0943bcbe3e1944034090bd1ac334804f7d5f1205a06182c9a1d52e3e29405a3b

Analysis

max time kernel
88s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
18-12-2024 20:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Size

171KB
MD5

fd0da4f3d8ff91c15da4fb93e8121e21
SHA1

93890a16d1c0597cd4e92b85b2313d21a8c7d41d
SHA256

0943bcbe3e1944034090bd1ac334804f7d5f1205a06182c9a1d52e3e29405a3b
SHA512

d9de2b95064cc1dacc79d9a5a7efb7c88e8eab58b96b208744c075583c3bf28b8c49c5276383ac4122211e3bab3ff9bfa02cdf465e77eef5ee7878aeeb0f28b1
SSDEEP

3072:uXyJStHyynWJs4JrboEwTdrqwGDSSh3+LT0t9NKKKIs:uYStSyWjv6qwGTq0t9NdU

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2169) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\S5hKYdJLhQgBg3u.exe"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Redirection.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_FAQ.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_script_blocks.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_If.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\winrm\0C0A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scopes.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_WS-Management_Cmdlets.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sbp2.inf_amd64_neutral_332943647e950ada\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_escape_characters.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky008.inf_amd64_neutral_9f6abc54cbf095f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00c.inf_amd64_neutral_53a58f4fd7d88575\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Programs.gif	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_wildcards.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\channels\OCUR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_While.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_split.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00a.inf_amd64_neutral_a89d2c01c0f43dfd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_parameters.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_neutral_12aaf5742a9969da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_blocks.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_aliases.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_properties.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeric.inf_amd64_neutral_27c5b45728cc9ed0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmts.inf_amd64_neutral_b7f0a8d5f67c19e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00g.inf_amd64_neutral_2926840e245f88f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Switch.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msports.inf_amd64_neutral_fdcfb86ce78678d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky009.inf_amd64_neutral_8e54c9ff272b72f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\pkeyconfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_neutral_7572473d88d69307\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\hu-HU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Line_Editing.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Line_Editing.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_type_operators.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hal.inf_amd64_neutral_232b95977cf6d84c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_neutral_857ff0fa9c73850a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_methods.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Path_Syntax.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Parsing.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cdrom.inf_amd64_neutral_0b3d0d1942ab684b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Special_Characters.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comment_Based_Help.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_objects.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_profiles.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj7.inf_amd64_neutral_7c21481229e1e66c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_command_precedence.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_environment_variables.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02750G.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_down.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382970.JPG	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-2.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_hov.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\weather.html	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Windows NT\TableTextService\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115843.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14800_.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bn_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_s.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02039U.BMP	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\VOLTAGE.WAV	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\SAVE.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImages.jpg	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\PREVIEW.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14755_.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR38F.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_left_hover.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\BUTTON.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\requests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Adobe\symbol.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Windows NT\Accessories\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Bears.jpg	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\background.gif	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Sort\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\PublicAssemblies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\45.png	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\THMBNAIL.PNG	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\More Games\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\settings.html	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19563_.GIF	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Document Themes 14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Country.gif	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_bfe8e8ad4acbfb18\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-diskpart.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2c57e9cd579f2d2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-wmpnss-api.resources_31bf3856ad364e35_6.1.7600.16385_it-it_57bed8ae38dcf6ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sendmail.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1e196194a0e8e07b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ec3f1f5c9198800e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_eb806fad92a5e1bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmi-filter_31bf3856ad364e35_6.1.7600.16385_none_3813b0e96fcac66d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\aspx_file.gif	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..e-apphelp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dd03b39304508693\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ab-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_60803306b12f3e01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-cvtres_for_vc_and_vb_b03f5f7f11d50a3a_6.1.7601.17514_none_ba1c770af0b2031b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.MediaCent#\f1f58d6720098d7c1d51faf7f326d72d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..show-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d9be1ec514cad222\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-console.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_acc820ca60e95359\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..lprovider.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c89a83791977ffb6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..kexplorer.resources_31bf3856ad364e35_6.1.7601.17514_it-it_72a3d14808861766\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-findstr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1fb68944608185e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-systemcpl.resources_31bf3856ad364e35_6.1.7600.16385_en-us_be1be094782850f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..simple-provider-dll_31bf3856ad364e35_6.1.7601.17514_none_1db72541db9236ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Error.wav	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-safedocs-main_31bf3856ad364e35_6.1.7601.17514_none_832fc1bb7d681e0d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ation-api.resources_31bf3856ad364e35_6.1.7600.16385_en-us_65f5d487ed6088b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tcpip-adm_31bf3856ad364e35_6.1.7600.16385_none_8efe707fa1acdc48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-timeout.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1f2f69abc0120dfb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_ru-ru_7b2a0898d09e3888\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-msdt.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2d52e09a1dd75908\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-chkdsk_31bf3856ad364e35_6.1.7600.16385_none_c1bcb003ee041301\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msf.resources_31bf3856ad364e35_6.1.7601.17514_de-de_7bfca3e330da6f01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_battery.inf.resources_31bf3856ad364e35_6.1.7601.17514_it-it_4fc28b4f1abef068\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..pc-tabbtn.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1aeaba6a0850e330\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_en-us_234809c32cf5e8cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-autofmt.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2a97368183221f89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-culture_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_af3522070c88b45c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_job_details.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..stion-detector-core_31bf3856ad364e35_6.1.7600.16385_none_54dd4ad229c92897\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-shwebsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bc636a927d5f8af1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-display.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9b1a17d72f9f22d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0446380dc1b5f086\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Runteb92aa12#\190c40c1f98dddf624b7e442286d76d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Security\Permissions\App_LocalResources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\inf\SMSvcHost 4.0.0.0\000D\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-instmes.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a5262a37d8880034\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_9d4aeebe4ef0ad3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..irectdraw.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9d5be3a38b80bebf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e6c6c59eaff1b09e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wlangpclient.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_05e99d037e04f79a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data7706cdc8#\d3c9daee844c6d685e059108aa87b3a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\Media\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..et-server.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dbb30f4bc3ba35e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..lprovider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_877c6e67fc518371\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..i_initiator_service_31bf3856ad364e35_6.1.7601.17514_none_3899b0ad2bb77a86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Break.help.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..on-common.resources_31bf3856ad364e35_6.1.7600.16385_en-us_441475eb6c6fa311\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..serverapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4d8c545a218890f2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-sharing.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_631f27f540ebcb53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000406_31bf3856ad364e35_6.1.7600.16385_none_456eb9d87c7bd6d4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ieinstal_31bf3856ad364e35_11.2.9600.16428_none_caf2ec2ca6b08f27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ooler-ppc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e369a2bcb3cf3f3f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wpf-terminalserverwpfwrapperexe_31bf3856ad364e35_6.1.7600.16385_none_80543131e5508a75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-h..providers.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d01cf7e9851677b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-aero.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9606d11873dc4c26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-10000_31bf3856ad364e35_6.1.7600.16385_none_802dfa0ae24dedca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..utcontrol.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_82d677f24a0acaad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.iscsi_init.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0f688b14cad0cdba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "SYOLECSRBRGHMIH"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\ = "CRYPTED!"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\DefaultIcon	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell\open\command	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell\open	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\S5hKYdJLhQgBg3u.exe"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SYOLECSRBRGHMIH\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\S5hKYdJLhQgBg3u.exe,0"	fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fd0da4f3d8ff91c15da4fb93e8121e21_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
291B

MD5
0e823b2192841b7ab657d598c7f8d102

SHA1
39334061db7b29c4ee2b9ba2e665602a57591ec2

SHA256
e9bb09224381f242827be7da5d3af8deb7caf0fad06179f69e9d41efa46191c8

SHA512
b50bd57d06242c68a8549a3885040b3809cb238d7f777392f530ed4569b0cd099831160bd68f9a898f3914b0379f1801f83be97680f70c08d96433e650aabe9d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
f0053a39917b83af3c3ee38d3ce3a2ea

SHA1
9cd39d54643153d142fc2cdd6442003097b7d5cb

SHA256
c468a63b28ce55f386b8662bb2052ab534364c1732a1a5aaa5eeb36b0ca3e968

SHA512
ebb5d363b7ed93ce0bc11d50884abe6fb6c3bfffa29411d8cedfeed892d234c13e445f02c5f0890b6f60715193bf39953c5802917da6817dc359875d319b0baa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
82e31bb2421ae27f9ae7efb4034d0973

SHA1
85effa89081ec78ecf6370449df7e31321fbb28f

SHA256
aa5878edb61be8720c1d6cc7e6e200b77dec12b3cee06efaa2b3d373dee3ee65

SHA512
fc5901a28143bfae1ba396b440cbec16b51b308133a8008682d1ec94424cf6d2a5f4710b2931323d12431efcbc5cbfe5c0ebf847f32824d3e1aed6ddddd2def0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
9ab427016766d20de6deb58029d60214

SHA1
380349b66b2dd59600a25410b9a01c6e330cdc87

SHA256
8a1fb48ab4a45fd3cfb49644b0ae055865aca97a77417db6ec5599cbff485068

SHA512
afea364c710c4e7ab26da5f6e109511c638bef1787417eb0a7b1ce5ca54322496eb6b3290493f46adb7a9147da84183eb61b3130e638cc22aba6e171edcdf9ba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
ebef6f0f53cbdf36218a7a0213f36fa5

SHA1
b29335db5e7a6379cd0bc8ec2d11ec5ca800f702

SHA256
6bd7ae58c829d8ed0d791f2af93a3554f7879d5922d78918c54b9b88ab69b6cd

SHA512
03a9f154a001c0ca43969e2e562ffe33a0dc134b73b70741245ea67c8e5520f75d4a4f75e8e3712222df43197c749ceb16318a0eb9cd14d393920efa1e290a61

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
67fa87e85085a92974e612ea2478a506

SHA1
bb3cb04b069177e06e9cc21840c6a3617b685fe4

SHA256
efb749e230a43c3748030398bd38fbfa272b86ae790776c2d374099d7abdeb0a

SHA512
83de8af97c66dca6c523a8480de70c8725b2429ecbff196f9f418cc1c1e105f3d73b7c62b95d34cb9f21254738b965425641187f382b99ce2c88018c91c919da

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
1900db4a9189d616add661077de221e6

SHA1
0f43a957c1006f639b50917fdc387e749eef2d00

SHA256
94301982eb7b271f4249a07f7c1eed87980d0eb3b48f5edab0b8027728806f0e

SHA512
3120d8a7e1d5838f4547e818336e0276dbefd68848d78f5392972e0af0cd4abc068ec91a89fde19200a114f05c490e38e06cdb534011a3068b7fa5de884d4ca1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
5230703a81686290d1b29524ebce4fff

SHA1
a917612ba438956449150f0445d574a68114dce3

SHA256
6153dc54dfd7a59e70d0ec927c9abeb91696bb67e8e5450c60bc9c87c3bcfcae

SHA512
92477efb155e6ecb6cdc17b565445fef6feb87b2c5d3b12c9a0875688ab975910c14d58b46a376c6db19c7a4a4fa7e63801ea0ce111c3e0c712f3999e60ee734

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
818af86514f8578f15254358d059df08

SHA1
1c747165d03391699dd19899d3bbdee0795b8c7d

SHA256
ee2dd7f28ca87915dd264acc69ae8f49d2d843d75d6b4b72dd9f9f2fd6ff99cc

SHA512
130f8077d4a4fa682ed6f4251d8f2e457fd51b7ef8c7b062e80772b809be763a2d482f13b7a27b8806ed8e59a5147a6a25f1b07c39d7a59db3e99edbc87c18d9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
b6b4d598f7a0168c44657fb88995997f

SHA1
357236b6e19d80f175f58e971876f77aab9799d9

SHA256
8983bb088e43910b76cd1955a437930ff336234bd120bdb7e1d2503b6ebbef77

SHA512
db934d1472c44acef7c9f536578e0729a22075a7d6de0b9e612f4ab8d4676125ce7bd8345318b1c68787674524a17369d1d2246cd908d8b24a75b7eba0971722

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
96a4acd89befa09e991c1d6b4a35a326

SHA1
098c9dc9aecebd7cf5bfdf7aa17d85f8c87595eb

SHA256
4d044fafa75f07060bb94a6ef5585544345a25432f2715b8a418798bc16a3dde

SHA512
60611b8b73460bfe70c6771493a7d21c58cbebeb44406f537029331806f4d292785cfc51602fe2925986ad24ec8ad272742c668582f902295ea74a1fc47f239c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
fa8d62b353e963a6a802dfbeac3e724f

SHA1
529356eff7b5db5c4245a41d610fb38eb66da758

SHA256
a1e95860da32090bae068f1a92fb35e7e5320aed2dc1bd8a8dd1d707b2e75ec6

SHA512
4b6616c11f0713e5fa37ae1cff6b27a9edeba8efa5992c0fcfd254c51ceecb8907f49f48d723df3b334dc581c648b5a07661cc05bcb4a442935dac4827e38b89

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
71d32fd6f4cc1a783e1ec8a41180e487

SHA1
c2a7811a8da3b448a2570dcc85e316db1b037656

SHA256
f4d2638c40a657b3364ecb613dd6ae6e5e44711549d513983600239f6ffbc5b0

SHA512
73746d105a931d00ca549210287c879355cb7a05c9a0ded68c9df22a1d6b8a42dd3690e9f81eb78cfdd2e83b53bf211896aff4013d43b64af040676a939cedd3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
0e10c63e37a41070a24d263f3041d071

SHA1
9dd0c247c2c0c4972253cc530aedd4ec96a1083a

SHA256
a0ffe0f875e217a74944c59125827d2054815136e07a45ebe1915ef17f14f129

SHA512
a830d0686070b8772b264c894866176a3cb057daa1fe16425488f5f144e03d9dea14d4c127a3c44f740525211ed952f0e7bbf4cf64ac2b7e40e36542888d407a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
1241a960ae9367761055bd35cd5b5a2d

SHA1
b4c7daef5c2810d0a466883276d402204d699a1b

SHA256
d4540c41e889c535e97bcc89a14c91c49d9b2d962d48ce12dc3cec67f295b600

SHA512
391477bf2c5ebc3229f3775e56e2e76485c23927636749707eaae2922aaa98b1d5b53367de2634cc06a36177bc3939158fd7801f4983c5a2c22d4442bfcba4f0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
35d62042f2a13ad0878bbf4acdc157c1

SHA1
41d6137aae37ef0b83f2a0744914841f1af0d96a

SHA256
919f90557393943850ce905611f97885d46c59a3e7d38b8692e80a0f14d0c157

SHA512
ff0cab9b4d2d66d0e2930c00e2bc1ba001613f3c3ce9a3734b28c3151904859d89aa6c160ae3bdcd740b043671e59bc56da8432d8b9b5bdf72a8ad0f9dfd41d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
33c68714e321bebab658e3cac3f8fc47

SHA1
94ac42240c3cdb282119b61c67bc4cca7e9670a1

SHA256
b9a07ac2f1837ad5265db3e3f845469ee0527b50234568053302713e9578571a

SHA512
c6b32369bce7f42d7878b2ef9f5908ee47fa7e1f360d96f5a8ecf4ccedd82c8c8f5234b45949482d071cd78dbbefa827f31e453e153db8c3f6f47023389c3b4f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
bc4c5dcb27bbb0d20e181046803e0e62

SHA1
21f1475c7a439b3a32475b1df24690da181d3b45

SHA256
487165f7f56e184e8bc807724d323bf8e13d952c044ca105241d287ef19b1cad

SHA512
2d53edf0137e11936e86a2cfe676b9d3e9a9544bc918241b9f7945de5dfe610f660e8746d763fe76628a069ed4a0ab72348aa8028cb4343a9c4ce22ec8f18dc8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
0a13132c70082cdbe09986efdc4c9dd5

SHA1
24dfab899479ab76272266ab9f3a92fe2e7a94c6

SHA256
c8af1a0623a28be5908aa6bf6e08fbde5e8e099a95536e982e7745d5b01c5baa

SHA512
f6478cefc776ec102f2eeca34e7d2af3256f2e92c3b56abb1a6ef21bb2e53390b06e7cf58ab2a1f2c8805dca8669e9be380e46517daa1706f7a4088b257794b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
3eb79d1b056eef936c3f77774bcc8500

SHA1
59c0f5aa87b22b749b103665d4372184011acbb7

SHA256
ee1fd4cedf599f45bbbf7319ba52431f54aa5d4f49a1340453f31415a06abb49

SHA512
50bf42ee5ddca64a77fd5c81c0e19a6b80f4bd04b992f7e38c08cbe86e096d4a4e9004b5511a84465e3e03e3cc297639ef3bb731d88a86e7b37a84484bfa8f90

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
16fd2ca3c87a9dda16327e55ec5a0644

SHA1
1e29772bfeef60978a69874c872c31048bd775ae

SHA256
8bfe0a26984bdba8bfeed2bec7e4c4f7546c3e9664c8ffa24a562d8f37cb9452

SHA512
f3296a86acca470b350c1338cc74081780c3f2e0173d0ef545a69f77d2a9e3e4857b64f319063a3a9f0948db87191df622143f3fff0c7457d6401ba92890f011

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
559e65bfd462c6d8bcd5e994dcac8560

SHA1
6f0cf9acb13cdfc0d63b93a1380e00cdb469f60c

SHA256
9bb8f59efcad40eec30ac5dbc1cbfd508a541d4744fac6ad344b1ee7d19b5d75

SHA512
79988e86a5c3e99005d70339624c82d2cdac412b5e1e02aa329b2041719ef22183f62444c4be5fb3d943fa0b0469d46b6a48e4ff9d6746212988d1e3a30c346c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
06e5b3fe5d73f8ce33dd276f867e841a

SHA1
a25d4a672c0ad7b834c78b21d1c06c2c85d69ded

SHA256
90cd285fca12423623e3dbffbf0d7ed69f2b360a732756aba8e2ea774e5de19f

SHA512
37b773c1c4e07ffd22b25df08311bd201d85edcb1ae7f1710c7c74723794280377926eaf55e6ebd22d319bdc2a0403c530eda9acd2b14c64e3771f1ed44af638

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
0bafe5405fec7feb30bfac81bad919f0

SHA1
84c059dd3025db04252465a1614abbb6d6dc5640

SHA256
69c857f6e482c1d7ad865f01098f694df164fda860e0a6f876382217988351bf

SHA512
de7e9986d176c125f5d4ef7f6e6c739e744d927b77f039b80daa72d6bd5fae70ec471975e86dac4d454cf8b74ebf3b2bfed086d0dbdee25e5ec5443536f336dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
e4c83cf5b7f735b255e20adfec2f413f

SHA1
ea36b43888046e1cb4a2f24068f04e82429d7e28

SHA256
49b80927a82be7a7297dd9fd3bd4ba792b3fc007e2d713bb04160c9c78d2a1c9

SHA512
f96a655a06bb13d543e2bd375df234fed5fea92dac8e28f0aa9ff829a8f77ba29b906655bb826af359362d5c26f3c46b080dd85f61be36db4fa791656b50ecd2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
4a97f4ae7e70128c34a82cc4eda38140

SHA1
1e9216a209b8c8c5c0a737f26e1c1db0abfce387

SHA256
2eba1be47555b988e4b80d50ea43509300d3c293dce1d12bb17a6689801c0854

SHA512
e50c4f64bd73dbe8edbf07cdecbc1364896c719d2dd1aab6534e88d1c612df75aa4b3295617f64e10b493302cbb97425e5610963680a0d5915658980bc50fae9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
4066294b97107b4962e331bf3c902d16

SHA1
f874187b98511a26122fc099361f2c2c4b22da49

SHA256
b1a2cdc73f217185efb3fe911847a2ca90ab113a478838dbe079ec778e5eb87e

SHA512
f1292914c9d1dcf9de8ce2463db24498442d5d96b33431d0035538dc50ce2b7b2e1a9181e5831fda82b7afe2f6e0925727f5a05ecbc87be9cbd0673c3d9ad033

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
7fe9d466d8cf45f9e7f14d4b61c4f7a8

SHA1
f599616d70ce34a4ca88da22a7da5629c6f591c2

SHA256
0eec06d81b4279a629223263c7e9e0e18a6348580c1b0741decd22c53ee7a958

SHA512
690b54b0f01d99a01dfeb6c4a29619ffc0e4847f7b4faae550e329468914db51a4f9068b06a3a9b3b6e6140d999cd333878a72dcb81ab5293f06a9f55ae98336

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
662e1eda307a0f760d23db2a21e1ad3b

SHA1
bbc5879de790e368fdf58b23d63b42dd3ba13434

SHA256
0579fa553e7e744440912dfaf29289da54826506bc5cbb1e8a0742923b06f210

SHA512
0a3e78400d0b6872b8be1ef1807b882f18e1c309910c774f363c93ce9a906e322dc5406f8bcdd2d5b6df5914d393d2f341cf84dd98ea6f28e2c3a843568b11c6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
ab55733065261487b0085e40568a4030

SHA1
15af8080189a0c0b9a562063c9a5f4c0b10afb03

SHA256
7184b2b929a51b06086fa77603ea7cf3b836180c3799c08f589345556ecb87de

SHA512
dee479fb38c0044ba1780c5ae08e3bfd6daa133ce4a49dcb2a47355085b4518dabf8972b468092c2080397e8b24c4c11e19b1c1796f9ad3a3c33313c9b59d041

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
0a29970d1d01e7f2968e1e8db1898a68

SHA1
29f92deea290ff5a455277493046ac67277663d2

SHA256
cd4e6d5dcbac42dc062a3157a7c2e95be0c879abbe9bc3362d8241a1d9e0afa9

SHA512
da1763462ac95d96472431df07550fdc59f7cc862288b73e604358a239e74ae21d937fe56428a00a0499b387883091d6527c6be733919ac4145632bba3a7efb9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
5614679af941cf958caa9e52279d735a

SHA1
25b2a5b1a1674ac9c693b3475cf04cdd93c15dd2

SHA256
006c8b691d554cf37d799b28dad39648499b739010e8ac622062e5f2d4d503b6

SHA512
985bf75102558c4e80d3377e3806502efd4a2bfb7e10a1d2c2ee86e4c122dc8363b815ecb1a31c735d23deca500b11ace2e727d375cdfd98e89e1adc865458ad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
e73f4980647b8f7583150d118b0f0326

SHA1
40e3f6f3cbdec9ef2ec09bd0ddcd158e8508f222

SHA256
1765d4f0f00b49dd87835dff29c5fde9cd1857dba14a64edb5645d61452da7f2

SHA512
c890c78accc0edb032424d890d31270d08d00114e8d4c3364291ac674601d1d43f1af49798737f0be95c257701b90064c2f7839a1bc879bcae7c7bbc5043f6c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
48a37210378fce2d3d925ba3951fc891

SHA1
2a60b87bb7275d97a7c4d7f55d7da5e999951a91

SHA256
696b903b6c30ac2032fc24b079c7ee906b6ea209f605a6630be503419536b02c

SHA512
77b3ee55c8e82673cb1aef53d4de35daf2a1136596ca22e4e80d7de067a2905a8d21413f1e121dfb3bd412298acf140e99a67439568bae7fa4184ebc0dd96f2f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
5efe2e11f8a51eef4ec67589a0211e17

SHA1
86e3e844689d90ffe41ebbaf43c9e71553218eca

SHA256
ec894d70d0403853ed2bad35371c57579bad7fd7962fa35a8db9b415563ddd94

SHA512
5c6e87d8fe6f9f71fc5bc18b71cd3f358e5c5b7d3cd3bc747ec60ea18dac40e6d074e9999f76e04c776c6ec9abab3dfda52a715a678b939cb76c6508f63f256f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
bc884a6f2854a8270c6053a99663b4cb

SHA1
1ef783fb0b0f90cac84c6295166309ad58def57e

SHA256
f5862ffa12e4a6b1fbc2029f73664629e2c60996acf07b136c24ff20a4f6e0a4

SHA512
f344dc622079b31bf2101f7d53ab883d0a2c7796bba6127c00b4549d9dda997a0264f0b4037255e3d422487f5a0daa3c05a1bcf723f61fbfefb0e77f8949cf22

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
e869ea0f35be248558315a65cbafd28a

SHA1
0f655804be643e39c5e463edaddd411bc07dfae0

SHA256
5e6377e1571f0ebf2579d81c57f7abcf7a1b0d2881c913fb6e55055f1adabb04

SHA512
3667c231957617687b019da8bb25ee1d975a9fa0ee2b4061eb3a3481c6eacf5640d8bbf8b4f8981805366f4cc34972b044aa4420d3031064c893d6ea3b75b080

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
471de9004fe81fc67e14fa7f22b36fc7

SHA1
229ea0a89fd40e83367b4d8e12bf75a51fb1a7fe

SHA256
b5150b01e694301a4b4537dee3f04d198fc0a2b0d2ecf686082a7d7d447def06

SHA512
4f5d0e73493ea9ef530918342aa8ab92fdd1b0ebc76d07d28b97ffa741b897034825c6d946839939cd7693190d4e5105ea061985330a43df1ed6d029cc2faa97

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
02230d346f9435ed9a8f761642d8f1a0

SHA1
7b53b3e849225cb6f1a185d8afd3e483f09b403f

SHA256
256fe3215a25df8bcac7d22fc3540afe58a9615a1eecd9cd905eec00290efb99

SHA512
ffa7297b3048cbb15d0176528e0bc2de277f882dca7eb77062fa492f5207330ee233038aa23ef5a63035681cbdd240266960646cad9bfe9cb807402170c62935

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
81fb2e00fe55772300dea1660c5ab70a

SHA1
c8b8331cea99c26e4e8e4cfdcdc7e9f7387871ae

SHA256
84ab793cc1e6b01de4282090d73e571a7afcad09fcde49b09f642bf8ede3691a

SHA512
1c5068d94838532032efc24f86b6d8daf829c1f9e724f408a73081f8643f886b04356397afeddb4d0032e0f6e3cadf26b88ea3bf6b6a1d5a5b1eef650cca17cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
9e44612a1948c4932dbfe7cd9bdb3078

SHA1
cd29f05e4d4a9f212c3ee0194c83905b6516029b

SHA256
176f11ee52f684010e487bf51d2b3f46356c8f1c63ce0df2d04fdb0739d361b6

SHA512
f287f15f6ebb1ccba147bcca67858da0516fec6689da35141715be19b6b2f43731c4492f6872132a1c11d9125d6ce95cf4a293acca274d5d32054c5e1a7d0720

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
a0d00aeb36e9fa3226e28442cddb8646

SHA1
4b2ef9b50e4a0ab8fbb27619f79bd51790b244a9

SHA256
a80fed0b2072fd13023979bb8115bff30fb45ed13d70eeb4d36f61c69c8a39e0

SHA512
3853f5e057ee776fe7fe12a0ec9fc26b15e6c9975a960088ea764e14268fca77c48f839715147b1c88a9d7535e85a7249c04535a02f889e8339747eab2111e1a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
b57a9b22dd5c2df01f4e960a83322fa9

SHA1
ec5a87490f76739ca8e6b07b81bba8e7f88235bd

SHA256
51256f13322e4030c77d01f7fcc8deb6c097b11dff3ae96f0d4d851b5285c493

SHA512
3f20e5f4e9e6757fa800ef7365d71f7fa3d0feb121cac22f2e4e03862fef6b87dbd5089ac3613e3c72e33ded3e85bfcb297f677ef40ba828c4d9d7348b848c4b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
de93a7454d1a7a0f40f81c4bbf8a9180

SHA1
68f22bec1d376a30dfe7653f6846947cea28697e

SHA256
f3e3b677f9e3fc38b3b3a7962ade1423502969525d20a25bed84e5763b0586fe

SHA512
5f715b3431ae3ad7fcdfae551b16720c53dc93f3d98f77987697bab4d4ecd35df4f4a3fea1bf6056d98939a6ddcab6ce4ff040ed791d573b319efb4bd92a84b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
4d0427f347d38935e62a67e6d15916a1

SHA1
f0204d02cef47d56d63856fbaf104b7d31ba20d0

SHA256
b50a8327a91220f890e337189821e44603d73fb0aec1da5538af666d0d6f399a

SHA512
5ad484d3a935e5381c557f7ade6b28bdd321855f7268dbb2092fdd4e525ee44c77488e40106ed1661efe372bb941e8327389f655388bdf1b666baca67129347e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
c16c2e90f55b237d12f95ed482c34d0d

SHA1
eb9402615ee4d992287cb7f1d8d959592ca2aff8

SHA256
ca29d7937e8ff33721d2dc2af0ed11b1f105421993661a07466b000ae9755324

SHA512
3bebea95c78bdd0cb46933a12704b786a0a55c21eb542c64f652050fb964196f2aecc1861d05ef3fdf2b3b11824bda6a2772dd1d713e25e14735f5c3c03dc59d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
cd346f50a807b7dd41ba8c48b383a48b

SHA1
2c37042adb776d8b6cace82378f2e7d12ef32c4b

SHA256
8d5ee4893e456d241defb62290ebe46d047373732cfd6c8334013471f3d96d62

SHA512
ad2adabd42a9dc06ebd28143755f3b3462f8159005b7cad4dc33209639d3c728e5b6bf0068a08ea085384c875107d7cd14fe0e1fa1cbbed9309bc60680fc79a1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
63e18df0c059a9e6e683048f8d5bda6e

SHA1
d9dced73a749c8572fb45747ab30ff52c0600c28

SHA256
930e11367ebea7f67a6b5d5403258fbd7c50e9b73fb5745bea7aa98a290384f7

SHA512
55bc80be776105f44b802efb56c2ea1b8012b9f6696e309e1ff329e2271f902486344742c714a6372b160ff3c6f08e0d1761f0b50b9f0f97f8dfb9126194060c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
a9a2e2ae21dde752f5ac97cfd21a1666

SHA1
81a83494e78ee3403f552e422eba2572097efb02

SHA256
2f22b343249692a8ab873734172b9402845ac5cca60a38b95bee033b6bc5b66c

SHA512
39c3ac3b342d077aa20079b69bb24db22d8698c27e42b5501615da3315935d5c1104aad53aad0d4e9ce6b0c86423f0dfdd6a8b2327a60316da8e5fe56904b61d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
df673311c3572dc00b2851bc4c8c306d

SHA1
5736f4079b7be6d1cf100340acc86e245592d604

SHA256
2f737c7e107ad27aad1d93f41f686c657a04bfaef5f9886a580d3667ee04b36d

SHA512
4ad6433f1ed4e49c2f01dd0461402084991603693a71f4ee7238d28faa4755a7ff31c13766e0f804eaf2d2b805bd76f20b5d13e7ccc6cee5a7d8c86828ea7f12

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
eca6b9872d83e6b92c086b6cfba24a09

SHA1
883378404f48c75e0b997cbaf120b7e3f650a2da

SHA256
bda2163fe0beaaea9714b71aad42ff57e3674eaf8f0a8ef11925de69ec76b5f2

SHA512
45f57b4030d9c4383998b8318d7c958cc0d1fdc80f0fef537a2fcf3c0356ac45430ee22f7c7df58612e347561bf18b7d9d6571dc9cd61e2862aa5e1e10b847df

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
159575b4b9f8a81dd0ffd3a881a1b029

SHA1
fead8fa808cff28d7cde3e166cbdfbf0ac752b75

SHA256
0182eb50f5705f0117127af1b39d1c61c5bd823b92daa7676a47c2a8e57eac23

SHA512
865b6a2bf5e2c21b74768396036330f2598cbfa835eccdf3ca6a4d5d64bd4e6feb871dd010a44930ef9d6655f4a85019c5ffbeccea48d41d453b1e248a1e3201

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
7abfc5b2712a8dcb168344230c8392d0

SHA1
1bd21345ce1d3f28a6df593c95465cefe080ade4

SHA256
ac4ac233e4bc1d8f60b2aa17f6fcb2e10046d5a77132099219ec4b7d6ac4c31e

SHA512
2a746ac35ced9e613619a8e2078c047c0079a042547dc8566541dff7d8e0207ad1fa2a58ce2f569d75d2df45b1d1bb30fcb8e60ff2c297b8c80d25166519f5db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
9058e688f741463272a9cde014d9f188

SHA1
45ce60497248189b906a38760a8226aa31975373

SHA256
96ad576c53ed876349b5b2ea6af470bbe66c1c88b771b3f27c3f32ecdcf3cfd7

SHA512
4cf4a6e41a7e9493122a5fc4d7cf3f5f6d27e176932d6d2f35fead5f218d4c6cd61c56ac7df648575a40a530d5b35a82e195c75793a4758549e7035bf4a1571e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
91238c90847e5389dcd7cd66bf7201fc

SHA1
00590b80068cb4456035c708e93fe3b02039a44f

SHA256
3c43a5283ba5d124c6bf1123f95215ef4bdbacafd25be93a3277f5e2e6cf1894

SHA512
5e4cef7ee7032ca5ca8f082f47bdb6d645b5d9f68799201615f040143093083bf48d10f79cfa292e9f44192d778ba53a64889387aa1e04f51a91f50221298d86

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
9457deaf87a1db61a3a7444825e99e5f

SHA1
69a64b96e04cad28ae4eaa5929579b7c8c4eb040

SHA256
d1cfdb5e67dc8732cc879410c01c1ca911fcb7e34804823141c02152bc3d2972

SHA512
c7921ca7d181527dd4ce5a1a7d76900ca782c090fee9bdcbcf5f4797bf057aab160603fbd7cbf1ae2701c6a83bd65c5b4259c8e830d55e290759ccac1046cb88

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
7728d088e8d8c157ae0191e4448b78c7

SHA1
d65a2d5bfee0896c8ff4e7ce7e5ce5db4988fe49

SHA256
eeb3c8b04d20e00f07e1463adbd2343b97c2dd07275911950d5dbc198cceb4aa

SHA512
ff07950c51d58b3f10cf3af5d304fd6f218934cce941d2eb52147831ef5f73262ebe67f5bf29063df20ad207c53128c83e1218d815743aade4a916e0491337d9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
9bd8b151903c8258eb4dde9b8fb641f7

SHA1
0340443f8a2da756339d18aaa96ff88e33d859e1

SHA256
f296efe82d5e3b791ed40d323df50b31238e87d35b6dd616e69b88539f7baeaf

SHA512
93746c9bebee97e2db28ef9d81dae7693848467fc506833fbb50a9050fde7c41481addc54ef99a6473010a946a85ee711697d686867dc8130cc5dd6ed5f2cc8f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
0881c11a1154327c5d0405545f4fc35f

SHA1
be0b73ff518fc2742bbbbc7b4a63b909837c74cf

SHA256
9ea1598e7dec64d9d1a1121415d88730b17b3425c2f401796af72f9acc2197fd

SHA512
a5db6d3e7768edb21668aa681bdbd9ce7e9a1787d561f3b678b4cf311633047a2a1c2113cee79c79d1591d1407d516bf96aaa6c4bacfda79bb15b0f855f14358

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
ea009490145d226c66d515864a8e0150

SHA1
752f2a323a518fe87eaee7fd4ccfedd5a315e466

SHA256
72179fdad4e71fe486679508f00f84fe5b57c6e1f4855a7f0b39f512c48a4e1d

SHA512
edce44267a36918f87b58026e0425a16b254394635a84269c733897f8031115834a932ca37169f70cc163b0b0e0bc2c31352653fb9d4237aee185716fd546144

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
f624313a5f78d908b38d16e35c4e317a

SHA1
92f255fa3615215e8cd11499225a0fa7c7ce5b06

SHA256
8b95c4e7db57e93b4cc692794de37cdf90e3f2f5b3ef081518437111267b8cce

SHA512
81628de1906fa9253e12be0cbdf4a87b34eaac81cf7b6fcd180b5ab2bdd103c419e4788bb9ed6e510171dd5fc3d1300788e47c95edda0f253f792362dc481bc4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
87948e0043efee770f727cfd6d8b1216

SHA1
e20937dba7b668fb6a65704b613cbc1b54106586

SHA256
4de84db5adabe0ca37b3ef8084a872fc328e3f040d013ac13aad1d53b9d6ef30

SHA512
978bc5be6475bf3c056a0512f9e1da6156ea31fa3404d93f8c3fc47a6e12d2f028bf7a63e65d1920925deba354dd9ad0e6329f8c334d9d7cf63154490a7d86fb

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
ac7a031cee1717202e883321b76d6016

SHA1
a9b2ba772533ed4d903c9db3d67e538609d68abf

SHA256
263f37866723945d18a8cf7e0fb8b57a6da19d28f004d86cc48e2e0f2e1056b3

SHA512
158fe09bb271f7ff6943c14de756b3cf899ec396d86586a32d6ce8b35d0d4c5e7d1561e7cacdf2fa3ab1e387bfa7ffbdcf718142e7401134bb0dc5c57230b994

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
33077a61d580c2ce87aab314b0a95a14

SHA1
e081e2f642c727c19914588f3c2d6b89ed69112a

SHA256
1a741b90e204b813cc12793e7dace9d44ad88b430bf1e9ffa164081b5d951260

SHA512
8d19c9799761b11bb003ccd3e7dc439e42efa65508f57eb437959eae2cd901865f852a027ab48b216b41e0a16f9be89aecb35023d951eecbe5d64a45933ff3d6

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
7fb5a9780402387b847cec43894e61be

SHA1
4f71b732fb15d831cec55c6be7846611a7b08292

SHA256
dbb78c8e830884f701ec160dd68d8d9726e1cf16ddb7c44b47846dc31989113e

SHA512
1b8df9d5734de74714d9384a4ec8a52eecaa5a1aa0a00bde2e8a642cd805c3c91faed9466bdfb55c6e3f3313c84a41a91542d3d744682396a7a661ffeb8bbfc6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
092611f93f33071c12f4f73faede8bca

SHA1
c46a500d2a25b4ae289d892d8d55e91bce9b6554

SHA256
e6c3231bd51faade0c434c44fefe2cfe93f197df7507dad9a066447b6d0f8a48

SHA512
51d790b214fdff6214f7008f71fbcc64a894486ee60b61352f271a4fc1403e486560ae4d119a3578293c097ba91a9a1458d0865344cf5ed8fa8036bb734177c4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
bc0c7bf74dc85b0ea2f633286a2e1711

SHA1
1089690fd87fb04cbcd5b838ac95dd37244ccfc9

SHA256
e752219dd9ef5fb47f8ec2a92486af418fd95877b2586d7a9329b8a3b18710a5

SHA512
bfae19e38a47bf361a6a8d5eb7f278dd6e54c0acb652d99bdcf2def4a257b58ef909ea6b364d03e59c0e5663dfad9df84e78054e88fa53c522d71eaa5dba5288

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
c526504658de7e24a19271c235f46ff6

SHA1
c04fbf18e5f65275a401a9a5db93387e5f39333c

SHA256
a56014b1ad47d7addd7e41da62eda392a6bf5b23fcf3f4930283317e4a2949f4

SHA512
6798ce504492d45c4fa3849aa03a6f924938627bfc27386636049a9b0041539a003ccaf43c014504047a2e3736911ff588547fb3a95ebb7182cedddf46f9eb76

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
6d859cea65128b9070a9e0be11007f1c

SHA1
8e37e7e98a748f9be7a8ee48a6c5b71fad8a3faf

SHA256
09c651857ab777c96b76fe33bc27ffd862e0f02a6b57a7e81412e87101cf7728

SHA512
a7ee2038e4cfe4f0e948acc4bae6c847580c7b165121b3c2c3eb66ac774472974fcb52297d70a26f19d7b43991b459dd7c772d16e7293107ac11bfa0fd9ea9ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
7d6ed6e911e0eee74c6c7350634acced

SHA1
9fe563ddcd0fbd916e84ac410a79d92041041fa1

SHA256
f9150896d019cfc401ea13facba47f30e8f7786bc1fc1e66d0bbb47fd0983806

SHA512
a9212dcf31928337dc25ee5c9171cc199835edad558727437ab03432a01c491c58225bfe0ce8c7f0f78834eedfa7c52806891b5bd82d7c7ee1a36635c4f44dba

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
f4fa8bba95d2f44c238669718eb8cd55

SHA1
0fc1666aef04cfd1180e5fd8a969c7aa5aafadcc

SHA256
7d9ee83efe0791099f1dc46ebf9242790e14ab0b45a03e2180a4fe2b9d173d26

SHA512
6b92e179a829986774bf164e76a30e05248fa4b390fa50b48f3bb64620dfbea6072241c8886e9c464b9de2ebb7c6de09e87b57ff2d57ec16b75f4107bf5219bd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
e409fb580d91ab0585a2a61ff55d2313

SHA1
206b3fcaca4e8f8362a5be21731caa7797736ace

SHA256
79a6b617c5d440a414e94def10d4acc926d09fcab43990f2141b0c68414f3d74

SHA512
de37a5ce29b334f6b9f0513a619ad26992d8615f9d1ea48a5aedec278bc5ac703403255d098a82cfd3b0c7bac52bf98e160a999f98cff8f8d76e1461c32abf30

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
adbfd48b176b4d391bfb264a1275bda2

SHA1
e3eefcff5c020d07452a660fc1493171e592ef58

SHA256
c88fe07bcb7af0bf08df26b4e00458edf72e03f9a1c8d0f67b09228ff375bbb9

SHA512
35e3a7504fe1f920ec72590754699350ac7229f30cc555b7da65bcfcf517f92c59dbb49f7eda672377bb26a10ac384e806ef0233b4573717350a35b7a579e9c0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
b423af9d7700b913375436b6eed00254

SHA1
19d8b3c86ea33ff6a65b8bf121f09ecfa869e435

SHA256
8e797c19b2073e60f4f5b7d62ee2dd314c00212a82f337309a10b9200d52d4b0

SHA512
81a5c9d7ecc7ae767c4750a9c320332cea3369b915dcb58680118fb32383c3ef40f889dbfd77a3ef06532175170907ce70cb41d40249d97d2683d07be1992d82

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
393d1062b4d22a5681fc45a68a9b5746

SHA1
3617b99ff477dd755d33334682d4d7a5d010d921

SHA256
b6c93f92383a428426a7527c326d1c04eb1c5ead9e4b1a0358a2384435894010

SHA512
70b5a2e38f2becb58fd54a29420de47faa4c2e06cd70f8f42d0b3aceef1c77d6dd509f6884a5f6abdbfffd6293d21006481bf550ebc425b5f8aef7b7750e364e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
d02b7220ce90d7c8e3ae38ae149598a4

SHA1
df318bf256425ce3bda38b10def747d53191efca

SHA256
6cb21335331e38eec2b27103ac334247dfec496ef6558453ba3e0369aafa8781

SHA512
7f6240b48497867909c118770621739c30ebc4f0d55b644c42e4d92816516ca0821abaa727adb5b183fda05bbc3ed71201f049970016ffb1763083f072a85e4c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
fe6708820fe59ab0aac4dca9b7cb2c4b

SHA1
60e6febc146a7de0519576b1e872583b56b292af

SHA256
4601a1b1779885ae424302d3c6ddd32bdfdd12c3074b032efd9c145158b3e10a

SHA512
2c16110ae6ea6ffb85d0b9fda1823b23e9925a6691027a8e65b2cf7fe63960a4bc7ac0c0a3e98ee8ae5329989032e32802882ef084ca15f4be65b4554890e1a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
77ef511c7a7cb8b83067d690b41f097f

SHA1
f3139229164a39640d98920c061c1c204f678d32

SHA256
f130d46ea70b70c9311f5b9021ce8b5c1c17094ba1669cb4793d5f24ca917d13

SHA512
3ca0d69101537ff3e98149c1ad18fbce589aadb7a22b0892a6e584d7be906256be698ef942da30495d0856c7ce6a679bf2aaac9683ed6299c2d72ce460056512

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads