xorist | 44ee695b532eb984e46de29569ce35854b37d409efaabb6bcf9f5316e2b0546d

Resubmissions

18-04-2024 18:50

240418-xha8wabh29 10

01-01-2024 15:12

240101-slnwxsfeh4 10

Analysis

max time kernel
1565s
max time network
1576s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
18-04-2024 18:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Size

2.4MB
MD5

675716e76d329c21fd1c8584c4bbf4e0
SHA1

3f31361a356346980a458f72639b167f8557d997
SHA256

741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e
SHA512

33990b75e05409956567e2c417c4af3cefed346d18b1c990651ba9ae55f4c41e448f48e708ebb3f0a47dd2f95a648d99fa49b1f53bd68275754a98662451b75e
SSDEEP

49152:T1qnoAYJ+dAyibulZllnhELJPA2GINhptUhwRVmif4lqKw1UWHgCw8SbdkYMy:pMoAYJlyi8WBAypSQVf4l21xw80ke

Score

10^/10

xorist evasion persistence ransomware spyware stealer themida trojan

Malware Config

Signatures

Detected Xorist Ransomware 9 IoCs

resource	yara_rule
behavioral14/memory/2824-1819-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-3932-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-4153-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-4312-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-4313-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-4314-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-4315-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-4316-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist
behavioral14/memory/2824-4318-0x0000000000400000-0x0000000000A50000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Renames multiple (2154) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Themida packer 10 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral14/memory/2824-0-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-1819-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-3932-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-4153-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-4312-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-4313-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-4314-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-4315-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-4316-0x0000000000400000-0x0000000000A50000-memory.dmp	themida
behavioral14/memory/2824-4318-0x0000000000400000-0x0000000000A50000-memory.dmp	themida

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u0m269i9MFZ31k7.exe"	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_profiles.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_While.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_environment_variables.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_wildcards.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_ISE.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Continue.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_internationalization.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_operators.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pssession_details.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_data_sections.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_WS-Management_Cmdlets.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Failure.gif	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Assignment_Operators.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions_advanced.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_CommonParameters.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_cmdletbindingattribute.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_format.ps1xml.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_types.ps1xml.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced_methods.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comment_Based_Help.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_properties.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmp	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_eventlogs.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_join.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\System32\catroot2\dberr.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_requirements.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_While.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_types.ps1xml.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_regular_expressions.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\default.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\System.gif	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_modules.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Automatic_Variables.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_data_sections.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_output.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_try_catch_finally.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_2.0.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_scopes.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_hash_tables.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_PSSnapins.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_WMI_Cmdlets.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Redirection.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_objects.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_blocks.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Language_Keywords.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Automatic_Variables.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_jobs.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_modules.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Reserved_Words.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_WMI_Cmdlets.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Windows_PowerShell_ISE.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_wildcards.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_arrays.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pipelines.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_providers.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_WS-Management_Cmdlets.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_escape_characters.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_format.ps1xml.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Return.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\TOOT.WAV	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_rainy.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\logo.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21334_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\10.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099152.JPG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382955.JPG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows NT\TableTextService\TableTextServiceArray.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00531L.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR41F.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\SUCTION.WAV	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG_PAL.wmv	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\40.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099148.JPG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01245_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01843_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectToolsetIconImagesMask.bmp	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115840.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\eclipse_update_120.jpg	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask.wmv	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.PNG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_snow.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_divider_right.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\24.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15057_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15275_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLowMask.bmp	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14528_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR11F.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\UserControl.zip	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\THMBNAIL.PNG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR29B.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\RELEASE-NOTES.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_gloss-wave_35_f6a828_500x100.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15276_.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\logo.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\tile16.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9B.GIF	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\currency.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227558.JPG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\TEXTBOX.JPG	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gpupipeline_31bf3856ad364e35_6.1.7601.17514_none_5a5226e685faba67\DissolveNoise.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile14.bmp	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Assignment_Operators.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_escape_characters.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_transactions.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_type_operators.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..zlegadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_32d323ec6e85d609\settings.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_moon-waxing-crescent.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\Gadget_Star_Half.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\406.htm	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-scenes_31bf3856ad364e35_6.1.7600.16385_none_a4393b1a254aeaee\img26.jpg	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_History.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_moon-waning-crescent_partly-cloudy.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_black_rainy.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_hash_tables.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_escape_characters.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\img23.jpg	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_parameters.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\reveal_rest.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_snow.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\alertIcon.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\Media\Raga\Windows Information Bar.wav	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\Media\Sonata\Windows Logon Sound.wav	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\401-4.htm	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Peacock.jpg	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_types.ps1xml.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_foggy.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_prompts.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\play_down.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_0dfaaaec65b0831b\calendar_ring_docked.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_725857cf41f74c3f\tile_bezel.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\Media\Windows Ding.wav	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\button_right_mouseover.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Assignment_Operators.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_remote_output.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_hash_tables.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\Gadget_Main_Background_QuickLaunch.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-full_31bf3856ad364e35_6.1.7600.16385_none_ce3a164d3f0fa152\NavigationRight_ButtonGraphic.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_trap.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\Windows Exclamation.wav	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dc373b8a3c1190f9\calendar.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_6a1946701e0df451\bg-desk.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_blue_sun.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_82258a09c9170bac\flyout.html	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp6.jpg	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_gray_few-showers.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-pets_31bf3856ad364e35_6.1.7600.16385_none_d0d7ee773d711005\Pets_frame-imageMask.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Return.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_If.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\settings_left_hover.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\404-12.htm	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_Special_Characters.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_functions_cmdletbindingattribute.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\Media\Characters\Windows Feed Discovered.wav	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-11.htm	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\Postage_VideoInset.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile13.bmp	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Command_Syntax.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_blue_partly-cloudy.png	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\404-2.htm	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_data_sections.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_transactions.help.txt	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-wab-app_31bf3856ad364e35_6.1.7601.17514_none_44b0c76c35d4b76d\verisign.bmp	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell\open	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u0m269i9MFZ31k7.exe"	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\ = "CRYPTED!"	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\DefaultIcon	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\u0m269i9MFZ31k7.exe,0"	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell\open\command	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\XVFHASZDBSERGJE\shell	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.kmbgdftfgdlf	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.kmbgdftfgdlf\ = "XVFHASZDBSERGJE"	741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe

C:\Users\Admin\AppData\Local\Temp\741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe
"C:\Users\Admin\AppData\Local\Temp\741d75a02d0c4974968f0738a8b67104e1c24a58143b73b5ed1c25ac023b695e.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Drops file in Drivers directory
- Checks BIOS information in registry
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
c209945e7abd939a4c66b28fc2770369

SHA1
7a6d688e5f67b638cab216dae1bc990ace964994

SHA256
419f51687e494e82bd75080714c218b0ad607e8a13db893866cbcf4161acaf69

SHA512
7734296684a24db56ccc29e6094ff7f91b1032ea8f50de41676f63568cca9a67612bf43e703b3b28f6d8cf2c92e8b6d348c7de4dce94af7e014ab07023719cff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
63fb355044eab78f7228b87cb6ef5843

SHA1
88bcee4073a7c0f67e01e442bfb51f8c72fcb68e

SHA256
cfe458049dc5cdddedc47b37cefdbf07e01d7c8c891dce72c9b52ac7f8858097

SHA512
8e0e1523846c5615b8718475d9e58a256882c809ec80ff52029923e3b15fbe05aa8f3769643a36a646bee86b5e20addda0a1ec32a1c020c0531495f9afe24732

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
804b11374b18e7fec23dc9e9db731961

SHA1
b917823728809bd46aac48753ed7441204f9738f

SHA256
b1dbe8db91c4d14f001927faebe3c046adb54eee64e4b56bfcba2c91015ba7c9

SHA512
9b137c4fac47ab60560983f55cb6c2a5416a012c50f1b84e9d9dca58f29d07628e724c39cd4f03d14c1743b435b89838156a46abbbd9a2378c7d9055e5a2f672

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
361a9c52a997040a4becaf3273912f4c

SHA1
5266ef57ad838e48f6cef28514b41e450b121692

SHA256
b5f9546ba6f95735064cccf6322f02caa0d0c6658db7c0b9d1addc2fe007cd4f

SHA512
6dcb6c1f06619cef1e51c74e1e817ba4d91257bb481f03ed1eccc9889ba015c83b5bcf31051b0804d1167ab60710a9ffa0f5446f89fb84623e124114ad90c0ce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
1109ff57ce47c72b12b4b6e682c0180f

SHA1
31902e8510a4fc9e5c8c382cf23379bea8e8aed0

SHA256
c53c5318da56e8add364c1f24d66e32337d77a403901282d372abdd21d0805f1

SHA512
45d55a0073826411a7f90c0e81b9c3104338ed14b5679ed68865c74b4212e9fece804521ebf4d5bd670f60c23195b71b6a2b23173c7629ee3a24366cb6032d35

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
29c590f07fc56acc37377fbb605199a4

SHA1
50ef0ee700072738025cf5ba65f2f42f2f1b7538

SHA256
e39c70c5d1932f3e757799d0d9bddaee33fd98cc421a04fa9346e5155108563f

SHA512
1cce21b9503f1d5f6464f63623a34a92c7cf5c48c2793d8d64f2932e1383e6de349ca59a4ca25d15a11f9799d7ec8e9541239ba987ba32708b96c62c42c48a63

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
c9bb91fba64270406a8e131cfca0d536

SHA1
9463bef19e2285332710876d21ca6a2f5c33d202

SHA256
e94d1811fb2cd526ab493d6849e5fc0746c0b1bf3b9ffacbe7a14c3118a6b1f5

SHA512
47af41b46a76ceaaa01794e32889bc6618840d6bf5517500da155ed1f1115b4d1ae6979da308d9646855d53ff8f7985c4fd99c126d54c97e42c8e4ebefcc658d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
53929e0130d6f6398102126dc717cec6

SHA1
84ba8c6af90f8b54ecf41465ccb92dd5b5a0b8d1

SHA256
e0533aa9cff2263b2252a8e5631e65fe8e171be71475ef3776719b68253d293e

SHA512
46cbace0a37e7391a52c508a09f8e559cff39b4b1d860d69e4c7514a6bd16551c59b763f2b9536ba11165db3217e31fd2750d77afaab84171384723677dc7c30

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
c4f6fc695402d6e4b857f1c792f39ffb

SHA1
6bbf7747ba8a3fadfcc08403bc321ccbc5076266

SHA256
4fff97b2863a4aee40cd15ec7cc2e1ac9eb5107c383d871856c6517f00b56cf2

SHA512
726dc19f0fbfd6f4e1142346155401bc2da499dba56864b17be640c2ea0fc88048002e00a4b490b72989071ac5a239f7fa653e7c48dda800fd3d80367bcb0c30

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
abacbaca84d831b28f5cfa8696132fe2

SHA1
08f75c589a0885671439259be6bd7ca5cd357d59

SHA256
ccf4c3d9f48bca70bc991414be843c7512dcde8a0090f8c5faa0b9c4e603f9ce

SHA512
a3448f42d66fe99621a481b6d68aaf99234912834ff91511445531f0a47117c6ecb22275a4359c9b8e244119ffe8a6615fbf0deeab42c2570295044d86da52de

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
5221ddd6b588fd6593d91adf42a79d41

SHA1
27b3ef8b98922b80c1583b46f050db035fca58e5

SHA256
2e363ab337ba3675eea1bdaf200e8dc70c06f37e0105dde509d050800f5381b3

SHA512
d023b5873ac9fd6b506c810dd8a5191dd8249274966e6fb37a3d33dd6912a596bd8090f77447091410c1c8c5e88aafa4030d67460ec4a6d0efae680dcbe19d03

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
6edff3271d50a368fd77849f37b093de

SHA1
54574aa232d046b400d00760a5641f7957802931

SHA256
c7a4adb1dc6ab6540ea3cb9197a7c3564010ae818a6ba8b9ce266995528dae89

SHA512
d7ce0df4d3246649882ab3612ca670ba996a5f77308c2dfcde67d874eaddb8605e891066b10054d88b2f752fd36d32e5f7d58db4f5904114961e5474a81f6dc0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
1956ad0924806a5723b2603a5801b03c

SHA1
3ff68c5102b809d0d57d28c3428af41cfebc3618

SHA256
2452e9a54923a33d93362ee9c5bb1a4d7ced03b62917ac0937db5ebca4d0f91b

SHA512
b64e3887900e263f60be694ec5f4a7ffa8f24a7e2a13588ec5d4eb9e8299401c8c710e166e74e727c877c2cf7f92aec9dd2dd5e72c6307134c4a629d4518e660

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
2953b650ce2da9c51e6f1ccba46e6d75

SHA1
2d450b8f2712a64a46c04af26ccebe22e7bdbf12

SHA256
4a8cf872a82d7e4fd55fb319b92d50f587dbf8405fdfdccbcf078e06aa5aaf4c

SHA512
90e89d79e92afd35aa600c2fc3e391ef3f2dc6389430e70125b3c44bd0cbe1a5fb51de523e7a06c8ab4e72e190680c37796e8e47f450d4b0b5d8f9fed6264648

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
1c55a74c690172876e7c4c9daf7acf62

SHA1
1fba6396b24d79fa3b203f4179d82ad9b1d55061

SHA256
05f7019744aeb4756149408b379fd98c5fa4924ccd910a1c39281a6f914019f7

SHA512
aa9bb0660fa7c3a5b84eb90835028d6fc108aebfad9e307931036fa52016f2c277134d69f988fc6238558ace3383102f5e583a1b24660ad7da6c8cd189f349ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
0504a31adbdd527b8a08a47ddcf061bb

SHA1
5928fa34d8000d2b8c6288910a385a33d4eb969e

SHA256
a7d8ce549c608624bba36db4cd773710e48bb24a970dcb960dabdddeb2d32d46

SHA512
4bb533aa25f6c6c26b1c9819b4d88a821e227d3df5393354aec715bd4f3bedf029657ca204beca211164834b206e4a7b3757575b5a9ff9682718ba43d1908909

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
80cd12d97dfcced8f03b61ce920a6706

SHA1
7e5be17ecbed9eb07b53d712aa2e0c85c36e9302

SHA256
c68b58f8d03dddd486b04393c019382953168ada6f6f59585d00c1fd6fc197b5

SHA512
42f6dcc51985c7c4cd51f7ea2f8c55e4687155a3cab8d12f0e12e3d0017408e776347b76601ef68879159af769f7402f9406583c9752e3310b33a53a8606b046

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
16b72641b26fcf8b3f1e2930ab3f43bc

SHA1
58944ce2f6c8f8f0bff4e732377717066e87bd2f

SHA256
d8eedc8afd6135f1b4d0d477f3c457c31dab8c50adc227884a3982a32c8ec371

SHA512
aa67d08dd72cbfb4f96d6c2ca58c2dc216d046503f039dd09edd1e8c5cdd236c4251331c04902592fb31b9b3e7d56572b7ea8e27a8f2b718d0fa8db62fde322b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
b0d5af152f74899ee6cba5f9ffd19c5b

SHA1
5606f61d26508234fc2d875e1f57c1ec8417663a

SHA256
71ad94cfc618f7905d0589ce7a5003f1eacd55cbfdc453ba0ee59403fe96cb81

SHA512
45c83e2a89d80054db251081bef9f101b1bba39e9d89f035db0951f4b1c67a6235876aacb79ec9fcb4dd0bd17cb940c5907e3f1251717bbe586770955e4c1c27

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
309a25780d3f5ec1aa268acac4df2bd4

SHA1
a93626908bbea2963edaadeaebce6ee158238ca8

SHA256
61551d2acf4576d84f5ca9a5acc129f06316429a9781a597808dc16fed6fa985

SHA512
6ddd1f0074b69242eba30e0e54f0fc71cda63f4d4586d0b3156fb219a57a7c0346a51860c1a14e0a44c4a93dd32e39fa87acf0ba6dde2530c4ef7b2dae6ad97d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
ab26cb367babac79a2358bcbfa4cd3d1

SHA1
1516a09132b4ba077249d17a9d108f6a6414a5fc

SHA256
0a6edb1facc916f0bf49163973fd263a6265ff6fc3d61ba9b2f05ca7bd04f8a2

SHA512
7d93b71be0e53cdc5f29c4a6cb41f6ab3108e0527046663279b472edbfc05101f45eb80b9c65bda579a75c34a9a2008937a32a271d462092e39bba88de5a8c81

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
181863d0c28be014e32c9143be3936ad

SHA1
b9b12707c10554ef21154b394043e68da4bf4899

SHA256
52b1691384d7bdf15feb37ee5baf8a21aae764149c255b46f707bbf63b906950

SHA512
255a9c8c309139c453a3cf7d670f9b13b21f853f8144904c94b1fd9d23d31bbf50c3ebdb1d5398c180ee29eaec8215bbb799a5929f534a653f6758e9ed415b24

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
84ddedc44003e48c2609ee237b2f00f4

SHA1
6f818038b19068a2cfd138878ef4d862c3353821

SHA256
e4b6a5385c572d20c09bacdfc8282f596049b6fcfe55dcc6e9af6bdfc214c623

SHA512
72513cdaf6c6a58323a2e888db0f984a8925f9fde1f141c0013ccfdad675b536e55d3bc9b8c901acd9f06a7afbb7029af372ec1cbec69a7762974f34c5b97e9b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
35b47e3ada60863e51dd6446034501d5

SHA1
ec0ebadc7fd64a69a1d353731f9496a6339e6e5a

SHA256
daf5109f99fa0f8e98e12caf7d27037320fc120382accf5d3b4a93134acc0cbb

SHA512
72454f1453b74f84d8e9a89ece26be5b256b87523924c10127af4c17e69971d52179c074660b0da7076438a3451e39989e8d3e392ae7b8281e15da7981869e00

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
2505094bfa9c91cd5d0585e61ad1c7aa

SHA1
2627964a78db5722f800d8a4ca6bf67960da1f8a

SHA256
1cfdf84fc416ca1fc051c62a48df3e54dfc1bcc1e41b424025eadfef6cefe28e

SHA512
010a760050341e6fc7e7fa4d6d67c795726930664a4663b4967701f9ccd304cf384cfd34b4b45c43163597a96ecf3b7bf4e1592ed77d13f95cbfab285a3e71dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
16f49d8ede5dd812660e27249384a113

SHA1
c06d9a9e8b43cacc91268fda10c9231292a4737c

SHA256
490cab4893ca5e75efe20f6b77ad7689a6adc48e55c6aac16931ec3f6f6f568c

SHA512
c12c398e71db454dfaf43163a47df82a01b702e7a95fb9739713ffac00943f4cd27d25509648554281d1ac46f6add1d4ab43c83ae3e02e8506142acd799c0476

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
9301d80020a2c1ab4c04db0403787ba4

SHA1
f7d35aca4d87db2e3f95a981888a7f02b3bb219c

SHA256
a9a28d7ff88fc49f16e314609c2b8e937994d60d6632b8f12d4f184aba297fde

SHA512
5a1c4db6826ad7d31adf3453b34bdde37cbab6a123929ccdf4eea74eb76a236428ad38d93d4967e551bf3af14787d3e0cac2852f50e74994a1a917ac55ffc54a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
246d69e01cb77c9a7ae3437fa84a1d2b

SHA1
9eb10b9722f42339bce8ca8c3e6c9719c3b069d6

SHA256
c3d274b247de1e44c5e346398bddee19e8ce9469d681fc714db8b2e5378d4326

SHA512
75d00bfe84473ce27476688ba3848f930f639c98535af32c8e686ac78b662b16de26b7befc000d21d61f30e58c03c0a1940438a7074f12c6005d18b472cc5332

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
dc92660c3339933ebe7a143388ec54e0

SHA1
427c92dcb648a7504bf4670c9508d0719bfb60d5

SHA256
72611d457f28be83fa97147213cc057ca573459ec64d50f039b77321bd983780

SHA512
82ef57875f3cce66aefdc29dd5b86659c17c63de5736a956c003997c78b6b4fc7fadc087acc26d43dd1a7c4b604acc07de3bd871755d0df07eca26e6bb4a6009

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
476ec1abee9625e31f4aaff98e4a2ba3

SHA1
e1e1251feca8186f5a7f21c670891d08a5d92ad7

SHA256
cb21583143839ed786356638bc4707bf7f01e798e8281ebb1a9cdc6c22a8eae0

SHA512
1dea4a028c02258d9acd0428340670a7dbeea5f9b8315a348c8f94e16039b3987825f33865269fd34edb0d3292d1ed7a5abad323c15e7e64c777844fc351d8a9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
26a2f64bf1da4869406d4cc4d3f6de1f

SHA1
30d13ca9a6331c95e54dcbbd1a01d667470e1cfa

SHA256
1e6184e8a03f2ff79ed7db2fcdfb2b5c037bdbe8bcc37c5f0ec4cdb7654fe16a

SHA512
6f936463e1fe8a5626dc80ea217e3c6a9e2f1a95c3d1626e8109359f5186f266741f6f7cb3dce1f8190e7703921c2f791b3eedbd5bfdbc940f3de21d099a9c4e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
3e155b23c56155158e04eee48b451f62

SHA1
f873ad4f6a80340e23d0ad869c78b9b5a6f91fd7

SHA256
d7599822af408e37c0451373c04787d101c3d9ec009ff9a2376c1b3a62f71a01

SHA512
fdc3c3965d8b73e531fdc7ba78f77ffe6e7a3c9d313ee8752fd11e78ec6d65acbe88c7c7afefa6e776fd263e241a1d22ec2f40501a5761b0073ebeae3c317497

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
9db731cce3d7c8a1cdc6cea6c3d9ceec

SHA1
5fb9903ca876254a3cd4719d663079a14c83b404

SHA256
ab0d4d7f8a5dce11557092d04af1c58de3ab19dc6ef58f0cd585b0df9cdf241a

SHA512
086066f477ce3ede3068cb696b3e9943c35838b443360540df46199918703e42dffc5834ba258ea5e5cbf7a3402ee7d87803b503fd1314eab5a8616c5180a990

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
dc33745404f61b8e63c1495d5e4f105d

SHA1
a40491bfc3509de2da6a7d8613e703c8808cc48b

SHA256
af8c29bb6e9809a450170d76607ff6bef266464072e7c103c49ba8e05f5cb68c

SHA512
3b0523aac88d294c0b5a3640d43bc63d42152b2b82b5b0bbb501a6aa9556aa816228879341b1dc1cf3a6d18093e8888c91076b927d7aad27c60beb963cb2f969

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
1c9ee1f57b1e493825244315cddab61f

SHA1
134bb78f48594ad993efebc23e14e3656f72e3a8

SHA256
43b9bc2cc860b57334dac3b994fee43aca38aec7d902b3256efb9b444f4e41c0

SHA512
bc1fe31808d2b45624475827e5cb5c1cfc92782778402111c2aa2949c16fb92491275de6d8a66ee4da7a1b87e4400c267cc68247bb0cd54f3b47b54b644fe5d2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
11c1db8fabfec691506126128063bd8f

SHA1
54e7d5d9234d2bd203dda022a94d3c982c50ec60

SHA256
dd6a633e01653fc0a7056515b2db9e233b07d2aa10cf179c24a20267b92cf76b

SHA512
f87920d5cd4a6371877e74d1b817ea3f431728e4e95e208f96c4ce8f667d5da9bf0c825ca685ae1d12bd7654e266c71a1fcff83dda3da809b022ba4293fbd9e9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
39453ef5dd82f6d2e5d6fc0e4433433f

SHA1
38ed635eea699c59370f4c34eb6ffa2e86cb4ed6

SHA256
ee582ef56abdad439fe781a45d2ae02f4d3b08195181eba746dc851190e85003

SHA512
a85ed94e18c58c42d2a4b8f77cf1e55da71d96cedcb31dd03f006c502b0a0ad8c112ad27e27379f732ddc000c02a6d68006912513dba54b227c1d59a164e25d3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
1156b38788aa73b60593b54a686cffbf

SHA1
e33711691226e21d3f10cd00c80420fa0036a6c7

SHA256
49d44a560bf2636f6c6fdb0fcb5423f6fc3dfe5d7ba4183f0b9636e7a93d1586

SHA512
254453600772382cdefe0e30592c8c9ea42064bd59fb3224657caebcb8f1c9faacace7f5664cc1a544a8e4a08dc9da926a27cebd10ef9eb83b7102fac4ec35db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
2a7311bef1f35398897557d3f457dbc9

SHA1
739433b7474464e2789afab3ca148519a64dad47

SHA256
523affcdc401f959822a190561328e62a7166533c96d946b8e004da0fab7d630

SHA512
f44019115ccac3392ebc0cb3409506add0fdefea03866814f30f6c695fb3d399261debfc68192a57a448f58179f3c5c5afaae152d0f081a1f637037a70da35fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
b7105fe3d152f28d3359e58a2fd54171

SHA1
1f765f46c40bf38665b760c9806f0dce32cf93ae

SHA256
2a5f9a42c2cded8bade329e3e7892d885a3efda6a30b5ab0179a07571775ba05

SHA512
8c4fbcd220aad8bfbd1d7f6203d85130495f7468f4246645d713da4a675e313565b29a9540b0267031da998e9886690c76520d47b3ae62138faab00a72e027ed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
c9a1057c9b495f6209384083af936a8e

SHA1
aa069e51fff610daf2f9f84d34a1cb4716493f71

SHA256
44affc00affa0e3e9ffa36f5e647637557da51991e19f7b9ed7644f82835f771

SHA512
82a857aa004a4433cd26fe5a037c854b4a47446c597c6524f2c38acc7ae8d208ba4d6663940ec2008c779a123faaeb4a3c118214b292ee20272c195b8f3c140e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
5da4fb0a99b6147a4f2a647ad4a8723b

SHA1
ad363c76bbc4ef5c70cbc226d36c5e5bde1ce818

SHA256
b3f05f6092a3f1cf692f108426b4ce2cf87d8311ffc2d5783b8d0ba14e7620e6

SHA512
f603bba865953a94a2af20d1462f2f6d5bd6e312f1bdfea843de67500274e5b50505c5eab2fc0262b81b9c1a8e89b61967599fc2afbf904ada848d32005aa430

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
f10ac68b0713af6aecb798432d3185dc

SHA1
ef17cf137b2028c379ee366e8d8bd7ff79fe6a67

SHA256
ad81e7be0773b24fd8d1ddf58c1d52531db6b49597140bc9a308a325937555ae

SHA512
8ae29277e2c7f0d5e55cb7c1bf23de01340ba45adcd9bf6d5db55b975d901c6718a9c9ca6801d060f16e36d588e1d8298e28a895d644bed655e520299ff19c82

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
946900e769f05135619a773df5fabb75

SHA1
ebf7433a157187b7ea1c9e5d208143226b3a7f32

SHA256
351320d06d3af27ae99a54170593930af63657513cec0dbc0bfa343f51274dbc

SHA512
1f63d4682d4b252fe58322e4c3dee09bf22bafef2216646959552623d3c6d40a56461c506e4bdad49ff965af36d34149a28c6c5495ca985310ca1d4a6415b803

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
ea47980acbff36583183903534552158

SHA1
575aecd34eb0625baab30dbc29f8ccef3cb18a09

SHA256
39a2498cc8277455ac5bd6699835f2b7850a1327a9d0c50cfa65f9de407270d2

SHA512
10b6f3eeac961ef4daa3d9cc669463494a9a8429fc7652a5ccc15bd1e726270386d083a0ad6a677b2e351559adf815c2862d9f15b1c2dc971aeb5209ebd92caa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
63a1e94bef1c9f7fc8991f96e03b904c

SHA1
57da748ad09ee91a9b9acd60a519f2e542680989

SHA256
8d66b86977d563fc7709a2ea2cbb300238c6aaad70622a02477be53afe4a037f

SHA512
6920694ebb8ac74c6f2a1aaa1bbd10f0ed0b2d2c2cd10b6dc504018e764a2179604cccd12a443fd2f7ae020af1c6220055526921969fb4a5e9cf2f58c95b6f0d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
b91906b88b0c7c64ea47c03abf281258

SHA1
368bfdc3812ec2065da532ae816ea50a9acebf32

SHA256
7bcddfb44d9ca2811684634b06f183e8b2102110fb289f81734e373035818f4e

SHA512
726d99af71ab286b5167758ada1ccd8d4f9e24cbe3c4992b3a03ce7196a6244971e6fde766b84b37017e92dd3c94cdce049e5690dde6141346412bb12ef19c7d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
8c64aa39d46deed64de232d24ff38600

SHA1
b0d23a9159847a99845db498521a149fde5e5627

SHA256
0a416717b57804b6f0f34921ea1455cf4064f37e070bc2470dd04631151b55b7

SHA512
94d9df128f23e27190fd6f2a7be9516be0ed454461a0dfaf449b23425b85397868b22d3a8f23e7591b1398c251976a5a10b8e2fe09b3926c9e61f88ba40b8b02

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
bc8e6defbc789bdce70c76a28b7194d9

SHA1
15cd4585b3d43c8ac9d7fa2c0f29af523a07efe4

SHA256
f99083f6f7dd18c34bc3b6b97c8749e55de4da64a2327b8bc6b7ce86db85ff83

SHA512
11cb9b71839e5e3b847b63aab5d9a02144bd31732f691c4d4a8e0f80d68c0041c87ac809bad8cb6640115c2cfbb538672fb1078c15f6eeca856b977ad14860c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
e173dccdc21040c79ef90f7d0fdac82b

SHA1
54ce97a1597df336ee9aae2900ef9e48c9ddca45

SHA256
5f50ab08c60d731e682914f7206aa89ffcd426030ecc281e2bb43cbfb6fbb777

SHA512
5b23556a1001a9b17921fca1f627c96da1a072d04149fe6d33f7bd372fa5ad3e46c441afc25f875f054ef1f4a6075a0a503372429e13de773b7c1a9d235e938a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
4db8a3ba2852b6a152c4c37a1235ddec

SHA1
d32baf71d309a933155428ece4b270dabcba59b0

SHA256
5c9f56332d17303a7ed3e0114e8c4b526075be6809d2e287647c5dbf2e8fc7fa

SHA512
663d1dd60cba48a1a41bd7096719c139d0bf7e0bb7d431cf6d33dc6b2f073f3386db7e1866db7c918456dd39d5d4a434c7601b1e5b57abb4f7318c240f3e295c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
5d24752abf81fbaf26501ada700d3995

SHA1
8aa5cc633f20e97581380b18eb06ce13edef68d4

SHA256
7d5f3212face35cd5b95db0ee9136d66ee715e495691de992ab143e589b80896

SHA512
e038fcc0cd0eed70d9b26fa372a3174cef4ae05f29f1fc0aa3dd358d5ed737443adea7ab3b641154e5b314d77cbf2614649971a5a35fb5f28e1792474001436b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
abc85a50f1fd66681555b214bd5120ae

SHA1
3f64eef2a1386137fcbc21f281c63e0b8849a05d

SHA256
565f29a3d830fbeb604c03963c2d334ec33a5b877fdbe2c202d24a9f541eafae

SHA512
6f760430f6ef780709082be8785ad710b1982e007f5ebbd59f87dd4b82704ce8907f40e66346afa3a4a5bfe3cec64b9624a8b917dc151f85cc3e5aac3e54ba51

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
96899674c5c75184c09886b11365d194

SHA1
f0e0a61deda257e556cc05bcba17e238e802ee06

SHA256
2e4a0b528ae223bec0c445dcd186d30783595bb75170a393a61b03b73b860fe8

SHA512
0bbbee596a375bda38be078ea63a1be3e8697ab0f1675c66fa5bb0ef95593492658f31fdc819c54668113046a118a72c91528d9401232bc1d35fa39be448dabf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
9fb30195d6baa480c32a940edcec339f

SHA1
b0994ecf70ce4621b0179923b2b9c9e0e741b206

SHA256
916c56cfd288f72b2379c6cf62ba249fbf8fd79dd9f9117006e62ecb56169702

SHA512
e44bda25e10e2281379f088388a1d7e95ba67bdb0304a686a6e62186a54aad0d86c9d0beed5fbffefa122fc7c4d69961f41d9d2f51fc2c59323ddc53b8f992b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
a2b5d636a014c9a0a84258f0ccf98f46

SHA1
14277de2722b1cdb2b62091fea0f4a81bdfff710

SHA256
f3ac26dc19410e95e6cef93a6afd7985a8af11b07c23c01c83cb746a6822289f

SHA512
48c47ece3edfade5f1516b64e40c3f1edadba51ee52f0ceaf070e81c4df2d176ea206281e92ed69303371510b16929e8d914780c900ce015e123f8730a261215

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
832842f0444f27c05f15789de8d0fe9f

SHA1
1649262a4ec2a319012ed5fc0eb15dde1ec88369

SHA256
dee216b0c0534aff117280e3cbb76356239da0c3546deae2ba02ecdc1f37db3b

SHA512
c1d8ad1942d09b1ac708a34558c6a97292ed0d5a0f93bc35dd142c3aeb241d7c1f04b9cbbf2ae5a3a3891e1e9cd0411dfbf78c840abdd281183605d3db2e0d33

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
5218c5259f89c6e57e8f40ddb91fc737

SHA1
dff0cb2a6d17baac2f64469d25b9c8f0783b1964

SHA256
cc4250ea237ddba3102325116873131e2baed30643c070fe9aa12d9d5c65f42e

SHA512
2ee879685b9777240c475f2c7919252f663aa99c6ae7681361158083da4dad144905a65bc8c4f672d39e6c1c685b0bd4d9e56b629607d9f301cba62c4518e4ef

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
55aa628a07550ac99de252ab78306f61

SHA1
1fef9dc3f77821bf750bce42ffb1f6c892f74572

SHA256
839eb695666f96062e1ded9d6f1c97056f6fb6dd78d8f265e437c48e9d0675ca

SHA512
2e1e0fc7de510c92aefa23840cfe5e5e14fb98e597aa626cbb2f3034294d54d6cdde51dc0bf5a76dc3d40da70a5ac3f774f0db9e450c17d1b416607795643715

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
d5a632a41d602a4eef588ebeec89aa12

SHA1
34df371469031d9087f2468a9ce0e88308eaeb86

SHA256
ab3ac6b6cc56ebc63e65dfaa1363bccd598608bb0fabf5549470a205ffb2c937

SHA512
7c3e2e68c1a08df580f1e261ac111265f40e28be3132b23802ad563770c13468577a1f16fa2accd04b0c6b1bb29b49322d4112bc2453a2ff75291537256edf25

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
4e1670acb3a2b78b210a839ba54a7107

SHA1
c314081ebdba5e9b4f34903e139d8e677d18192e

SHA256
304f123c7a70e8965f62addd8ba5acc5bf2c9fa0ec2400e218cfeded28ccb2a6

SHA512
fa391e26ce105668307eef1e9eab540ed82d3f0dbe85bda1fef50f2d0788e5547651e29d5bf0fd44045695211638f335ca1588e8c703df8ff370abe76af355ff

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
218e3267e227b6bf183d122aec8f78f6

SHA1
4db1510aa06eb8c0a8547ec0d0b13fb2177303f0

SHA256
9bfb36c85186342903fe7b458cb6e28db1402ec8ec6da30db4098575da7e0007

SHA512
1cff54e7380010fb85932b4911b5633d15282f21c830ab70e12ec83b15fe36f8f6f051d9f671973fe14375dc771948216c2127a3daa4a64c6913fc230fecfb77

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
bdf7f015bc99980e0848d4374b6b1afc

SHA1
550924804be4e77041db599216a570dd82735796

SHA256
156cc06ac9a324896c98f8f3e71f86a6203128b8634f20a00dca9ec47304d1b7

SHA512
ad875f6252bdde6c9f9764f1444af074fcb0ce96f270def4f6d337e6a4bdb3837a85f595eb4dbd82a761cbc8a76be59d1499cc89688a9166c69e6e53ad6f0d1a

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
e84954bc75eae1dfa4fc8604dde17d23

SHA1
2db0a0cd0933ad0f49af4c614b28317d7b4ee3dd

SHA256
5d5cf3705a5425f9338e1d026827a1270a4d85413f54c1fda312db0dc4145fa3

SHA512
214b118670d67dcf2886e73409fecda1c6614365b6e9a05ae9caee9a5dcb655702e8750731cd65b47e35723e89a26317ab0add0df23485191e07807cbe3ee7dd

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
a18fa877bc346c2d6a5a0ebecaf582a8

SHA1
a62cc7d2ccf7cc483f6afadcdf7c8018b7c8631e

SHA256
f247084f30876e748a59bc72ae577ff3429e89ce3fd9f9ed8ccea05f278a916e

SHA512
79ad00d1e81de217dc922eac792c7f5764b600883a493822572b8ff86efb3d7fa9906dbc1094911f70c40b390c3209468c95060d99c632836bbbeac0721f0491

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
1bc0708738f800231c2f2fb48b3b9509

SHA1
0b59fff429f22e8cf7f885b327e48041281b20d7

SHA256
78b881ba9e3b61685fe049e795f829792e9debb549c3ece91a2d1296f9fd71e9

SHA512
a727108ce70a2cb117ffad9815a14a5ab0aaba637ab7cc1969c8d20abc721710fe1948ebf2c6d594a706436fbf58e933702b40a1f26c2c34fb3a94b9b24efdea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
a020bb28bd35fb03f367946b4faef444

SHA1
d28c059f65960f8a812f08906bb1b75662317004

SHA256
6e657a8dcb8338a48860a04a7bac4f5fda6f4cb67fc7765032bbf394d40c95ff

SHA512
8f1865a86250c2de1dd6959e61d23fc5904167d97648aca558d755ed93f13124b5a05c2679382106bf986452e3c78704540b511a37985b6cc0d5973c022be5f2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
1460db39e48809697d3ba5e675e44aaa

SHA1
3a6a7954c5bee8ec192cac49da32daa20b68ee40

SHA256
b5bf8bd3be1ec2ec951a05dcd0a3b830365aa6adaee9a1bef4c4636b996b7ea0

SHA512
8dfe019557ceceae9a35175ffb38152857c532c15617ba1203f379356d2e8e43918f64cfdd575c7abbab242851b755a28d22deab04631393dbbbfeb90f9b7b8b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
7c9bf5da1c349c270c334f553e9f59dc

SHA1
470555da3fc3b416035a9ea6e76309cffe700603

SHA256
5e8b1ace18acc03e54ce8d7950c1063ea0cd962d8a879cd69b16a0b49880d800

SHA512
4590553d7cb465f7a6b0151ba8c073aaf99b63d3e311a5be5987c682bddd58a6f253149c0f5943dd78a282bafae429b3b3247052c3fa7ff0f0d0158df4aeb187

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
36a3f40b0a1dd2196f4acf3deab70a24

SHA1
afcf55ce3ebe2ef39efa816bce8bb2b7b4ac7ff2

SHA256
54f57a6d0b84f50b0985689a39aa5957d05b95024fbd052ded5985d4d3de8ca7

SHA512
e78e7108673257c829bb92896cdde4c5ce1dd34543c725cae3009c794078023e0f8eda84ae6d6265af5304b012b5b820febeefd4dd81800ecf8862f11820f644

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
86e6c0fe465279f0aed32810180900f0

SHA1
701b620cfe8fe50b41901b2bac427c4fa2780816

SHA256
7f6edeee0bf26373516d03c513dc5d474cb0609f70d375a431b9bc43659f1993

SHA512
0d43ca0f4eaed9a122f31147f48be2ff5012751725f699e5a05d45e8389ed8bd387a9b6b1c38e263b93fa7d33da56c9d2b1620a998fb6e563fb4779d5cc8bcdd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
60a572ad1bde9f702c5e3c9335ab09e3

SHA1
5f7e8383a934762316d1d41888b3a7394c4dd085

SHA256
448e5d4a8adbf750840b3ac9858369583f0b4f3cdf0ba41a8fbdcd16ff3d97a9

SHA512
d8630e023068e0f277187f70fd1446cfd9244a5e49e3268b9037966411cb451b49e3cf9dafbe363456af1f9a604cc311ab2298736558315a589e8ada2c65f6f3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
e7c9c85f5f4d62c65c31acf49842320d

SHA1
4307d892d4255939a79ec70865e8d4230ea6e9d4

SHA256
8e12cd0290d025231f50646753ffbcb2a436691ca3ded8550cce1ee781e46cc2

SHA512
2086dee0ce633ac79bf4e8cf8fafb750f1f119f4f24635bd30475b3bb581ff5f84c28991d9da97edc1299c7cd186732f5a09ca757c148596115da0f9062dc85a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
773d07547f47e381629d2c3a41b6947d

SHA1
0f36939f18bb6c3b85dac66027e84ea9e6828a38

SHA256
38ed93714e8b54c12ad02210bf47a15a88d70c71c987d81a1c60d79aae4b65ae

SHA512
042552c3ac84c8c9bdd273a8f90d5f6d46f7e65df192f916fb049920f5bc0abbfe9309645ee2aa838e79283ce2fae6060282bd3ec88c880ca0263ac0af688087

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
7a8a32d97111cfa2b1d4c72cca943636

SHA1
bf825267627fe94aac445673277ad6d40f31fafc

SHA256
055348c654b7ad120831d2c53c0d260e28469f099b70c1e47d0465101cfe2833

SHA512
da5393c8e10808fa8f05140958493c063d20ab4058d38da83b841809b9673bf13bf03fb2aa06d131f89905a671300c6b82ba5641e4b99a45de70534947845f42

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
c18e42fd079450d9acef51832f19c807

SHA1
60f113a0600c0cfbf896db2ed982562337126e23

SHA256
2e3ab0f306cf390afbd4c29b7b173d24177b657efe9d1e10f129893b6eec22e8

SHA512
cb9a0bf0ca20c656f00b34a23a01afee12fc8078586d20f6a0dc78c39182155f821a917a14ef9756882c79ec27c86801612aa04a7ea0d7bfd7afd9d26daa14b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
efb0ea957deac176d69a9b308b74b4e6

SHA1
3d777c666f8a5b0d9935cc4eea7e55400325e035

SHA256
2e93095604d6b1231d0a5246af2e9703ab604e85b6ff22a8ab16fb85a72fc8f0

SHA512
5a1f26641e911a17d3e4e350399e5a026be73bf03ce6bcd38ca24f25652008a2acccffbde3d5e5e0291a56482e20fb2c95dd62ba3ef7b5d36b1b433433aebe69

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
180076facef7816ce6473b3060f825a7

SHA1
ea1d8fb79e96c42a6251b1435fc746546bc50a13

SHA256
56336b8c7c5624c4ff6807ef754431749a8e49dc506247516c92294b8b6009d4

SHA512
4805edbebc66d89bc521560ce2c2dbf88023b608a5274bf7b05a87b20e0c3d76e150cbbd3bedfaf166089f64b42a27a65e85c628b05d2081e1de7f015ec6b099

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
cc36c0eb353da99d7bd74e50d6936c28

SHA1
ff3ca9160b56915fb42cb1a38a368126715e9e72

SHA256
217347c58c413ce4be41efa7be1e68bcc94ad12b608ee44b3dafc25a6ecd455e

SHA512
6964926a8512d3d0d4cd633eeb6f784d5a7ed544699ff331b6e7f80eae3b8e26875fc72a89c71b7fb1428169f913e20488ee2c74a50c09cd0157c41f731cc031

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
a004b0668d0ebface583523e6d7ad241

SHA1
f3e1fbf9e6dca294aefac7d9e34b53966f2681cb

SHA256
662e096be08b8e82e8aa39e6deb7b95e1d52d213ca5879178da2226a74c5b284

SHA512
3569a24f2b3a55bc1f68ef80172a007c9f6ec4d2d51c9bdaa6b9e1e015b7145c56a643611c8b4939ba4f50d6d1a6dfc72d704e70c4576be489244f5a05abaaed

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
803d54daa282f21be1152996aee9a2cd

SHA1
ca4fe19b5632d669f3fca3eca7335c94f66c2bf4

SHA256
17b0a4a0f1657872cbe1a3118c2d62f52849631b45dae43be4b9f692f58db8d7

SHA512
6aa406e34766a8e9ee635179906b55a3583b6ab81a44f777f64aeb5b3566189f443cab6d8ad62ae16cae96b52be62354f43bbba421b62314f636bfacd436d1b4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
2dfa1c99a049073a4c9505bd935effa2

SHA1
b0741e17de03f1764d7f2f32aad41d19484f834d

SHA256
8a84304686f35c24ec6b46b4a8ca16ce003dc2f38a13f75c0660571ec0ce1cec

SHA512
d7491bc882643a5fe7dd6359599a2505ee53240c600dcb8f24cfe9dba14f87f6dea3842c9cebf7e07b2675bb6e12b7d24d5e56aca84c372341f79b729189ec5e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
a26905f1803d640b46f11df11bdce796

SHA1
8738620276cde66a037c41d0d87b7052c30e87ea

SHA256
6068f4efa77101ee6104cd6ab52b457989502d304fd39e01a20d0dfacacb24bb

SHA512
c38d3a3f0f104b061aa9935fcf4540a47301574a8a54d71b5479108943d1f9124e44a6096b5c4964aea46b165418dd4369f8d930d4ed8a19261da965543a0419

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
d4795c5698ad24feda0e59f83d580b23

SHA1
221a6ceb847d7f70b14065eebf1e510f62bda8c2

SHA256
6bb30eb5f649f46f86dc29c1b4b55243ff4fecf5920dc804bc0f77759136da2f

SHA512
cc7a6619e2c0d603467f32bc94845fe5276d60b700698098e3e65cbc42a7dc13054cb9b3e144dec35519ce1031f7b7eecb341b73ea1f3b4afe349eca120abfad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
67fb765610c8abf76888e7495ab06336

SHA1
a5a84df7407f11cd843f1c4dbf6454d9be957c95

SHA256
8422b56e579f6e042c2797ecde2f90a309b1b9bdb7d6a28d68c17b9a12c03cb3

SHA512
c73db2c48f17a5634cbfee81e879138675dcfb7ab23fe6e8ed7535126dea2decc7a8707938419c8e0a970525046ae92a633534359a1c8a578e19fb2469c14c46

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
09541b880b28fcdbe91fa78b2e26e0db

SHA1
c0ae4c3b10b65556b8760faa68f8e149cb63933a

SHA256
a859f10c6975880b2dd4830513bc1084b4eca069a9a8ff489453b703973d5d7e

SHA512
7903a75c2604c00cd2de9df38d74039272076c6939fc241326b52d4904555820d58eca5d22a253488e01e395f1a36c38edc739c41429bcc8f04f85951983c12a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
cbf19257d583410b336eeb203273acda

SHA1
0118e2952b901132bc9b9c1211f628c9a0ff6adb

SHA256
13ee275b05640d6db78114d6634028b7b4b2bb573f45c304d8e96d537c87b17b

SHA512
01a3c5b838aeef1f38546487202e2b6cd2a03c845ecbfb8e3bc29f3c983a5f3f33396338e1d809ff96315ed87c452bcb68045e32d69ba27a504715ea59831d93

Download Submit
memory/2824-4153-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-3932-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-1819-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-0-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-4312-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-4313-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-4314-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-4315-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-4316-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download
memory/2824-4318-0x0000000000400000-0x0000000000A50000-memory.dmp

Filesize
6.3MB

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads