xorist | eaad06b4a7b1072a3e7e361638e75ffc18d81e17d8a443b511b77162fe4251a3

Analysis

max time kernel
144s
max time network
122s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
23-12-2023 11:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

mbrlocker.exe
Size

7KB
MD5

61dc75a6465bc7582f873b554fcb1b6a
SHA1

9dcfd74bcb873ddb4ed65ea234140f33664a9ff2
SHA256

eaad06b4a7b1072a3e7e361638e75ffc18d81e17d8a443b511b77162fe4251a3
SHA512

457ae5e5315645f8d496fe4066f2487f8e17372f9225b648498b5444b9f13ed1b7768a773c37153cf32518ec102d2c8c5f3f89f7d760a81ded9bc96848834f1a
SSDEEP

96:lrZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExs2VKi6oWd96OGMUA:Nzdrr1FG1WDCgmjPZHT/OGMUA

Score

10^/10

xorist persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 14 IoCs

resource	yara_rule
behavioral1/memory/1528-3641-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-6409-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-7953-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8430-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8754-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8986-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8987-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8988-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8989-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8990-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8991-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8992-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8993-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1528-8994-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2133) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 15 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1528-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-3641-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-6409-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-7953-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8430-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8754-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8986-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8987-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8988-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8989-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8990-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8991-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8992-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8993-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1528-8994-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KQR91Zr4H5Ab7EH.exe"	mbrlocker.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr002.inf_amd64_neutral_b4ea26a49ad66560\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmjf56e.inf_amd64_neutral_328dabbf0aeed9bc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_wildcards.help.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_scripts.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hcw72b64.inf_amd64_neutral_023772237d3a4ade\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iirsp2.inf_amd64_neutral_9ed65fe0bab06b1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmadc.inf_amd64_neutral_62d6e6995428f9d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmetri.inf_amd64_neutral_f89b8a357327f615\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Language_Keywords.help.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_prompts.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_neutral_e77f438012239042\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scrawpdo.inf_amd64_neutral_4c228493af8567bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wstorflt.inf_amd64_neutral_3db956c41708f7f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk00.inf_amd64_neutral_9c0c35afdddc16d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_operators.help.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_operators.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\unknown.inf_amd64_neutral_5eb6ac70dd1a3ad0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-DTC-Setup-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmc26a.inf_amd64_neutral_547edd894d7c19d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdp2.inf_amd64_neutral_ab710894455d7b9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasno.inf_amd64_neutral_c86d5b5e5fa8b48a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_debuggers.help.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_History.help.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_logical_operators.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmags64.inf_amd64_neutral_e68956e24e287714\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\Temp\{522f6bf6-ae20-0f66-d982-a746d010852a}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_requires.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hpoa1sd.inf_amd64_neutral_caaa16c52c48f8ac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr006.inf_amd64_neutral_40c76453575b1208\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxlg.inf_amd64_neutral_14f9249844f1cf17\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky006.inf_amd64_neutral_522043c34551b0c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\migration\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_trap.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\windowssideshowenhanceddriver.inf_amd64_neutral_184a2ef2a8f57c33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\migwiz\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Documents.gif	mbrlocker.exe
File created	C:\Windows\SysWOW64\wbem\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\1394.inf_amd64_neutral_0b11366838152a76\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr004.inf_amd64_neutral_3319ff2548f89fd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\SysWOW64\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_jobs.help.txt	mbrlocker.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_providers.help.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_neutral_86bb50f34c49ae71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationLeft_SelectionSubpicture.png	mbrlocker.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIconSubpi.png	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\settings.html	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01744_.GIF	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG	mbrlocker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	mbrlocker.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	mbrlocker.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-undocked-4.png	mbrlocker.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg	mbrlocker.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_OFF.GIF	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png	mbrlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\hprof-16.png	mbrlocker.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\CircleIcons.jpg	mbrlocker.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png	mbrlocker.exe
File created	C:\Program Files\Java\jre7\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Program Files\Microsoft Games\More Games\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\logger\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\trad_h.png	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_docked.png	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Common Files\Services\verisign.bmp	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14691_.GIF	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-background.png	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ERROR.GIF	mbrlocker.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21434_.GIF	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial.png	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115855.GIF	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg	mbrlocker.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationUp_SelectionSubpicture.png	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainBackground.wmv	mbrlocker.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkDrop32x32.gif	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0289430.JPG	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR33B.GIF	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\Shared24x24Images.jpg	mbrlocker.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uz.txt	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rss_headline_glow_floating.png	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_bottom.png	mbrlocker.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new.png	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\PREVIEW.GIF	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\TAB_ON.GIF	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF	mbrlocker.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv	mbrlocker.exe
File created	C:\Program Files\Microsoft Games\FreeCell\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG	mbrlocker.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Document.gif	mbrlocker.exe
File created	C:\Program Files\Common Files\Services\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.resources\3.5.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-b..d-bootfix.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f5f9d5f8c8d6c6f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_netfx-wminet_utils_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_478e55843710fde4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..on-common.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e69748ce5f68ab18\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ef7ec24b37a4d290\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_prnod002.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e4665cfbc3433f62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\settings_left_disabled.png	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..pologydiscovery-adm_31bf3856ad364e35_6.1.7600.16385_none_e774dcd7484c8452\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..tools-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_700630052ce0c0a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Special_Characters.help.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-gameexplorer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0e7baabfd05e5435\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_nb-no_03f6001a44de7439\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-appwin.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_86a3fe0653491d07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-16.htm	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-htmleditingsupport_31bf3856ad364e35_8.0.7600.16385_none_6a1cbf5f4ad99b65\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0246f6465cb859ba\settings.html	mbrlocker.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..acysnapin.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74d82838f1c4c5a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_679a6ba79b07a3c0\drag.png	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_de44258d81747ce2\RSSFeeds.html	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3b85bcbe4734e96a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-tapi2xclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e8e4d27156d257c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dot3ui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5869fee04188b095\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_wiacn001.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_922c65d7f4aa7a05\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-security-identitystore_31bf3856ad364e35_6.1.7600.16385_none_a80db2b3efe7af3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..rojection.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_135e1933af1da298\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_edf33f857603a056\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msmpeg2enc_31bf3856ad364e35_6.1.7601.17514_none_0b450351a4424f06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-0002042e_31bf3856ad364e35_6.1.7600.16385_none_a082e5cc54381951\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_wiabr008.inf_31bf3856ad364e35_6.1.7600.16385_none_0a0081f3fd32525f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\msil_microsoft.iis.power..framework.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9bbf515461941a83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_uk-ua_0c40c3925a9ae4c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-winsatmediasamples_31bf3856ad364e35_6.1.7600.16385_none_0b34d0642122c1c4\winsat.wmv	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_net8187se64.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_26a869f069f08dc4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_prnlx00e.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5d22fb808b24a697\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00001809_31bf3856ad364e35_6.1.7600.16385_none_51112af0b00627b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-e..nt-client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8846a6cf62ef55ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..linetools.resources_31bf3856ad364e35_6.1.7601.17514_es-es_95e59d7704cb7b02\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7601.17514_it-it_02c858bf03c4047d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ystem-web.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_af2ea846d5480405\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rpc-ping.resources_31bf3856ad364e35_6.1.7600.16385_de-de_60516d323a05fb7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_netfx-msbuild_data_files_b03f5f7f11d50a3a_6.1.7600.16385_none_09648aeeea40605a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_it-it_068a8aa70d654920\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6c68ef809d24488b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..xperfcore.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d13b56f8948751b3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\settings_right_hover.png	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b5fa959a738d6d74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-artcon2.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_98b4ae4c6dcfba21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile39.bmp	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_18c7e2a7acea553a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\assembly\GAC_MSIL\WindowsBase.resources\3.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\Branding\Basebrd\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_sl-si_a60cf38bf64d0c81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..noverride.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fc89231e8251fb4a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..input-cpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_beb32b6bf638fdf4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-e..ntication.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_820ff59a993d4f97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8dcb8bb83ef0bc47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..rvices-registryapis_31bf3856ad364e35_6.1.7601.17514_none_a65991bd803dc65e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\Speech\Engines\SR\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..asks-sync.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4805475288b5b544\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..lity-base.resources_31bf3856ad364e35_6.1.7600.16385_es-es_81d5452ef0e77ae4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File created	C:\Windows\winsxs\wow64_microsoft.windows.d..ackmodule.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_636bce033bdf4cd0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-5.htm	mbrlocker.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netlogon-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b02316b7fa8930c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	mbrlocker.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU	mbrlocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU\ = "CRYPTED!"	mbrlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU\DefaultIcon	mbrlocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KQR91Zr4H5Ab7EH.exe,0"	mbrlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU\shell\open\command	mbrlocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\KQR91Zr4H5Ab7EH.exe"	mbrlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	mbrlocker.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "YWSNXDOPROZLNQU"	mbrlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU\shell	mbrlocker.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YWSNXDOPROZLNQU\shell\open	mbrlocker.exe

C:\Users\Admin\AppData\Local\Temp\mbrlocker.exe
"C:\Users\Admin\AppData\Local\Temp\mbrlocker.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1528

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
19ffdc946f10b2c55aadfd74f1ff1667

SHA1
95de1f80d4f0a15c51335d3db107f93c13ddd2f6

SHA256
0bc65dbd46e109a1cbabbff06a69d6d9d6f10858e21c553f145e361536833b33

SHA512
70df07677e1ef134cc53589f7db3ad6fba55dc3f977b127e468008d781763324a82e6a68e22963709ebe91baa5a0fb85dcb76c61629196d6c897f194cdbe2330

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
b97a8b16470757768fe3df801cf6b241

SHA1
c004e6e4ccedf6b298f7a4c45bc1fd53b15da04d

SHA256
6773bd8f1595db31e53756a67b9c968616630a92f911b1aec15b2f4b56f2c3fb

SHA512
26a2f1319053271f0ffc06ea39490929b0cef3096c55a1fddfa3c7f6bea31aa49263509d29c520d059dde7ad3bd22e1b2a0fc720a1df3a9c51fc9861b8312416

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
c0fd080ad1c103dffc5bff5ccc9d7ce4

SHA1
a756613bb4deb2f0e726ef34f13a2d0750d6b6ea

SHA256
cbf7840426d26e21bd845d20572d2cb8bcb448c9fc9e7d484a2d03e3e79265fe

SHA512
09e19ddabc52a3dc0131f58d2cebfd97edf66909125f0b519e89ced5ec43701b7abe675acf845556f9f34b41fba21c21547a0cba5a01fe361f387e4f7e9a8b91

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
caf4e538faaf5c2fc7e111fdbee64b21

SHA1
0a26ddc01f1cab9149cb33ad871c34a5093a0b7d

SHA256
2487adb418d83669413b1abb984561a14eebba6cab823680270a6bf9447e9d06

SHA512
14e676d282c2b866e94adee2cb2f6f6e5e0ca9c949389b5b6cd3aa443b55e9c1822c6706216c22886eaba0098375da0bee8f1a83bb8d092c7cfb1aefa8aa46ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
da72254576ce99bc332c6d4629fae842

SHA1
f75f5eb76eecc2a1bad33e4656fb8948ccc8e83e

SHA256
25915c20d21128c78f8a32ccd5d09aa8ea3324c186fe75c77cd342f91109ff26

SHA512
89ca46436db19bac552a5c3b396155438850d64447827bc54d3ac310e8a31c13483c89973c846b38befb40d57751120092f3dd43290f3e0cb980abd02a169ee6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
aec76239dd820bb776c130dffc3d6da0

SHA1
1cc01224e3391f2c148395ea6bfc6bba60309d2a

SHA256
472cc0429a08c38c0772f11cfe8c73a3ca7d342d977b412ada1ba69038a66eaa

SHA512
e30a505e72a92bb3eceb3cccf85655732d3a083dc4630f9b0da0071d102d3b0c324c99eb5caae6750468f28f1202ac2a33b6a018b61c6bf18aee6490bb8a2549

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
b4620b0cfb713f39561ca0a0abaa1d28

SHA1
6809953f4fea2de8ca1d0ecf14eb1de878c08097

SHA256
6fff1f8a1044276641cbc81840d189589aef8825ad4fd8032916fdaa10692f55

SHA512
6d9a7f73fec55172f5da3aeedd48c4fb8b97778c59b62a4cf18d2dbdc3c9d64cda879c472d7eb01fdef0c2072e4824bfe4c21752e22f602d7b8388224d4a267d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
5e406d105650816780ddf05cb6394875

SHA1
222319b937d799981c1250a5b81dfe0464dfd699

SHA256
e36599b85fbeeef3c4456847d1f2c6bd82d049078edeaa877a92222b65a5f056

SHA512
aa21f8ab8cb6c90e0fac07d550de21cd764701e8faf9d78cf5731a08fa6ce118e69c8ac7b39b244f0a7ba6123edb20cfa5c85422c1123636a3145b74c04bb63f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
34bc6d6f8162951edb2b57e9e24b7f20

SHA1
c90037af9910d3446d47e16048f8042dc6089722

SHA256
6d9c91ec30fc9360dbbf27aacc0da2a18cb952fcd7ff91d942de09342eab94d5

SHA512
2dcb7e77b8a69c5da078b7f30fdc92ca5dd6c2c093a64f634f49d7f0af808f3ac4d0a1c8797a962dfcef6a262cc9a4140980c6c0b937114a8a589f498fe85cd0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
58b5d7718803b5d43837066229623ef7

SHA1
2523a843bd2ee47438d442a6e528d42c8fa48043

SHA256
3ed597de16b47812c44899b3fd16cab495d2f198de66d885e06286691a65675d

SHA512
e220f8f7143e5eb9c2f224fa86e9c6c8a2dce125b8b52add96ac9e99bec635ebb8afef730d4c2385700a9afe641a8fae32fb53e62f056f12b3b6d8a61ff1fcac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
aa94865960fa25e49958ab932dcbefaa

SHA1
3091754b396016b109866214ac391239f391d3c5

SHA256
eae30ddd8983a0089bae0698735ccbd358843a578bd85717cb389de94c515d45

SHA512
67d47534925b8a05bcf0ce765018de262632083fe736bb3bbdc31e0b7cfede7a2541c80bd95e2c70c5e448869488bc2e769897ba4b2af3cf6e8077abb0c22755

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
6ed7f6fdb4457e157e15a71b977dac86

SHA1
3ed8b3bb09ef924de6911e1d9b783b07c197b098

SHA256
e546eaa8b5ca8ca794d7b706975f771274f9e48128fde6037fc31b27c5112992

SHA512
f7a3d6e2dc6c42e39fd4935ce0c8c461c911df95961d293d854f4f602e1b4f898a4220ca6a88ade2f5d7704768ea87876c9261bb2b91b4742ab113980be0526f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
72e9e04617bc14719588e65a48a4b11e

SHA1
343d1cbd551e068eac38c25b55b7f8453c284050

SHA256
c4fe1024b8b0d358fa8663658877e4847d284201273f5c7586234b29a5a51caf

SHA512
712e0026af64e19683f1b5bf4f7618df2d605b333f3a2b7d5aaf5caa88e6512e62fc5b4e57f652f5e99329f5da88b61db04ce3c6554d41c94502ae5ab15a71e8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
3ea2fa6c1cba25a7e2acb8bd6a75c629

SHA1
8e6c0c101c6ad81bf502ae71cda83cf85caf41b0

SHA256
cfc9cd89caeea7d11116b2a3d4955e29176a6f9076330f5f54ccfc9efea155c8

SHA512
441d0d5cd277b2b730d199833042ea041568796a5f22299a0ef47c2cf70fd10a076e0c308d78151c6e4e52514af81a01a65aeb99a30e06d48654a64d4d07cf64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
20801cc934a3af35b921c361f44e3789

SHA1
ef99ebc78baa13b7952b1565018c80f5dfc691bd

SHA256
f10a03a894f372c8abfcce17256faf30ceb808a0caff6154ab58d74b40aa45b5

SHA512
8ec76776edfe1f92cc2cd55119d4188dfc57a80b08557b8683d504a3df510643df480be0f5260ff3aaa61d15b3edff8d18b148c53be6e20a2d8e51b2bd34d239

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
88a5e0786cc95c938149ab0b0fdc70dd

SHA1
15867a7d83dfaab02669dda96215d6f66cd9cafb

SHA256
16c5997964b3f568f6f55c436978eb9bf59a20d722b91e01986b17a4320fbd87

SHA512
3ceb89129c9fcf01fc29fa7749d88f2e76a527795d06244db9fa6bedd6be2d80e06a58c1117be24b529a6071fef492cd7ba6ba980ceb17fdac31d7c6772bac3a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
4e3a41848a71fd775e7c8844fb447fcb

SHA1
a61b60e17499e008b5063ba8b44aa8d59e059976

SHA256
9c58f4ba9ad4d345d4a541d9ed3aba3bcf1bfc84c1ad8b0085bd4333c051eede

SHA512
61539c87ea92211a6adcd41bbd316c935ed49d5e4a0e1216b6b12ffc85c3af548e48e732a3b5fe0bff80404d222108d575ce39ae94a0093146689f0be7061564

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
905c140627e1cf5df40f99827722a759

SHA1
fcb272a117e01da32414f8538e234e4b8f6ce3d9

SHA256
761a83ce6d08b70f4890fd3a2fc38b0bcb94472e6f3a6ac113836173866651e4

SHA512
9bdacc92177e67a2af237794c47abc36f224c990ce8ff64686b0597c1bba6543426573fc6ca3457ed39dc5384383a7a61e49dbc0ead64a3b8624e5b6f35b8010

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
b28ed250750eca141c6ace44caef8cec

SHA1
d955d96f5954e2514f7d207941b38f7cb2da381f

SHA256
133d3bdd30366d73b6fd04c9cf27165525ce0e031e28148224d41d953dc777f0

SHA512
df7c9817068726464ffb76bc6d7d05bef3823b9f36d6ad0d335baec341cd783c985441db5aaf1f016933f521c0ef48c27566784af3a53ffa61ff4b562fffe0f1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
92f748ba159d084dd063933e6aaf5392

SHA1
c3ac409050f469d6906b7a73e0fab8ebe90546d1

SHA256
e2e0d57cff36bf6bab8abbc01d82b3bcdb6344b2687e300238ccfdf6d2755880

SHA512
bd6095f01c0d1a383668df22e5e141555512833d1251fcefc46d4541787c8e128a4b37bf6add0ac543b8c6c80f2448cba295bea44c225fd0eceb6296fe6a3f9b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
d158fffd24df74efef4db085f2c0672f

SHA1
af254fc720cffc0cfe6f75592df617e68984e55d

SHA256
8319860ef2ad55d5ecd5be7a3d5101e308daae39b5cef3c8e339b21252021839

SHA512
af3e00a9d704a694096290bc0c8fb3f0b838414a4599e0f5bb42a9b9137ec7c9b595caa2f242ee7804cf0b86e271b683c1dcfd61f9da4ae61ac17f4b428e27ff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
bab909f7c38d8eab876d531f787f4fef

SHA1
b6d5ac37d1dc4f372b9ff1ffd642ac451abf6db7

SHA256
94bd0dd0f117a415444ffca2f50bb1f80909bec377b153f0420c4dc3696436c2

SHA512
2135d2089c1d63c643a9ec838e896da32774e758e4790e6e605681f7a8baf57ad932c5af5d4a9766d232e8dc0efb4131ed5e558dd5e6528bbff2025ddfd89933

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
68809b5d0ca5eb9db4220874c838b396

SHA1
bd63aef3ba9513ab08bdafdbbeac169d660b7f65

SHA256
52ed432609d71ff089784eca338c2fccc54cece73ddc9594ecdfc1ff5c1c7ced

SHA512
db61b7d374e63bfe78d47cb0af6fe2096e5260e0c66c427b5795f64c1bd67d31266a08b26cb431208a100204023aabf47bc98cc19b95b1d2b382514453844819

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
dbeb050747a6017183870a173e3f26cd

SHA1
132d2af7d93686697af116374fde3acbbb9e6684

SHA256
5ad0f015c361497bfc2debcd53aafd02398ce64a26254c86b416aa028ec998de

SHA512
6cfd24bfbc160538d57118de41435d227b8fff552e46d75d67abe871d2ed881143c5ac938bafae6241176b2cabd4fa01d8763760aa77058cde0d9b74a818e7a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
a8ac02bf7f35a52940689a52f0cc5060

SHA1
bf3bc71b77699e07d892c0e045b3f8e08f763736

SHA256
892b3c748c30db67b4844a50e05838fbac33802099bb8a327bf944f57cd1c373

SHA512
3b4c56a032ef9a3b4dfb233502ecaf84c716d24b1a2df3851bfe112c093ec75b72b8ee4bcd3743f713593ecd7cd356358821603861e94ebda4ba1bba559d5a41

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
36a48b476c4f5df19aae8e90da3a28c1

SHA1
fa66f4733b2f35a748346931c125ce928cd0ffbb

SHA256
acaa2a4bebb9e2a99f234e4aec69666880bac38f2c8275e132845d0ba1021691

SHA512
937c91c9f3d54cf5761631f12fa26831d6bdb994d6253f61623ddcb13856686ebd776148aacf4b2b73505bbb9c70a610680113d0f678d1eac8f8520b8b0ef3b5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
067bc2fc75f7a37569b9e3c74ada053f

SHA1
e82690bb0b3926dab57fbb755fb89a853ab280b2

SHA256
ade24092052ce251752636b1cb370b954a9af1e442ac0fc9b198f0c6beed90ba

SHA512
c77bb98f6792f0932a1642432aad0d2ed16e6799a0c423de58463d1f8c590b8a91bbaccbaf8ac8d0d37f0d40fc052e08c81cc3d3e93d175f058d4ebf06fbeee4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
55d4999b29b9751ea5b9067943b4a70b

SHA1
59f1e8aa40be136ea8ee148b7efb7deacff4a861

SHA256
fa405a4e9b47f6165efc2e08595cfef39f3317c3059f82f215c19e0267863e2b

SHA512
0d2a02969357cffd747e23f1229e01d5b00f63116fd273219af077ce8786e5b1a96b74237e11e261a8af55b12dfc52f5175331efd794827262d403a4654e7ada

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
d9a81d12967ac41f4f9b4ac321ce82b9

SHA1
49a308e5ea0126da49aa6805e63a8482ea279011

SHA256
f37963518d8dc80164778c642bd2e9f3fbc6dff50ed2d17e9991828b1aab76d5

SHA512
3567d168f4a2b5ce7310a5243bc338e1b1ad35de0765a9abb9a99421b48a215441986b985d5b328b247736e3f95c084d480c12bd33f548ec256a36efc1ad8b07

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
42f0a9cefa6f63b093faa2f0d83f0e8e

SHA1
605d1c16ab260819ecc112779640b7ca60dc8730

SHA256
f5abab494884889dddb7c78af2fd0065f63cf194062c9dce3cad9b19df89a505

SHA512
6a8585635fe7687dbd9f95a691faf64c26818e3771b26d79b069697f91759eceecbc740dfe830563038572104298a300341974f60ddf8ceeffc1b67f0322147d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
f373f77d716731c13bae5d25b10dffbe

SHA1
44b9821a3b6c4d5628af23e20dcad138939ca316

SHA256
3ec1e81d6040741e16dae6b65560250d122ccd1d56cad2097e4d3dbee455f283

SHA512
513da280dfbff5de1b4c1ecbf2f38bcb41b7bb29fedf68f6514454dbb7851c5d21fd746c6581aba80cce5b7bb2d9f3fee6cdf87706334f8751e234e63f3d2822

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
c9054a5a90cb3c3525696c599cf2c7f9

SHA1
b5d89ac944bd278cebf369539ed1f9a1344de746

SHA256
dab8383233bef3d4d32395af165dc0ac1da4e1b080ffd81f6878b33864873d33

SHA512
c37865cfec00d47bfe289320ad328f55238d9154654c7bf275c22bb61b9bb191d945fc761e157aeb08927a63b86e8db2bc248f075e0c557e5e9c7f86f3f59b5a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
704e4e56c5a2e63abaeca299ba539839

SHA1
2dd7c0c1fa0757e69ec88b9ae22a295b4d7ae082

SHA256
abd4ac7e0c8459d5c7d2d919a937084a47e48f4b6381cb9d74d58bd934b1f076

SHA512
f7ebbcf46700360ef53aeb5c76bb6fed14ef35150cc9429b3673bda271557184a9f24385634456f358a556e1f1ffbb718404d8e3f14fa2ba6f7a4089a81183b9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
6110865618b6aa4392d0ec2ae8ce0aa8

SHA1
1f73a294a2b2d3a466ccc09180fb9aec157cfcab

SHA256
e53a8df63d49f56d42e0c1dc69625e1b78a0744fda50f6622754733b925dcd39

SHA512
e9d95a1adbb684e873cbeccc0c518cf3b17e718419b80d1cacf34efc6a64c229f80e3480bb80dc5c352179dbddd84cce91ede7ddc3a79377f22f965a0104ed4a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
941d91641bd55c2697db349055a4ea7e

SHA1
815146a2922321818354b654bb5dcecb4ed85f39

SHA256
d8532332fbccede63fe0cb3f8d6fdd3d058d842bad903d80241ec9e30017687d

SHA512
ead3aa73c76e7df6a5094f774a5166837318566c503b32c492e95913b91dd232f62a6c6df6e286f5267285e20b480b4f627afea92017ce943fe1ce3f417ff2ff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
62caf9f7560c7c14b92488c07c627325

SHA1
485398d542aaab2e591bb927ead07ce3295c90af

SHA256
6783b0099f8b149d60564b1d0109c5717d47a03826b1a49dd52b682c0dbf50fe

SHA512
ba20eab974cfae1c7904f1ffd9187ff1836f5f5361f39d84ce3772c5d0c68e331427288b58eb814518ac6bf9bfe298ff3df48b844ce9044c1a8a0af94d2193ed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
e29ed5788e5d0e6f74cd0f43ebc2da64

SHA1
c90178aeefb6bf59b65cd72501f128751cb73012

SHA256
1b01ba1a37349e532f7011c9248e76e3d3b4e761da64fe360518b58cf3301858

SHA512
6854b86e4b3b8f29da63399823e723fc955bc96681067d6f6803d55061f8520037389f6a22d8289bd57a60ca99b92ac400f3b6c178af270b53d0857a04b5d117

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
99eb8af687bc9b7ad17c2d541f175962

SHA1
f1c9a20c35021c8ef8f3b89bc93cdfa31a730808

SHA256
77b4da152595867e92c991bd64b36e4c34149868da8ebec8023b704829360286

SHA512
a11612a1981da6142d5eb7455142648710fd7b3b5e961c4278cb9e57b7ee3a9d05cd3c61f0d3906c895ddae3e825c3a082c23775dc98721b272054530137fdbe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
695aa04bf1e1144ea22e5a1ef5d8d6e8

SHA1
b157a829105a14e62844dca4b6d56a332cb49118

SHA256
4e1f433b7a1e8dfc2904ce79ab7994bfdeb56b69ab1c5d3df98f577dda78b003

SHA512
aa97fbedbf9307810df2ce84ff5cad3c2065e65ce2806954376ff648cbc1d5af0abf1c9aa29e101be5b3ae35cad4f99c17150dbbf7e284b91f6aea201b5ccdfb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
8b128552890d42aa208076828cfd80b6

SHA1
7ad34d69acecfcf10571ae6c9e6cef57a0d90a73

SHA256
a5d90cd4053f84e6022391f9e31b43a9862daf37d28f1c51738ce315634e0c4c

SHA512
c4b87eb2dbab5e5c2fe8db7e5f253c20c0a0624859feead903032ae5de6e0681af951872514f13221a8fe756c050c6fe489575bed967d687a7f52da946bd4663

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
0cc6b9de07b42355914d986a11ff99d5

SHA1
77f94aff9df3f270f8e307e91c0453385773d07a

SHA256
fef38c57f6e01ec0587950828c604acf5a198b393c1baf73b4b50cd1f028f511

SHA512
4e705f51c5e27c9abb128479422133347e3b7c282378c3dd88a6a0920887dd845df56073d254855b8800ef28ecee34a2ac1ece94796a14ae08497568cf1b1490

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
2360b7d0dfc834f7bd49a2a0876a6f73

SHA1
c0a271dcc250ffed676336df890d9a634a0069db

SHA256
93a9055943fb4035f1e4f05d4be1acbdffe563171146bbd09c45518fe6581754

SHA512
4ec036f7b4c62ffbf5a47c028b59e61882887f28acf108e03d9604b8a6b9fce54b6e6b1746c3615154fb7f7950073b3acd0704d5eab455809ad76ab15df3516d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
090e70c1f295de14932d61744dac7594

SHA1
4823f0d37b0b53184bc93e5fad2b5a1ff9622a2f

SHA256
6be39a9cd4409926aececf04b31d26d89d55f628e3e52b0dafa692f1e94dad81

SHA512
0c93170fae09c0f97c37a1178164ae4e2c8622b2733822c9118ec7c2ea1edaddeb09399b5a37e7fe9ecb9d1d42232fa7a3fdb48a0d7802071b9ac3f5580294f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
5cb37623a69256210622cbdf123f9daa

SHA1
ebcb3e32c5c3963073036e1411ebea79b6d21a34

SHA256
6cf362c829b2bbf630a072dc2974608b978c36e47e182c6a72304f54b1a718cf

SHA512
3e2955be3078b8981490dea5645a17ee73e90ea7800a17d79b0c9990176fea803d745ebb7c55ed4020ed0def8a8c922c227e4e897bec4986086377dd5d5bb718

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
87e795587509239bf20f13926426326a

SHA1
559c0adb193c76b173898fe3a48f1ecc6b4d8e6f

SHA256
c496831ee4f0aacb8c39ecc8e0db8115241c479b66a0d8d4c2d20d45fc54a4aa

SHA512
0392502748f4c1a1ba441677b8a52c0f951a75c5d0164360fed4bde51dc8f198428ebb9406b3d80caa70e3dbab56f561b0ff15981c88344ff1f7b6219d3a8474

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
f83683cd78f1809cec22487f968ac046

SHA1
03b49a120cfecd1028badd1760a7c5af7b308833

SHA256
f4f4f1bfa0b498d083dcb89df2a96242ed357f4312cb9a073f5bd9a6ca9db6cb

SHA512
f62823ae4e05cc2c57284f7ae2f6e576b436141f7bf94e5ebf8b9867e87ab5645f049bba2074fcb3b83cb5785ac0ce57ad2b25278812f16db81f22a68043e738

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
c6f260b2e52065de165c2ce90665acf1

SHA1
170499070e9869acb6635439ce2e957b75343b18

SHA256
21ce9aa1ec678ce9fcaa8944a2290ca720e1fcddc7255d7e2e19c552a2f7cfd3

SHA512
e516a8d60a20b2884617f50fef1bc6f7d2ab8a6da1a7a3217e26c6d26630dc058cf5f1be813afeaa1aa04307ef348e7708fde31be9cffa74c3f6e2a42a5f0f64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
3c9dc81c7f60665ddf541754d049938a

SHA1
5b9abcc7b80f34f3b169fe2d21c9d41db8ccc671

SHA256
accddfe12f640fe0d0d3594f02bee5948266197b3bb4fc69fd87018e68fd79ff

SHA512
0c978835b6bb54dad2aaeedc6d3a49611dbc485bb9dc0d5612982748601368f55d78d8a0880b2732d06004a53f574a705180784a496f5c91f0a003a0f255c813

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
2a950cf8a41f9500eaa59b5ba3870de6

SHA1
47f074903ff5ab7a4407a1550a75fdedd3c09c92

SHA256
3685ba1d0450c1ac84ee4dbd02839ac6277843b6ba7aa5245f72f8fe81534d49

SHA512
bf66b1856dd6e1bc7c65629522c7dae4f86a34b694133408869145ca9ede0bbab21c0bd1f87a326588bb4268a27c4ec47d3072d9910dd616f6070695d2706c64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
4b7b724ec269b8bd5bac1c851a382f47

SHA1
c0e3748b3ee4b944093abd615e5c357778de80cf

SHA256
25be342e63daba596578f3dd0868e85285fbd18fe8994c9de0c0488e1f8f0db8

SHA512
23e6d7a44c1f5c2716fc386ddd8b322903b91e3921404c032597d6c7b540661e0ea7773c5f40b86f5f0e285faf96e3d4f0f7b1e70ddb98ea0eedccdc7bf1be1b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
89ab1a41f6fd5f6a09940f989cae36a2

SHA1
6a8d87c224506159c490b1cfc14301d1436cf4fd

SHA256
a42439eea83ec4686f58ddc5068f35e45c7880c89f0da7526605a460b2dca5d9

SHA512
cecd8e6e8b98f7bb0d2da3e1bfd10daea44f435089ee5ef1c3551189f542ef15991ddfdd89db6113273284f55b6308b8d29206e7407ed6014f24892105e8a2e9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
65bbf22e563dc9c46560ebdc29f54814

SHA1
c9a04a1562698a3154c7ff26d3dc3c6422eb7b7b

SHA256
a11c10bacf05bdc499923d893ca4f88ce2757707a72b2599654d57bd56a52c68

SHA512
0348d5f43c92852122c827a2c11920b442e0ae09387a8cb50709c1c24cc8eb2c5f097c58e56adcbf5fdc86168d570ec88f9bebdb91f86a0aa3fda69996b63239

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
ba8af73c399f98fc0a73900cf61b1c06

SHA1
dfa80d7e9557277cb00d6ecf627fd5bdbeaa9b3a

SHA256
92ebe5798e5efe15274f4af409a1d2ed17be485f7c19f031ca5fb5334fb04ec7

SHA512
aeb557f4d1698b8e5c15d809ebd992cf50824e7fc47490c4a5a42e5566d0731ab2fc9f848871c8aa40e8dfaf8896aa0299980e8e2ff651bc022260a652d32140

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
448e7e9d4ae4dc10643e0e5eeefdea05

SHA1
2b75607ee0a9b33b01bedadaf8cb65828b67888d

SHA256
74ba6f6820bb987b76d2dd7369c2713baba51398b90dd2f611a5d9389dd9d084

SHA512
e422de0917e2dbbe39f9ff2459c80ba31dcbd09f6a625d93061eaf849a7b12ae2d5c7deaad03f5aa34cbf80268f6d5b7b7c7131f1e13bb616c01f1f3c1db284d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
ab2ecbcc4662e3a4dabec13469cbad69

SHA1
9b69bf5fba6809d1f3f19a595757ae154fcdd5d9

SHA256
ba8d5758e111643d394e29ad6e2590c635acb9e804663d125a0b310a0ff54ac7

SHA512
5a031b77a34dabbb59f76609796201b9e4183d28f6821ae54a363cb929ff0c236ba1754726b6b4e4d6ace3d611ea5eb5f51e2cb52890b22c35b0813f1e204c1f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
5b7b6ddc70980e05609c4734ec69eee4

SHA1
317e09215f81436407c0f30e32a5488686691dd3

SHA256
f2d44bdbf91eaf54de5c902f9d26d7687bb2b964c7bdcc5734b538de73c5a3e2

SHA512
f92994f078262293e199499ca7313e2f06851c05c96cd15d43347b4acc3cae47c582f4dfe175680c39d2a3620b5284bd00f0ea23164dcdf17d170f7734b17846

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
89863d9d2a958ce3726ee24eeb2d8f34

SHA1
691b9ddcc2a34b442db182f8eb6cf0fb2e3d2605

SHA256
e28af845be6b9d46892f24f0eadd72bf7ecda01777b2efeecd147acf3fb81001

SHA512
50155b6e2ccd5c8809e864fef7049515a6cf4116daf165581bf9ecde4a8c68e4eb99c464022828eea93960c70602db07b3de091e2b6cbeb001eda97dd9020b3e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
99d7beba2e5d96f183c569bd5f2ee624

SHA1
39e35894d853db93db689bfb30a241f5e86f358a

SHA256
af59c65c911cfae1f9c7cb9bc748cd8b81c417b0cbd71453e5fc736310dc9236

SHA512
9ff99dfcf0be5b8d3649dbc0b951630942461d1e8e10a5222e06bc59ea5e721ef613ea2d283f19ffe14bb3b896a7d0843371c61bb16f0a5bee1837377f3c68fe

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
7f2d0c43a24d1c3584568f05c05c50f6

SHA1
13c0358c20cc1a3fd55e88d25be48bdfc060c109

SHA256
a027c6ab4196da9b6be8a2292207568811dba21f86749ae74ce561a0084da156

SHA512
0dba138888213780cc77fe88011d0e96f919e3b078704b382f22f7ae4970a4d3803d90a3199f40d0db184c086c1dcfbb7c4dba73a90c869e63e22d71a65d7fc5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
935f736241498de28e9380f9fba7eebd

SHA1
3fc288ea91b74c92d434b8e72adb439589019506

SHA256
d767472d0629e3cbe10629bee6cf3d06e6ed755b7d7d76a5e750dd60c43831cd

SHA512
f6989de12b90d79fa4b119d6dcdde8c66dceb78450b0b3a78fa45606b19ca48f51e7bdb04e37f249ef88024d8e60574602418a9c1c5f34250b71edd00c918ee3

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
84e6488dc7451f71dd4049185484cbee

SHA1
25d5c8994ba18a740d0842277d07c8e236f1d070

SHA256
20a71b4a084bb6d41aa18490ded934a9655a310af2264db885308a383006cdae

SHA512
1c1c26e3cdff8f1cd100b11b8f0a3f7d407c8c900110cfd435502b83ff1c603953a12aec6aa00890c30105ace3198c34d52d0924ea8036250beb565a1a2cec60

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
cb69d8e186a92af1bdf5848bee18f81f

SHA1
9a90231a15129c059683e646a0acda58acfe12cd

SHA256
48a24f62e65b74c4b38db238a3826405a595a11acad37a4f78792f710e944d7c

SHA512
bf80c47b2b8f78aba794bf58c1fcdfae8175493463eed63acbcb9f0312fd753a5d303503f2e3e622b0f7085d446281150c6112e9e324444bb43f028336a3e757

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
f22d0e05ba0fb8908f141f29743e8b22

SHA1
37aa9d567c42992de3c3eb444b1c9fd119fbe09b

SHA256
6781d153ae5f9dde89f78cd0a1809877cb17d2a680c047beb81d0a4763b8e79e

SHA512
c1926b3bf37864bd74cdb1401eaac7aac6c6a4cc3a6ac342c71f11acd4eff9ea0faabcc8a2f04865059bed89752a7d9d26bbc6cd9d44996570349fc8c8dab1a2

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
9bc585ae23c0614803368995a41bb743

SHA1
bfde506260ce5cb721e51a642b8c2fb3e8a0ad47

SHA256
b885b50bea68dfdc3e484b826c2f22e20218290e230acf0bb972f8adbf55a9de

SHA512
a988d000d9973346bf3560b6519199c8f40f470898d889062062fc950cf2dab7724c2175e57594dd93fece225604c72ed0f71a240fc456b867ca6cd1bbd4c47c

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
2ac5918ae456df3e14029d8da33d678a

SHA1
4f614e835cb26d3c4e4793c111be0a231b6ac020

SHA256
927ea248534c386aa2d8f67f506f1875cafb1f8cc06d26a9aed8cf09b4d3e7dc

SHA512
98b8b0365a352a26aae3265bfa0ed2e6b86896bdfabd2c2ed64d955c9424c9d149962d8050074853ce943018f8380fee331100a6ed7dda5ae61a8acfd47527f6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
7cfc77d6f2f3ee383638f76115e85247

SHA1
a3275da34d6bec5078a33b1825abcf331424b43e

SHA256
f2564224a7a3a4d12e0fe492ad25e5966b918810152d6b9d6bf631a8878858a0

SHA512
baf1458792f3471f260bfa2677fe5e043ed934ec8c87f8e0978ed0ee46275a0945c87e1365f756ae0bb128e9774a3a6522703daa75aa3d70bcdab1c860680670

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
9cf3d5d032c0d918c904a5a84b899f96

SHA1
509bbd54bde26e2b110cdf90d429edc99b9e44ae

SHA256
d37cae31fa749db4c4001771f9c578d2eeaee20943c30b8a3bf21b5996c51fd1

SHA512
9d7aad104efed964655bac582a875f0810f769b00849e6adb4558b07427b03a757b05ffec05713fe27e6d623832f98276bbdd3661287304c6c623afd2d85d009

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
2374f078959157e0473b2731cc7467e8

SHA1
de240db5b1de76198709b6aa07d8aa7b0781e749

SHA256
125a430088c050f3b9e8eca04e51e9d19c816fe15de6381950db671efb564ee0

SHA512
d46ea2148f2ddefb0bf8e7b3be388c0f796721f0100e186785b0aca0ee1c9ee11ba02758b8225a999603b086895ae1c6a3f56cad4c065904bcdf1125e59e0e31

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
9c5561f742b0e96eefd9b656b02ec7e5

SHA1
5573a8bfa5a676c40786f96254415ea74e4291f9

SHA256
b883c6d0e10a9ae0cea4a2c3499a8569fd1a960da643537fe85959bae5e0742b

SHA512
e193bc2b7d7ee4f2bf124d1ff815ad550a13db6f22f545d4bff90d92922611d7ff2706508212408410381db37a192aed994a56cbae72f200fb0f27638b67dabb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
7771fe1042ad8136885e73a6b63cb3a4

SHA1
9706fdbc2ad621d627ec6ea655e3cbb369372ef4

SHA256
aae7ad96c15dcfbec1bd35f6450ef6fe1b4350124f6db66f4310c6912ee1db4f

SHA512
fa3b34c1e0ede2610c3f5c300cb389547f0adefb8e112a549909c1cd4526dab84230e19b523e9f3c0bf23633b86247d211a1ddbfa80efb92ada65a04e8e501bd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
5c1eac7233e2c99eaa69856aff80e865

SHA1
1c6b680c783cf06c52a277b7a5a0e737e9b68121

SHA256
484414b4f0cfb75014551767ac6693bebac4bac541d2c80403a1e5a384a5a30d

SHA512
b46f32a6bd4c96f216fe3fd8fbf6595f41dbf4317611140ecb2869eb5f9012abf70c1349a01e6bc1a7a65536445c53d866344751c95c16f5e504aacfb90b469d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
aa7e7382c8c86dcf81551740f4bff766

SHA1
bbf8586b75d62f54d1ab9cbb6c82e1446239137c

SHA256
f1a62c5e6f31826bba20d7767dd7f68ef5f9d62306135ab49cdcc0af375ccda7

SHA512
6572940ec29358c766897cace0c914fcae8a5f2f88b933496728c9f7e73573635c01275567f1b3dcc487da1e189a3ff37d2bf34bfaed37834847774f04933af1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
e8a0a96a2f6fb20490c8db6247828a8b

SHA1
a306ad08bf3b341e60ff0e8c7dacafd4ad7e541d

SHA256
81241594b54f5e7fd9b418b7ec3f43667d522be842c16fbe3e50eebfae1ba188

SHA512
6e26bec744e36e8b8c4f481e6698f3840b6156073bad14dbeb777fcb54173d870c08751a9eb3607fdbf6f9c1b6fce450b995ce0a5ebf1e23a12a6a792f7f6c45

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
eda44930edae8d297bb9b8f835c9ed37

SHA1
d79286cb55b6f68c15cb2ecd8134d87136f83d37

SHA256
c5b6afedac4909572d86ccd3100203ff2451b1da28e1ec1d7385627564b51187

SHA512
e14d164be6b9d1824801095aaf2bb8004fed5eddefad3676c03f359a307c30b38caa4ffc23225257b6e2e31bb1b65fcc60c90e2e1b7f336440c63c74ec499ed6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
2272e127ec82de31cf361a14c1725d98

SHA1
84158a57753fc5e32032694ca50e0d1a12e0326a

SHA256
c9e32a51d8752d063ac2b7ec6258f2f0d0f8898d3ee40d08b7f680ad0fb5e2b5

SHA512
9110e71b6caa7f4aefbb887009d9b9f21fa5e4bbe5468b81babc00a2d94deeb63a18ae470b058113938d774dd222548763320ddc834e4417774dc310a55d07e3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
0af5d1d0fbf45b6b8cfadb009613c8f4

SHA1
84e5e413b33ca4984ffd6cb4ccd699dd7380fb86

SHA256
06cf1ee65582ae7b17c380172f32b4601fb4300a6e9677a1dbaf2f1cbb8cc7f4

SHA512
db1ef83419321e2594f2a4a707acd7c341c31ebe2e28c1bb44ed7c77d28514a65fe0a01bdff1b03fd2bf6f03da02b9a616a539fee1baeeb5b895dab0992e711e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
dfaa1ae08ae1cadfa5facd557c09466e

SHA1
e5742de65f40f8c45328169c97f4aee397496cbd

SHA256
1019198c79768511bf6e4890a476fdd60adf2b9985b06b6e220abe109c6ee7f3

SHA512
70b4e9fadaff17e5bb21162e9ac9a87746067072cb3f041ce534219f3aa1aa469bf366348f949bf0bb5afb848f6e77825e582ee917319fa65ebbea2282a3b9a1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
5a73dc456f63a9c53f95b6bc4922ef47

SHA1
60be64bfcd4e7a32a838b1ecbf222a84f4aae954

SHA256
4f0dd2cf2a508db8a2f3e69151bc6a3517711f2d00a64cf47d41edadc163a75f

SHA512
9f54ebe69b8a2a01d6a3b3a8feb62a2ebfe5c8e9d93a5373437c71520d323c309a6c6b9f73210bf4cc394de3b1f13960ca2a5ea039c7cf437f81196019c0063a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
e7fcf823f7e1c872856f299efd38b965

SHA1
5aaa4e52459acfbf6d9194992dfd2902f995012e

SHA256
7a66b69613451d6c58d4c77793b7164cc582b9e28f6d0df3751bf7a9b35457ba

SHA512
064749e25638b7b9ff5c0d8b73e7dd6a03258a7b8e6835d8c9b12c92c3c637dc6fc5cbc791b859b9a1436c307fffeea326026808ffef9183716a902135bd6f48

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
9ae17e36eadc638a77530c1069dc260b

SHA1
98a3ae66f1a2d87c9ff12cd2c23811baac30be97

SHA256
3dfb50e3e0544063289c03d84e4d46e26f911f252a474cd8d96d7c42ab377c0c

SHA512
9e386593218e49ccdee2186a031fa65291b1aab38c9c812e8743b7012b9fbd66aecf040ea77cb56169e2b1c30d5ed62002a4f8db33749b622a66ec70307af80c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
5728af786b3f749e5333f8185c188d1f

SHA1
e9df3df0aa8ab1b4b28e6245b8c00d4fc5a1d1bd

SHA256
1a880f7525e19970cd0e970100e6410b90168e41d5d0812b145a4f0c361b2802

SHA512
b92d2d906fda5e004849b3c0d3b81dfc2a6f05235d2284e5b09bf680f8a0fc77b63789dd32225493184e991977047db18be2fb5b9b73bf55df6c8377efdb0500

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
3fe20e143012998c2136be6803ca0f93

SHA1
7f5d66008e5be4411fb7b994c5afc947bfd7afd4

SHA256
6c59e3b72273901074a96f6e8a90fd174fcb4afb21ed96188c59f862fdb16896

SHA512
44b72e562e717c376ca60657da391fa33423684ef432c5ecc16a93201deb98273afd87dd1217a3a8725335716965d45a0aaf07a349d5399b36c8c28f24bbdbf4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
7ce5672b1aea819ca97ef40633c696ac

SHA1
8c4cc90950aa653fbd817c15d0f56e46da0b2bf2

SHA256
8804c659e8a51c60ac33c280fe3d2a3452be3ff98bef2674bcc5fec3cdd9f779

SHA512
2612d469336ef7e4407a680dee8632a7c54c8c433ef98d770b4c1f150d577a0587bb4b6567821abaaa1419feacc7f718740a2ef78c6d280764816b7e1c969816

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
edb299930cda8750a49d4f3b5f9ce14c

SHA1
cac311e5514ac89ab95faf3e74cba64b61a96eed

SHA256
add92a2751bb165c10e2ce5a22407e58974837413c89db80371ef6e65e2aeb85

SHA512
90f05120d46dc1de2731c1d2eab44c166fe362b981170daf458941bc1a44f1c1523e6a096c3433935cffc97ce60985dcbfd8246e07786571b14b56528760a1f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
5271460bf01caf2ab983820a1fe0591f

SHA1
e409739459f96892f29bc2b4087bad57058dfce7

SHA256
2811800cfc05c19102972458b2b38b5b9cb58e9b58e4de23332d0b280a5b7fec

SHA512
556dc0b7efa18e6cced012b94e378810ae449a9ece57ca10c4edd6f5cf0d5e30e2754cacaa6ce8933ea0b50b41ac05bfeaef86f2c0298b2761b4adf9c163be15

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
54443cd244ef042737e4a240b8b1e5b6

SHA1
899a37b886c0a80065f5ae870e1b6223c8fae92c

SHA256
82fbd7a62912c84ada8ff07df2efaa66a15ef21e4f318af99cc2df1c33044c22

SHA512
56339ed0f74dd1819e862bd4878caab6189a1fb7d0e528ee46137b9ac65b0f8cac19e0c2f6466544c2e60a6645ef3ac8747bd643eeb9f24b2e4d05fabe504732

Download Submit
memory/1528-8986-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8988-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-3641-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-6409-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8754-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8430-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8987-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-7953-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8989-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8990-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8991-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8992-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8993-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1528-8994-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads