xorist | fedaed2ba9d817383802e8cc19a64b9e08bcfc729cfb0dc710ec87f945589ef7

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Size

7KB
MD5

fe6550da85f85e7c7eba13b67059c27c
SHA1

19ca7b595d47f254040551725a8d50bcca564cc1
SHA256

fedaed2ba9d817383802e8cc19a64b9e08bcfc729cfb0dc710ec87f945589ef7
SHA512

2b967097170aa5b3ae974ed8e2fdc67545adad4629c28e5cdce6e5f64ddfb9969dd875a41a749752b5abc1abdef7d5ecf08919c45522b679cde1d57b6f3d1c69
SSDEEP

96:l2Zhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExZO2HJSEbUZMUA:wzdrr1FG1WDCgmjPZZO2pXUZMUA

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 5 IoCs

resource	yara_rule
behavioral1/memory/2024-8244-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2024-8239-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2024-9164-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2024-9165-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2024-9166-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\q1xSCFkG1R2Zkvd.exe"	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\memory.inf_amd64_neutral_c2d2c213c3138487\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_locations.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc8.inf_amd64_neutral_c93e7023ef90e637\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnod002.inf_amd64_neutral_a10c656b6c7c053c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Parsing.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr009.inf_amd64_neutral_fd2ac5b9c40bd465\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_type_operators.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_neutral_a9cb77fe1985cd2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wnetvsc.inf_amd64_neutral_548addf09cb466fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\icsxml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_trap.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_data_sections.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_WS-Management_Cmdlets.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk00.inf_amd64_neutral_9c0c35afdddc16d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnkm004.inf_amd64_neutral_d2aee42dc9c393ea\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_profiles.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_requirements.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstorcertdrv.inf_amd64_neutral_2e1cecffae9c899a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Language_Keywords.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0010\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Comment_Based_Help.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Line_Editing.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_neutral_ce7bc199c85ae0a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_neutral_8b26ad5d0cc037a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ru-RU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_join.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_wpdmtp.inf_amd64_neutral_daa64ca27846aa23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Windows_PowerShell_2.0.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Signing.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_While.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\da-DK\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2swtv_noavin_x64.inf_amd64_neutral_86943dd17860e449\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_prompts.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\el-GR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sv-SE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_try_catch_finally.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2024-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2024-8244-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2024-8239-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2024-9164-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2024-9165-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2024-9166-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_hail.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21323_.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR27F.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\slideShow.html	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_few-showers.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\PREVIEW.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\diner_m.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_few-showers.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101867.BMP	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21318_.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-horizontal.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\METCONV.TXT	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\control\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384895.JPG	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_ON.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01295_.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg_sml.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EURO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\back_lrg.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_alignleft.gif	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\slideShow.html	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\search_background.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_hover.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21322_.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\Windows Media Player\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\rtf_spellcheck.gif	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsImageTemplate.html	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR4B.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\REMINDER.WAV	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_120.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\setting_back.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\index.gif	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\PREVIEW.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR43F.GIF	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft.NET\Primary Interop Assemblies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Hearts\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-iisbasic.resources_31bf3856ad364e35_6.1.7600.16385_es-es_cbc237847d1d96c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..oundthemes-heritage_31bf3856ad364e35_6.1.7600.16385_none_5872c0830d0c4747\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..ervicing-management_31bf3856ad364e35_6.1.7600.16385_none_5e7ff93b6f0000b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.Resources\1.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..xtensions.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bec88761433f76d6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_try_catch_finally.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_display.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8b846aed56c71c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-csc_exe_config_b03f5f7f11d50a3a_6.1.7600.16385_none_5bfb623d555cccb6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-10.htm	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_edf33f857603a056\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Routing.resources\3.5.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\inf\.NET Data Provider for SqlServer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..i-printui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_bb6744b750df3f3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..mostfiles.resources_31bf3856ad364e35_8.0.7600.16385_it-it_1a0000fcc8c12fb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-hbaapi_31bf3856ad364e35_6.1.7601.17514_none_b18e5ca4be201fbf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-icm-ui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6b38fd80c04a1d08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ontrolsnotification_31bf3856ad364e35_6.1.7600.16385_none_43dbbc089ccc3461\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-takeown.resources_31bf3856ad364e35_6.1.7600.16385_en-us_122d3ecc0a9e8edd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-redist_config_files_b03f5f7f11d50a3a_6.1.7600.16385_none_4fb004028b6c4e65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-ndis-packetcapture_31bf3856ad364e35_6.1.7600.16385_none_4d454bb22550e39f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-searchfolder.resources_31bf3856ad364e35_6.1.7600.16385_es-es_7cf923f66d81e6b9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..se_standard_101_key_31bf3856ad364e35_6.1.7600.16385_none_656338ca31b9f5c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ctory-rll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c1cb3e02bd99454f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_srpuxsnapin_31bf3856ad364e35_6.1.7601.17514_none_f90cdec89a2cfe80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_82258a09c9170bac\settings.html	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..river-wmi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_02c952f0fb621d63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-mfmjpegdec_31bf3856ad364e35_6.1.7600.16385_none_7fa793baa201214e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..iadrm-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b1ece08ffefda708\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..-gameratingssystems_31bf3856ad364e35_6.1.7600.16385_none_902ec1113c6f875c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-f..mutilityntfslibrary_31bf3856ad364e35_6.1.7601.17514_none_00cb21b8522f43ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-panmap_31bf3856ad364e35_6.1.7600.16385_none_c55145e338d63048\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000481_31bf3856ad364e35_6.1.7601.17514_none_4fbc1dccaf38d2ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-notepad.resources_31bf3856ad364e35_6.1.7600.16385_it-it_068592e2b2d613bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-nlasvc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_11cd7013a76769f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..-ehepgres.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_900a9e439c316916\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\button_left_mouseout.png	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-restore.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4168c8a61a9ddd29\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_nl-nl_1128c41de12dd9f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_lsi_fc.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2027b86856e610bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..rvice_mof.resources_31bf3856ad364e35_6.1.7600.16385_es-es_80f1f0a40b5d6999\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7601.17514_en-us_19fef411813ba5c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.data.sqlxml.resources_b77a5c561934e089_6.1.7600.16385_fr-fr_3475007751890860\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_WMI_Cmdlets.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..vices-configbackend_31bf3856ad364e35_6.1.7600.16385_none_d66b4dbb52eb8cae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..ctionflow.resources_31bf3856ad364e35_6.1.7600.16385_es-es_12cfec11177e9269\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..r-service.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1b58d4a08917a5cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-time-service.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_517d915ca0c7b0ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-usbrpm-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6784fa962de60a17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..cconf-exe.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0b9cf3a70c6e1585\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-class_ss.resources_31bf3856ad364e35_6.1.7600.16385_it-it_28edda75bec5c04e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..ibinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a9c0513de07d482f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-winver.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a5b512695f3a1cc5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..rformance.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ecba0a69c28cf438\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-migrate.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2c87dee4afd2be82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-fontview.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d3adcb49ef4c5651\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-winhstb.resources_31bf3856ad364e35_6.1.7600.16385_de-de_294057caa0539950\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\inf\ESENT\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Assignment_Operators.help.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-r..tance-exe.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2158dcccbc38eb5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..grams-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_88b54f09fd7b2c57\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmi-tools.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d23c403ffb6b480f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\DeviceCenter\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW\ = "CRYPTED!"	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\q1xSCFkG1R2Zkvd.exe,0"	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW\shell	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW\shell\open	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\q1xSCFkG1R2Zkvd.exe"	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..buyAV-bomj	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..buyAV-bomj\ = "TIAHKFPZBUJKCYW"	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW\DefaultIcon	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TIAHKFPZBUJKCYW\shell\open\command	fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fe6550da85f85e7c7eba13b67059c27c_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
5b5828fe8e041ba8b2365feda7f5df48

SHA1
0da4ca06ef76c250d296c4fa9ac315f96912d6bc

SHA256
2f845196c3ac28b0d0cc3adc289d25ce8000dfda27f19677863122e0332ef8e8

SHA512
084725608c77180008ed60b78fe33394fab220c8a046741f2d9880d3a35396a0980f106f3acecad03aab538e9ec8aa97f8f6bab944a82bd12a5134a2130e358a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
f96450e6f5e7b06e177e56ef508e9b17

SHA1
67c438f0940f26d1940e8850209a23508050a2a2

SHA256
894b7b9a5369d8f32a75c7e643da0f7d1fd6b79f13daf74986f14aa6414f73df

SHA512
367cb5603740e38e75597196b6d05fd25325d520252c618076ce1de92e77d0854e206148e1f9dba8cf71ef74ecc05c91734946d4b9075d6e11f872f369dfdb75

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
e9e190b4ab3a7f91aff6077f09b78f16

SHA1
8aa2e195f2ff870533da542bc07a496e72f8b644

SHA256
df7a1f70f42152a62739b298c58fffd14ef3a03e98689386a9f6c75a57c562d5

SHA512
6cce49d4794e99fd016c31dcdbca4fbd6610f9906c0874bbae8c894e917a09351d01d27c04936f9be6c1e392ebb1b7a1304ffb3c014e63ca75fa224f9c16a252

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
463225f38941107955dd7d72329d314c

SHA1
75216fcbe3b980cb04d61def2bb84ca04e796e78

SHA256
ee40e625547f68d4f284a6ca66b30580defdea7e12b63458f43d10faa7007108

SHA512
4ee9550379d6fd314d91d4922805205b59c4d4836d07a177eb7bd7efcab9ec2b5b0ded4ab8a7f70c047e2f5d26fc102f0a6f7cebffb4c2f0f14847c30d5cf6dc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
2bad8aacfe422443215f18c8b8620b0d

SHA1
6f5d59c56a10b9d5a70687089b9808c7c1b9e2fd

SHA256
6f54c61e4cbdff999071c55e3ccd75ace08fa7190440fe7e5f77b39d49e08190

SHA512
54c009ee1f752c26e2143bfcc3499743d1f92e9a2f0d926717fa2a7d291e38b716d5641b037d72801966ab476ee05e5e2b2a127fec776bf7f771ac53f395f8cd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
ad8a7d2486e184e6a8a19e6161a23f82

SHA1
2ce23a10e52aa1127441d8ee294c0f60e64f38bd

SHA256
626e4ac43b06e4f7103f3455815828bc25a9731b1464869e3e6f2cb230377a05

SHA512
1a70f95230c203a271d58f7edc4c9af8f144027e181457a396f64e4522635e17b02ba704403b4797e9087d80c0431b5dfb1b71b3295d3279bc186fe76be26272

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
cb8c5cd59bd0fbb2c6ea3b46142c73b4

SHA1
922df075fa813aac5783e5778e24f60d8bbf0e11

SHA256
b8b19724c33aa4343b75fb0b77d95b7432325c1891e1a53e1738b761799eb1c5

SHA512
3737b71c11d8a8201b333db9d9b34c00c931bb7e3dc070cb20f6e4aa38b8ad66a629997bd443a3308555abe26bfbab6c35942ddd8312bd4592d19af575474c7f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
c426531a9c2e48d9017f851a4d6ff127

SHA1
f07302dc076b0fe4b24fdd91a335e62f09111738

SHA256
4098376aae6b108c3c90d9c988ec66192fe6a558dc8cf65eac9e53758bb41c83

SHA512
6e5c16f3a41ec03890381d24906d3f013486096dd45e7a7ec129b48c0d2823658aa5534bf5e2dfc221232da77733989298381b7204087a45f764e9e64115ff14

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
675bcfa6940587f5d47252dcce2c2cde

SHA1
6f6a90e7a3415c8de6e002a2bc71719190f08630

SHA256
4e55d421c9737dddee1d7b4abb2de6f7cfb6fc7b0c87abe3fefdad6f722cd60c

SHA512
37b8c6002b68b6812d77abe068aee636f48e10b668b374966475546617eb30f88e3f21ae4c9c6d7840b5588b1b8cb621afc90037cc55dfb1347fe009fcaec876

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
adcafac7fcc6efec762aa7f13f902675

SHA1
6af7f33400c0652c0330d1bbbd753573af1ceae9

SHA256
0574c648fca205303ef4218eee804dfcfc9300407b83fc3de44c04752cdfb964

SHA512
ffda6b5a01c003d29b273460f6b1b128f535b5acc12b84f426c107906735145b00b8b5b18652af2f1ae483c7cd2aacd465f1ab81730c10f2ee5afc8f6cb592a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
53eb5028799c43d2682ad630e10fba61

SHA1
f544471ec0d7942de99c5388bc29f9bee51aac67

SHA256
1b7a816d198c9f55dfe93780647f6088a6a61f6d4e2c39a89cf089aa530cc24e

SHA512
e18f2253a8ab13b5ca9c2720ce8a2d80dfc120f90f431a69bc61f8b7ff0fe4b4cd4097fed9b99136a841d353b4b8e08ebb975f0eaa9a5657c9f002863cb630cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
90f906d2ad2af59a5e2cbd23c75f1f8e

SHA1
4ac3b85e4dfda35f7b82c6176c220724c7e5f0b0

SHA256
bb3e382b8ae0b1dd31766cb544413f0c6b8c6e5ceeb59d9b342bbe96248acdce

SHA512
cf97e44922a1248e12722613725e310dd975274e15b5fd5874e6bf1f8ad9608a6308e883c32feb174eb7a7cc2f6512e2bdf820cd47be56e127a649f5bf00f0a7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
76a46681f9a2bbf64e2201b4dbe4b0ba

SHA1
2d7ca59edf0eb601266bfee0f3a32e9fa14aa19b

SHA256
378d9e80f1fba840b41b9982f5acbf4264e04f9b233eda50f533136d1c6c8a0f

SHA512
6b8bc8dae26d83a860122e9ce9721a8c00ba3cc499de6df1bd171fa1fb4f2d2075f6d93cc7d42de507c6a569df97a25fc866bd0aa43218f89de54ab134ea97b8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
a9b22f8c6a8593d22c94bbc0f88d4463

SHA1
5ad57eb245c40285be2996ee7e94fbee5eeecc4a

SHA256
ad72d96e6fef78c589f7d5903b717c4190278447c68c8d61f2d1dd293acb6f7b

SHA512
05f782bc81cd15aa8bfd6d300b573da17604f1e4dc1a70c5e1c1d8e2f4cff0212b4d949c3d7f0e94b5bab1114e409760eceaf6c1198543a2c545d57e76cd3458

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
4e48d3d76ce80bc53e2326b11e210621

SHA1
ab09fd83e3eef824557c82d5fc5c4f503d750021

SHA256
19445cc1a3071aa88c1f7862105631df90aedb101029d77d6ce1e540d9e40d95

SHA512
54ca60d73f2348feabd9ab8c48e9ce6c45318dfa2e5bd7a2a6b5a656ca28bad2718776883f8689e8b1514f703c2be714742eda1ea3c4edbdec5572ff1b703304

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
40a98a294eef7bf68250a87ba5bedb13

SHA1
f9fdcf65852e1f1efde3808769186cf347e67907

SHA256
c1b9e59869a1f1d8ef7fdc176ddb7d7f660a1fca540db87372fd9c45db193857

SHA512
9b1a8337053847f9eeba78cf4fe288fd91c5aeb3db3b832aa7baf933f914705c79a126b686d449aeeb0a6daebfaa84e4c15aaf5b159e9d35f61291c87660ff45

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
df5d1ec23105c5c7c04d89fde4b474c4

SHA1
b1637dae7b024c02aba481ca821f518e97dfc9fa

SHA256
853f45eca5abea7917ce13b5759f7bdc4e91f59069e1ad69fb87467a88b8bb1b

SHA512
c3c8421b0e081acac952a1493dc65d68aa83c77d64bb6c849e242753babf522fdb7613397081ebfb4b9e3837321b35c115c6f70f0cce356a27f426276c82d115

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
3d51307c72f4855ba697e451c7f41579

SHA1
c713ac2dc2a94549f9519b2dde4c764d1a514f38

SHA256
3fab81647f62e077c6fd9014cc4d2418448fa0208decf431b6dd0a8c0a816f09

SHA512
3b1bbbf15dd429e2bac80bb46a1f4b37e1288f780713577768c18f8dcf79a69608e82302ee824a79dd9491c5cdf439f9d025cd6b97604dbf9a5115cdb325676f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
44509dfe5093c69a7fa707d936ee1e80

SHA1
c36a0e6e266531b569c5e35351ccbde090474fc5

SHA256
71d916994864d47ddae84305e0e8bae56d44467e72e262ee827789891e6fa14e

SHA512
581efac3d5db49234807c70bc23670d0fd7275629a36f2a7bbec375498dc63e6c492588a1e5762992889130db34c2c92c51eb575d7e2ee4eeed70dfa424abc45

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
53cfab82b57df69199bb5f00dc9af903

SHA1
c516704f2865a49e0aeb7eceed4f472bfaa08a0e

SHA256
51558f90984224349cce12b6e58ca5610aacf8da0c3f9a9f216acdae70d0bd48

SHA512
073c3232971409905ae8b3d1d971cfba21dfd955eb7097e843580ca5f1ac720ac05ccbf46916d4c6ed5d7ae8812725ca6e545d412bdee27ff37f5f7b3b267ab2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
09b55ea4a952d70eb44f2a9ac9e14c6e

SHA1
b24cf53a8179cf5b585b03b82d3844acb828a71b

SHA256
451da5ce7e738dae4b0f3f739cb443a03d893d466776f7c3e07e75a7039fdb91

SHA512
39633ac8e369455600657057ce104694f91bca4e2886940d21a431ab1891304d025a55dfc6a67e9f48f26f3f76a83d4370dd00bd468c7862a72050d523775d88

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
eee08794bfdd3685ff7c2bd52da89e34

SHA1
3e1fceb52a66e7f22ffe98c48305ec02e664dfad

SHA256
96b912ef0dc998f1ab699e2db365c98a973f02359e2710cd7b92003a0fded455

SHA512
d55baac131e9845bae5416bd00f2a0774da6f6991aa8acc2267afd7335ea9748fceec645ce93e950b08de132008172f42b862437a0440b5f872bdf2e6e0903c1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
f16dc85cfe9d41524c1bded4664fed6d

SHA1
f2bebcdd8b6d6ef566145482ae74f0a891265d5e

SHA256
4852b6fbf79e82859a7ad055669ba462605e6f655671027b5f85d0128804398d

SHA512
e09f7406fc2265d98e85306318c9f75ccbb94595246b1fa1f68bb097fc812dfe440f223cf9ab73991b75e106e667d2424c8d3f9ee7e57aacd5bec25f308a366a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
90be47449b1c109d1c0b7ccc20ab9bff

SHA1
1a5d06f34eb184b0e4aedb6f2948a88d6662a9d0

SHA256
385a129fc843caac7223e1580e00cd5e955c30122229a31f47bfef271a2eefd6

SHA512
decff9aa0ec949e4a6722aa2c2db77f2fd6c0b333f893f68cb0eecc60f30556a36e985dd0aafad12c820a279a7b89d088a3571cd1cafc2aa45074ec055df16bc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
6eb10cf45ef04e86e0e75ee8469b2a74

SHA1
8e7cef6a4832c17df130f7d0208d81f31ba65ae3

SHA256
de035caf2d246f15f085d0dc0df28e15b7ddd99174afd77e5fde65d78d368340

SHA512
fa7aa72cf35f4d0dc98108bdcae9aa02c8ecb0728170692d416c73b0f717760a116c2a572741d02e553ed07e77df63b4d8ed5a97c8721965df61a25bd92f17b9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
d6d98ede3e8afdb7719ec3a754d0e663

SHA1
8fb4be7ef32518c8f0a17c310384c12aadc925d9

SHA256
34b1f8e53496850c8b2358145ed9e2d585f7e6e7fde25cdc32cde4413768d274

SHA512
9ed84312a4919433cc07df74a8b7bbc46d9e4786cb3b095f0cc3768c3a9c76ae1f340e8dcd9abdad39229e8ff292858a91d00aede13f76fd5904a76f54515ee7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
d88bf64c4df4c6cc71d001a607102bf9

SHA1
d7db6cd2d7ab3778d7f88d97e203c2be44d2e17d

SHA256
69ec18a2c0695c7e30deceae4b3a3c76d9da75c25a6e606419733c22d5246e2e

SHA512
4c7f4bb9ceefab6891a1fbf78967dcebef5b901ba9b09f2f285df6e841e003556fc94ab6a211ae467c8cbe093941638015f2c0a4d09381bd25cfb5efc755455b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
cb9e3f92c23dc2781e245525c87a074d

SHA1
b221610ae1c1bb97308bcb980eb2d26eb8dd3dbf

SHA256
14430ff6b315fcbbcddcf85596c549e04d5ddcf7e1a06f034bdc74c1dd1b1cf1

SHA512
baec6a8485eed64c6f51f431b938fa2cb8af687ca336609d8b863db73ee8346ed9227117205875b2d37321f959686723163f8a7ff5a849cf2d3aeb5ac35babc4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
5251d086550716129da4d0880239b161

SHA1
98b37eb41a2d031a133ceaebce75072da2f11c0f

SHA256
096ccc4aac00ea77ef2786c3ec252f745f71be009ea63623ce56acaae798d8a3

SHA512
b42388432d97ab71fc56f7ea3d1f260428d4af15ce6e55f2e6ab22d36b221f57a00de82059753a87b96153a0e55853276e9b4eaaaf3333b68585eb36470fb809

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
2dcaa0925102dad3fed3343d58e79f30

SHA1
3e6228f85c33ca57a02b7638b43e5ec2ca693943

SHA256
fbf1bb6579355d77f0886a2c36536cfee9bc889ee7a808fd1cd341df5e1a897d

SHA512
16feb0e9c9733352f8df00c24b79a448ed8808cfa3d1b747ee5495275930e0627e3daffe6679a8dc0e723d644602ab255b9f9e77bcaca333a975b9b43d57bf02

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
39c07677c5f9e06086385a6e24f46f16

SHA1
5dd3d0878d131a0b184a1ee488f8705d54d2c063

SHA256
9254226ad5bb07c1b1278989dba7a7c2322506cea07239e9249227219ce22d1a

SHA512
2723bd244607c1fbb4dc4523a79a25bf9c4f01f7eb83c71cab4d5df2e65d381783fe20e552a5493fa373c2c1edc7300f56e1e15e4060746cc3b382e580e9a9e4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
8655d84b8a1f1a4a1efe3e8bc1b05ea9

SHA1
bfd76562bdde4bd44276033cec9dd7f1b9f4b3e0

SHA256
af162c40400c4887221ffeb7b1959cd344422ee13117df40e50e5d6d81e44e72

SHA512
d1e2e18af0aad26d3b9faed6d4039a5278990e998ea728fb3aace2f8daed4f8940c1f67aaaed19b728d91711c7e4a6891716e70ed8c74a69b626cf21daf28d48

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
d5fc180f0646383caa5fb5efff40bb25

SHA1
094b281b9eb308e577f5ed391a6e6cf502afed5f

SHA256
cac529c6982a298f4f7ec69ee2075e242572e9a3a79ef9ff259c6d3195b5bf12

SHA512
9774c6efead5c7e6743af6a11787495c5db8c377408f4deaa897c938e0203a83e63d27869a485c3887b71503b15eb60da4997d43286b4219b9fcdf867602072e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
ed48539cd967acf12ed8008750583dce

SHA1
ae299c721ee59c77eae087831be49286251f9075

SHA256
5d09916ae8882fe982c9e9eb2438eceeaa95597436503daa904996cfafcc4307

SHA512
ef4fdbb981769577f3de353d3ba8d09b7b474ef3de53ac7fb016b573d4641e5d47d92919f2edb3377087d8cb0b7249cecfebc9223ac59ed6824a3cbe3cbb3829

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
812bd911f055cc7fbf710192393ec7cb

SHA1
2aab7f92bc93eca6458f3b224b811b750ddb5c4f

SHA256
98363ee9e042030f77e31f17adcd371791dda534535fae57ecf0f4bd261336c3

SHA512
1bab77cfcfa36551e3bccd3887e618b48330adb54c4c1bb5c5976735f5f92b2129c2291a7195aad72e4f4f3b355aad62d8f92eeb8980ac07604c89ea059fcccc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
dc08426d6ac483ccd6aee70a16a612ec

SHA1
16e64d0c095ee447d0a81ff908deaca83f4c6dfd

SHA256
6477c02cd34352822443ec2f41831b173cf1ba661a634d47a8141ff75c393755

SHA512
d3b735092757fe270b1a4002b79869cb0a1b7ff9001e0775f0a2e03ced901c377f72bfd67009a805c4a1904e7f6024b2ae9b67f77c9f3695bcb71e656312a1bc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
9e5bd0efb05e5db9a7215e44cf871d7b

SHA1
04022057fabb89e7286846e0f024b92d74557d78

SHA256
77db2f17a6412342f2a34352d2cefd9267ca699057eb53bef77d15202f606398

SHA512
a610ce1b67eee39b2499ee9453d771e8350f33f0fa592f8da3e372e8fbafe912ad58f3879bfee796d63f99dcdf61778b335dd792317b388e435c47ae24e68b36

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
802493187663579f7c869381e0fae78f

SHA1
a6ef393e7883cef1aa06702a67a0f03cc40f817b

SHA256
bac0eeb93203b4f6445a1b0501d4f27fd7478c5bdbca55953c3f3d323b3243ee

SHA512
103ec17dd20da171c0cb9454eb25a9cca708535279ca709ebf09e58c3d1ddde539a4c4d387347688b58f2d5340e29740ced6fed748f0bb5a32a9fbbaa9cbb6e6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
530ac4c5e0680e5562033aea3e30c090

SHA1
1751f5872a57c6c67031ed6f01d9e4aec3331dd9

SHA256
26bdce6cb23d0f679da6d00008127b40ea1ff150d849e222dd7ce6b749be2c38

SHA512
c450c3c761860eb965224e4e77c876662deaa1cb7f855a78264ef01449f54985d1ba405cff34375ec32b47040dcc8faaecc54953359fe59a6f23f46980688571

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
131f78084c827eb90e7f08ecaeaec415

SHA1
8a9175cea7fc91ddf7c26904bc8a27775b0f5790

SHA256
a17f21a607c656d64110c8a495949aac2f390aa096441ede5f8633ccddb686fe

SHA512
36ab85f96d36bc0b73533993cb3b0e4048aaaf5e17408e5eb098dc02d4589a10ae50615b035af022f1bd4aafebff10e1dd3260725104cb3819770e1095a04d13

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
c6c630ccf51b1a19040a63a879484987

SHA1
cc2cfc30979b1abe124bc85a860df16a1dfe176a

SHA256
ca7adc6ae271c2dd9fcdd0befe10a7d28a68de9ffacd62ef9a068715909adb69

SHA512
c4dcd507b07906cff2c9c6d21f3182818a5f08e4c1c28575df5ba816089737d2941696d21d655e8a4b97061597715bdc7d0dd245ca15aa9d4171bb79b85309fa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
2a719139524eca8cd4113c905583a5a8

SHA1
5bfdad087d66a179160c367f3c5c492e5e8c4e1c

SHA256
2ad4dbd86f335dc2b4622447fab923427b410142e1ae676b2e503ceebd3aa971

SHA512
79eb20b9c84a8858cc2b92f68704156a2efc3678e8da913aee630dbef6c496173abe09f95ce3368aa8bbc2507f5a7cdc987a5a6a461d7a503e5a1f71e263d672

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
0ef9403b93b846128fe36ddcb18eac83

SHA1
a699fbb1ac042465f73cea361cec7189ab26e783

SHA256
7125efc66b09ccd4672808663bd7417f56ca3aad4a2f7277e74f08df3a32a89a

SHA512
d4672cd0efa080e75e5a035f6a8954bec1d2aa4820a31a8c6c309e8982569833042be6756614cfccfa82c0325a0a93c2f436182b2ed3c69273c6e95db14ac753

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
137453e2bf6ee3e982cc120e7a240086

SHA1
06cbe99d87e06ac06d8e698403a4ae1cb3fe7469

SHA256
07fdbe10cc81e70baa7765cd1336eedc27f91165d3595024259ff8ccaf58b332

SHA512
7dc39ce922d1a8bf122a2b2c5d41763dbda5590acb79027d66d29fe54b718d4bf7b5f9b9990f6aad53fde5f02c8a0a630a1441604f7c5ab4623516ac3f91d1a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
14d24d4f2303300d9d700ebf2a06e7c5

SHA1
a2243f2e2b43c16821c613922b5a11eff0143a0a

SHA256
829e1ab9aad80934f7abbdfabf20d5599dd5af47556922f1795349b904077582

SHA512
c9a735cf305c54a92332d435473f00706a4e0a47e5ff6ea9555ae52a817441a4a73d86df71219cb50bcd9f2195d89ac370cbe565784cdfd6d3821e1a38470479

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
91e1cd3cf67556a431063c7dd0406839

SHA1
6bae9073750c215d365cc587a0f7218237f43658

SHA256
32c5ddc1fe694c30d46523dc188f67b7b0c41bc7600d8eaa717683a26cbb1ba1

SHA512
d21065b6e3dd0fb905c1026fd97ba6149b34ed15805f3fab78d8c0d6aedbd2c60c08a52a0866c3fa64e9a382e5392a09abf508446576c714845725f59a87ab33

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
75d3da00d4abe7e5d0f8a278c16841ce

SHA1
4477d25299bf9e9608f2edb522abdb1dccaf05c1

SHA256
8362dc1bfb7ac1c89e56d635055b7f75390b5f7ca820c11d6ed07c4f7dfebb5c

SHA512
3a194734abd17f5b4ea148b544c6294bb7af70fca50982bc525fb6f5ad5f5a0c9bc19184c6f00fbc7a5cd5176bf273268e537af2ad4bcc7c05395c78bfd53d67

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
8b69cdd6fa2e8613059bb07bf689a959

SHA1
51735348edd1c76fd13836553dfa1396c8b92290

SHA256
800f0fddef7a3c34c3837d5fa7ddbe7330543e8386d2dba919f81f2280f93e09

SHA512
19c7b2dc8bf08596476ef24e8815208ad38a4b754ea21d92cc42d95335dbeeade963df90f41a5aa62f976a026b0b7ee54de325a4b47a3eacd0be576a90980aee

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
bea5434e331d92295120688d081a8071

SHA1
f9d7b3eb45d9a24c1b18ba70d5d6a45b419a8cf7

SHA256
2b5c2cc1cdf54a39393a20f48383e757d04945ed4b8dce60b9e0ea8afaaf45c0

SHA512
74bfccbaa490312c2721b86fd74409493ef1edf1c401c9225b9d14afdcfc1b4fe9400629c74b11eefdaa2ba5b9d125d092eca6f509449edba0e80f1f2d5f3c76

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
b67245693f979b161259e0f4cf6e3c7f

SHA1
4a7f94fd2217544c5b3a44ce325c27e50ebd38f8

SHA256
dece3eddeec4883728fde04242f2af442edbca4bc8c905831070d3ac511bb46a

SHA512
285d8f185870557210922d43ff27d444e5b2169bcbf0bca679931ec907daac186382939456e133c8f5a1202d6cf20fd26c8606568e8c2f99504d99a28fc4fe42

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
c2c05be45c614db54b857e9d9178e2a0

SHA1
c8a2624c0c08e8435c049beb46bb1e43c885fab4

SHA256
0940c95d57d941230a4be595e60a8ec9a46f4883eba50d33fdd7d19842282712

SHA512
88a3b1cfd3e151a16b1be36c94a5edbacd2b3f3d655c7e79d362a843c94ff8671785497e6a9c51520d5aaf49c612845b8dd78723a45a57ca64ff6a352faa6bbe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
8d7b340236d4cac36c3a5a2df91b3a40

SHA1
b05e24e680e78151bceeccd00f8c4ce212b865b8

SHA256
5b83560e1b4c5bb6e1f6cc54ee9a0b4110813c197a2689a3a29643ea768809d4

SHA512
44480b21a5ebe16c416eb24560c9a4bc0ed5d2e4121e33673c6661a5c9d327fa30cf280141a93a42ff8f0907631a44e39c72036e2586c5a340732467816a44dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
d39a502b1363ed24db8a3e1ad6d3c04d

SHA1
3b54f547046410c7957596cb25439a31368b6a21

SHA256
ae29db78adce19abba99f6ba877213c2fdd4c93ef4b6f4f7e2188b9705806659

SHA512
f7d6c704104e73004a473a785f04f06f56807505ac0283bce603b91eca826c42fb1d6b4ade0ad22f97de24970f6507a689e0b1ded81dc0062ad8b26ea72bc4c5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
c8f514a9eaf26478f2f107ab9fe05b49

SHA1
0f3f9b73735245d59f173a09ea969f45d001b865

SHA256
5ca92958f2e1b74651f08633eb69b61f5c7244bac21a04d237ebaef4136cd771

SHA512
ac6868002dd866f619ea12491061c4ca1f35a5dcd51de208332c088af7160ac6558d7effd6a068de2432623bc3abf045a23342d4680bcdd9d63bdc51da9273b7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
55f8a477082dcfc0bfa43634e8b5f910

SHA1
e9f369f39711d65d84589ecd9925a40820c0fb31

SHA256
762b43048c7059c7f1534e0bebcf2edc524fb567c39305d1552cf574cef54538

SHA512
0423f14c711750547858db58fb15033ab9b25a74ad60d2b2120b0f85c7bbfab5bf4c1b50e28a5b125094ff18fd5cd1e2f609b99cabce820fb48bc1e933f105e5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
be4f3a4f76ebe1ba31625ad6006fce18

SHA1
942f0a8e7d941ff743fd0c317fea226d1d100fd1

SHA256
bf8230a16e9f9d29469f477bbbd16c560d2c21f48a360bd613a882b12260a13a

SHA512
9afd2ebf17b9c75db354b98e44864279fc0cd57aaf5738c6dcba39cafffb34da001bc0d144329ddcda88cdd962cedc951ce05811d613748f43e25916c22816a5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
cbd504e5ed01dc99811bee14690aab9e

SHA1
1106e0893ca5ad6cfaa6e8096eaf46a158ac34a5

SHA256
d7507d71f513c7433042ff9416cc009cb3abed9e246945532d7b0c661b5c40a1

SHA512
d39f6e86a0d716f3d3dd13ff9b9b0bf5aef744121fb1f6bd5dd8b42faa3f174534cd66aeef755d371c447e79abb3742d857b0bb71dc62a1643ffab6065e41cc7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
b1768abf47fcf4cd9917c60d3f4898bf

SHA1
062f8053b280dc8a9410cf560eb48c62cafb148b

SHA256
e4c8623e53484245868a2dc9eb9ecaab3e1a5816917833c30949f5f581fe9955

SHA512
1e1fafe400c4ce1da11e5ef11e70c4b665a7208f3897217a466dce11bd050c2e2aaf72b0765df9072bdf9f7e8f122656e3ebf7215552caa215bd851b99a3adc7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
b1835fda4764642da3b866b64b0c4901

SHA1
2204597ebc09f22ddac48e331a430424403f59e5

SHA256
0d4e1db72fb008b9390e5874f42ce8fb4686c507f8c34d1e3c95ecfaaa0a9370

SHA512
d326756a27fbdf20d4f60a8c179b20af73172dddb960c8dd359a4dccfe7da93d43c58629ecdb5dca7fff46b14bcfc4df82c90cd384bb5b2eb90bf608353fd04d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
81dddb6cfd42bf3213ff863257a75712

SHA1
65dbf2586a682ea7ccfd77ff836744d52b16992e

SHA256
ac7d4debc95147bcaa434d7e2914f5cb857090f5a012819e11d5efce5960a6e0

SHA512
2d8bb2f623c8085fb1e46c80b98b95f37a44fa07d716f716c14c81d92f223a03a6e6ba793c09249dd6b4d3e8c07e3a058f043448289882b659ceb2ea56725a9b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
2c2da7ed8a1692b3a666fc2979ad2072

SHA1
cbd39a5a766ab6e9819ba957f78a3515457c074d

SHA256
2d153c8ce4784c971a5e5505b3380cf278cf49fd6ac0d13a769704a5b0f53522

SHA512
d544e2f97938c0d1abe0f5fd022456e53a6c3f82b741ae5a7c2d4b355d023ffcd11b328697b021c452bef097966b0766cc81b0cec3cd4b48fd30bfd2864e01bf

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
33f3ceec666ac7d88966bf7b363b52c1

SHA1
41399b8591621ba528f7b7788c4cd6958ead10da

SHA256
1d088ccd97375e069b471eba5238b2d9b205cfdfabff82b3b413711707f955cc

SHA512
13ac7716a74ad684acb7476f77ba81cbe21d1ed1a54f065f6be0734a3cf944fa719cce1ac2efd35d6863516a1d270d16cf41d8ea437a33349b5e0ec7f88d29e7

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
ba55037ade4299ade921d01882bff5a3

SHA1
f85a8e7e22ce83fe5442a9117e0510010d79db1d

SHA256
bd6a352ade9323caf355f915594602b54eb69f53580f5febe5898e71d91b19df

SHA512
6cf0952b3508d3fa0c1e0e033f688cde5c1ac6e268763162d279f613f03934326b56311ab5682bf9c5ecd708337e115e43445597decd2808943bd985f6584756

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
12883a6241a55cfd544792b944388f2f

SHA1
7c15abf0c0bbbafcf47ade08aa6615aabff5448e

SHA256
f016f42189c2c5c76b1a09d210f60e1e48b5541433411d4df5af500067fe056c

SHA512
3d9861b05c41cfbb5398939cfb0f38fb89bbab64bf73386fc2e2dfd7ab87123c8ef60862268f897404210a760dd0a344c9cbdeff4478ade49dbc33b178457c58

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
305fcb633374fe18b16e649b4756a2e8

SHA1
9864fd29c025fa17848b2b8791245b2c1ae88faa

SHA256
526d614735d10841692c15c40c4eb162dc2048508a7057979957d614fde0a3fa

SHA512
828f52e4a0e844c7ea739269be120279bc8d1edda6fe860dcd9a21455c654f3bd267b5b358ade4aac8e4a1112c64ca1c08705674fa923bf63cd90e5aed533f97

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
a9f4dcd79e6ac09be82af284e56d1f51

SHA1
8de8b8fe4fb78063e3ee0f32831e023abe73be85

SHA256
515bbe794b749c67c115a97907940935a2a19614ad0457b2f1821fa836894f72

SHA512
c43089b5064d92b619a0d0cee5ca103b27d4c0a7a49898144cef8d36ff95e384c902ed16313d55104a450ede38db703b80213e393e22388260ab8cec027902bc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
7ab26e28a90b3ef45ce1f2285000034e

SHA1
a9c96afc6d9e0e5aaf3613dbb769c865c2e422b4

SHA256
0bd902cafd24894f965f39d540dfbeb7705da3f208722035d8c55552dcba5212

SHA512
a7d831c773d1e740c47c483094ccebb54150f0b000409ea1e46c6e4ec3723945d9e14827bc73774455199f7bd3f5b7a471fa5fe306d6f798f3b14bb3aa29610c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
ef8078f8801f99603eda915154e048a9

SHA1
cb60ee5ae8a91ad45fd31f4c00b88ee69347c9be

SHA256
ff1d2e8802be5c3fcfbd10ba52a8f5857ad992747ce1332fbdfae7e75882704a

SHA512
9fd2bb55b19b403919defbd6e5f78e30f8593d5bb4135f6963db8813c6de8d93dd8294a5f58e179c62e999f90f8ed6e814867fb5b119498c17a668fff5e372fb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
3a326861bdc6348a0790115abfc7c145

SHA1
97222c67e0a895a12cbe1df4188742c1f7940784

SHA256
056b178d837b44190c53366f09b22397da15abc902586c6afb528f5ea40ed71a

SHA512
6f4c7c0139cbf04df849f67e163ad0352212c438b9885a9326d506799b3d0eed7e0be28015a5e58fdee66f283f6b49273e540c543183c8585e3f8870b4629b94

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
e2a203a53d7fbb31359c89ca818cf54f

SHA1
c3b7e4c0d9138709756649570f33836cde424e5c

SHA256
b61d1a90e5635eaf6bb76a1917cbd9de96947fe10c9178827d7551fdfcc41cc0

SHA512
696c4d03e4b71ef67e70389f7828ac890c2d9a64191942ce2fcdae09490733a99f7e848c82d594801df976731c193e5c7bdb7ef2c4a3c8411a9d873072da1731

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
4495721db694e9a03fa881f43f7d11da

SHA1
ebe4523325dbe977e5fe6c6893bf9319ffc4f872

SHA256
427ebd1d7bf0e6e819d4344455345bded465068a600402aa48f55fd8472f4604

SHA512
c65f968d783d50b41e5d66b1007469fe07120c35a6f3d9c85d32879f2be06aad887de05c87884b65f313fd480782d14e6664a2e024ce6640a52edc2358da3dad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
bc2a3e2fa619607e885e63ad7813e08d

SHA1
a2859ae1a344c97207903e5b1269cc207337ebad

SHA256
83e5e289674ef3a166dc469a69feea0127af01655a55fa78807ee5d8f8e08d20

SHA512
7a7ba035925e2174783f2fb505fe39bca51df70bb409cad4093b9365a0afd611e8cdeae1c72b3f6b001c5bf08ac1fd7f1474f3f6a31b951c4428fd75d00be084

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
4d977ecb995194297d88e9ba9a963033

SHA1
eff3a1904459edf747fb5d62ef07e0479b60d44f

SHA256
d735c5a9bea83163523960ee7f09c4a2d76c5197f657495e22ba2775ddd3069f

SHA512
0a7bbb4481c80988f7322093b504292b592e93c2047d1d3167ff202f404b9f69c9421b97cb4d2e6e19efedf8dbed367067168ac04ba8c42ec99e14f87c583d51

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
f317aafa59e480140ca2392302b53eb6

SHA1
a3413ed21f8dd4d2e128de37407b360c04d22d70

SHA256
ea113f6dbf152bf1fb5f159e2409c56770b9f9be77d633f51b473b6de1eb27ad

SHA512
8929ef2cd232cfd7c81491cba36e4b753b91cd5640cf3c912cb86698a3ff27ade27f752f44c7360c09c21ec436a3e8dad4da13e431d8e45efd6b0434a0a4b5b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
990278ba48f11b23dff1335f4416842b

SHA1
b4861e5cf1e3864043e57ec6b137c734a4b55c5f

SHA256
116f0cb6723c21f92bbf8331a6794f02b7e6f7ec7c05d5b6b1860401e9cdf196

SHA512
30044b9f69896cbe364b904ff85d2130aa6b0c231922767b64732af2a5819754b0289741da46102e30aa327244a513bb462acb791d2d084ec0f531b09a45a6a7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
f4ed5b952988ddb267f0b76042720559

SHA1
60ee3788329bd2b6ee5e4f96eeca3063f173a53e

SHA256
ef780b295a14a691023fb2314e1b8a466dbdd30952207fe55835586db6bbdd0c

SHA512
0419527675fc4d8f4e00777e3e5bc8ad9ec39d87f1e88b14007d3cadf03fc1ea0db64179aab60af38f2ea1ef0e8135a38790a6482974f3e2e1ff8ebc682b1e1c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
50bf655664fa7d0ca63b49197fa39d6b

SHA1
5213e4846f243e44877e6f3d1f922ff9038a65ed

SHA256
f1c28add1218e34d3d352a1831a80fcdcc7e0d0d6872d28350bb53831568ec14

SHA512
7a58e6b004b603332659092c34d94138eaeb70a1c0f4dec589e9719d9f08f4fdd38841d12095356c589eb9e4e9e50dd1289ddcce9c2c5204ec5b42d42af244fe

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
bea1e0d01f8e2b1ad84b2697d88adfaf

SHA1
5257a43f7f2abd1aafd13d8969cdd1ccf2e51f9d

SHA256
01b4c46bf468ebbaab379ceaad148a0344d9d1599809cdb5e2eec7736ababb5e

SHA512
acc637b75a7b0878d893470ba69b4edce5964e4fb68d6b0ab770f41f586e2207d3f6d35daa32f20fe6124606da756613987c5e35ab30c02b99ff0c75334d7500

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
0521e2ca0d247d96ca1589e3dfe027c6

SHA1
ea717e5a466a9a55671dd651584760e7cded264e

SHA256
4e2d8e636341cbff010428768c088a3cd8216eb4f69616363e9216e4b29ea7c3

SHA512
a5c355944d3e6380314548a707cac4e5b5e4cf7b0603daf24c0c9efe6cc28fad2c62d831f8c623eb5acb07b56c2cba5bb8e83bfb73e7a585f77e81081d7bbd0b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
695b63d070195b5495caf4e1becdc32d

SHA1
3cc216e686c50a4a442373502923b58fa93427f5

SHA256
8d1177ed83c728937ef99a965f58036385c3286e61495821921103081fe3d3b3

SHA512
c246f037b0743afd1aba11c87ffd524fc996c45d181792112c8f9f88d9eee99b7bca14f2ff2fbd38dbcbdf323271a191ac4618f37d80453e4c5b7d1c6168144a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
1736a9dc2ee66ad881242af482e55877

SHA1
1fce168803c2a7a4e4f433733d2d426a82b23ab7

SHA256
cff2175f24705947aebc48462e3ef6982b4aabed32d12353349f6a58b06cb35a

SHA512
0c2f1f0c6deb2764a4dc5f1a14f70214eccd8853f78c052da369a5ed54c19b5a4c3556961e0153a3c5d0cbb63836434a5c01ec41d1265133498924c4586933b9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
1614c3728d9acda9c7fcde7018819ae0

SHA1
f9d0819648e98e660e7f5a7ec60bf02feb45d80e

SHA256
8bb0dcb4d3e8f2e78886a180fd29bdde794997b8574ccbdd7f2f8aa764180be8

SHA512
880e93c8e19948a4495bdd74aaa3d1511ba086bcf6334a50b9e62d01ce6cba37afe22bacc60dad3d7daba8fb35abcd914ce62224515dcd55fcba42d2072787a8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
f9bdc03e3e58d362e176de6c003fe3ff

SHA1
84700fc009fe36e79313c9f5e4f015931fe82b17

SHA256
2f653a5af856a1840609bd8f0e6a7ee5e467ec5a2868349be2211387988c4ce2

SHA512
38e6197a97164b2309571f14d4382ab2a6049ad9406bd3919c04042284a7fa0a46ba4b33367c31186dd4d8333901f6ebd7b17c55698c693e8dcab964aeafb106

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
ac240584cea18dacb9cbab8f6016d734

SHA1
22aa1ac9284fe1416a40e10b799c5e262fe425e9

SHA256
e1fccbc959d86cd6aeb555f41b538f61af8052dcb5406ac4b3c41c9f6227696e

SHA512
b66dbbde03edc6cd151840f609816503a2fb417d87e63030b73be0b8064e8902d97e08f4c5960a5df8c4e6bfba57e95147a91ed228e6878b3a710fc0c49a34b6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
8e33d9bc321e4fd4aa959fb0f83b868d

SHA1
1d61c5c18a03d2ce3ae68c0dec4b2bfcfbd4760e

SHA256
789449fc6b321ac7cff5c9f10d3d9ade6effc2045d7c2ae4404fa2554885b432

SHA512
26cc211fbf7a077771c547f83167685c390252229e18b2e318e7d82e2202f6d2ba82d382e62ab85ddfe6b20b06cd951d0d2bc9824e00a96f1a2e2774b1ca8bcb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
9190b9ae51b8baad8253bdc618774c2d

SHA1
375a347ba6820447fd118e2364f8e4dc00ab87b5

SHA256
2767852ddae419918badb06231971ddc55baea2d83f35fddd4048d51ff819511

SHA512
5ed48e4513aa20cceb91841fef8b129ca879c71deed4ba0c619d6f8c7016d2bcf5e481e4644aa1d4564de2e4c8b79b32172803f2a26ff8d9e47bb436e6257c20

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
0dbe9ca040ef480b61d22fd948e8432d

SHA1
1365e941d294838d2886cebd9fd043ff1684ee6b

SHA256
b4f3696a92aaba70fda17c0847aa8f145167052e2a757ce3fffd14b7bdb41b33

SHA512
3091325d895bd1b49be4e7cecc7a0d60dedcce72fd4f9eeb18b10ee3e151515b26979b90cd2bf60e36417a2c0329d426d16f6cc08fb6328d2ec12da1a44911ea

Download Submit
memory/2024-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2024-8244-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2024-8239-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2024-9164-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2024-9165-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2024-9166-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads