3c5a98c0fcc2190a98ffa71a79f1f1ca8a9b369279e1be873a49ad9be099e47e

Analysis

max time kernel
122s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
10/06/2024, 21:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Size 12KB
Sample240610-z6yees1amd
SHA256 3c5a98c0fcc2190a98ffa71a79f1f1ca8a9b369279e1be873a49ad9be099e47e
MD5 1d32109a8ae5c0edf2f6ffa3a0966ac3
SHA1 6e534dc2c2d6894db95d796b958d6f6d49f9ce41
SHA512 23fb7c4184ca13c1f8797fd42049b172acf0df322d644d7819760def15e6d1a03363ef0a331ae900bc1eb5ce905fed04c99cef7d64798196f1522a3d8d86c0c7
SSDEEP 192:kl7Ykg2oboH9U3u01L+K9n0CxiYMKFIvkkoVaiXV4nQ8aUA:9klibkSVPJykDay4n1aB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\CRYPTOLOCKER.txt

Ransom Note

** Your files have been locked and encrypted by CryptoLocker with a RSA-2048 key. ANY attempt to remove OR damage this software will result in deletion of the private key by the server - meaning your files will be irrevocably broken. ** To decrypt your files: 1. Download and install the MultiBit application (https://multibit.org). This will give you your own Bitcoin-wallet address, you can find it under the 'Request' tab. 2. Buy 1 BTC (Bitcoin) and send them to your own Bitcoin-wallet address. Find out where to buy Bitcoin in your country at http://howtobuybitcoins.info 3. The Bitcoins will show up in the MultiBit app you installed earlier. Send the remaining Bitcoins to our wallet address: 1Q749eQAoHvJddpybgpNvz5sh1YPTQpdMr Now press 'OK' below and enter YOUR Bitcoin-wallet address, then submit it for verification. BEWARE - this is NOT a virus. The ONLY way to get your files back is to send the Bitcoin within 10 days, after this period the private key is deleted automatically.

Wallets

1Q749eQAoHvJddpybgpNvz5sh1YPTQpdMr

URLs

https://multibit.org
http://howtobuybitcoins.info

Signatures

Renames multiple (2023) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\drivers\en-US\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\drivers\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2660-0-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2660-8409-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2660-8641-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2660-8642-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2660-8643-0x0000000000400000-0x000000000040E000-memory.dmp	upx
behavioral1/memory/2660-8645-0x0000000000400000-0x000000000040E000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\winserveupd = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cAjU6jR764347wM.exe"	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\prnod002.inf_amd64_neutral_a10c656b6c7c053c\Amd64\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sbp2.inf_amd64_neutral_332943647e950ada\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_WS-Management_Cmdlets.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Starter\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\synth3dvsc.inf_amd64_neutral_bccbc5fb46a05558\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\migration\es-ES\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_neutral_8b56291bfd2a4061\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasat.inf_amd64_neutral_bc1469ba40fe2114\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_neutral_ed16756f950857e8\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky006.inf_amd64_neutral_522043c34551b0c0\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\UltimateN\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hpsamd.inf_amd64_neutral_84ae149ecc9f8033\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\UltimateE\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\Amd64\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_jobs.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssessions.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ehstorpwddrv.inf_amd64_neutral_ecd233d7cabbdebf\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netathrx.inf_amd64_neutral_905772087ff288af\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termkbd.inf_amd64_neutral_e561157e16aa2357\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_scopes.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca003.inf_amd64_neutral_8e91d4aa9330d2f8\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\Professional\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Professional\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa.inf_amd64_neutral_560c956da9bcd8f5\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicN\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\Ultimate\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremiumN\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky006.inf_amd64_neutral_522043c34551b0c0\Amd64\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umpass.inf_amd64_neutral_e3be362bfab667d2\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterE\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalN\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_troubleshooting.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasic\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcmdm.inf_amd64_neutral_af49d2f3ffa12116\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\WCN\fr-FR\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\Amd64\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0804\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Automatic_Variables.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_jobs.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr00a.inf_amd64_neutral_aa4f0850ff03674e\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_neutral_1abbad2f29c8fa08\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_wildcards.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_arrays.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumN\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_execution_policies.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\spp\tokens\channels\OCUR\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Foreach.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_If.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usb.inf_amd64_neutral_269d7150439b3372\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\ProfessionalE\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\StarterE\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsMail.bmp	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremiumN\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_troubleshooting.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comment_Based_Help.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Microsoft Games\Solitaire\es-ES\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21427_.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Microsoft Games\Mahjong\fr-FR\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Windows Journal\en-US\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImagesMask256Colors.bmp	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-crescent.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\203x8subpicture.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\15x15dot.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over_BIDI.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\js\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01843_.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_OFF.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\VERSION.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\on_desktop\slideshow_glass_frame.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14882_.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_dot.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-full_partly-cloudy.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\SubsetList\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00673L.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR33F.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\31.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATERMAR\THMBNAIL.PNG	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0284916.JPG	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR9F.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\16to9Squareframe_Buttongraphic.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\logo.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\in_sidebar\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Java\jre7\lib\zi\SystemV\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\MDIParent.zip	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14532_.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21533_.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolIconImagesMask.bmp	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left_over.gif	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceSimplifiedZhengMa.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\ja-JP\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightYellow\TAB_ON.GIF	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-iscsi-adm.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_35d8ce9c03f1dd34\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_server-help-h1s.uap.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d0aae185d680036f\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..nt-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e44bb9a9ea37ea81\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\inf\SMSvcHost 3.0.0.0\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-commonlog.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c55cd6d925543760\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-syncui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8b61db9bec792d86\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\msil_system.data.oracleclient.resources_b77a5c561934e089_6.1.7600.16385_ja-jp_165de34630f512d3\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-sort.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3c8f522739eba051\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..tivexcore.resources_31bf3856ad364e35_6.1.7601.17514_es-es_759477e0e4e75e36\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_adpu320.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6a10fd3e6b22fc1e\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-deskmon.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_14203ba108d8b770\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..p-provsvc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5c196db8fdbb2321\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_wiabr002.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f73e70c0e54287fb\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_es-es_932b83ab7f6e52ff\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..japanese-propertyui_31bf3856ad364e35_6.1.7600.16385_none_eeb6127e83dcc0aa\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\settings_corner_bottom_right.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mydocs.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2598bc163582d454\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-driverquery.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9f6b6db5169aeca7\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.Services\2f157d250a738f7a6074e0f29b298998\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_fi-fi_442e570e6aa0d70c\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\default.help.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mountvol.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0ff39d1bf099aa5f\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-onlineidcpl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b0b9e5b0eda9fa3b\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_e429287568bba98b\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\502.htm	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmi-ping-provider_31bf3856ad364e35_6.1.7600.16385_none_a77af0ebe7f8a1cb\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cryptext-dll_31bf3856ad364e35_6.1.7600.16385_none_ff6918de770cb659\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bff21f675e6e5524\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..dthemes-calligraphy_31bf3856ad364e35_6.1.7600.16385_none_c1407bc73caf8dfc\Windows Error.wav	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_es-es_6bb9b334fc977631\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\Resources\Themes\Aero\es-ES\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dsquery.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e1d445643f502f1b\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..controllerextension_31bf3856ad364e35_6.1.7600.16385_none_483a81802f69e278\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-atl.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_29bfd144da03046b\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_zh-cn_1e451fe096b5e5df\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..migration.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d60900fa278f838a\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..cesframework-msctfp_31bf3856ad364e35_6.1.7600.16385_none_26d2511408a24b3e\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-secinit.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_07902ec96c9437d1\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..serverapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_203e010d26711f1c\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_en-us_29fa16f1e581f525\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_wcf-system.runtime.serialization_b03f5f7f11d50a3a_6.1.7601.17514_none_db9d037fdd581ac1\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\ja-JP\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\requiredBang.gif	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_netfx-fw_netfxperf_dll_31bf3856ad364e35_6.2.7601.17514_none_bae87b3630a3f232\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_prnbr004.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b7fe1907aa51f6b2\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-h..p-listsvc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_8f54bc532eadc7ab\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\Media\Festival\Windows Feed Discovered.wav	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e74ded66652fb660\403-6.htm	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msasn1_31bf3856ad364e35_6.1.7601.17514_none_25801b39bc00ed6c\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..reensaver.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f976ce14b4222f68\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_prnrc00b.inf_31bf3856ad364e35_6.1.7600.16385_none_3a88c62811ffe8cd\Amd64\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..-temptable-provider_31bf3856ad364e35_6.1.7600.16385_none_1dd3ce8d1e7524cd\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..-binaries.resources_31bf3856ad364e35_6.1.7601.17514_ru-ru_a052f71d1700ee7c\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..ewmdrmcompatibility_31bf3856ad364e35_6.1.7600.16385_none_ace88c2f87e6eb61\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wlanpref.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f4a2440848c3d8bf\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_mdmbug3.inf_31bf3856ad364e35_6.1.7600.16385_none_fb6430b94dd81b21\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_6a1946701e0df451\month.png	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lsa-msprivs_31bf3856ad364e35_6.1.7600.16385_none_680de2b99516e12e\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..duled-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b6984cb6532681ab\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-g..oftwareinstallation_31bf3856ad364e35_6.1.7600.16385_none_e818845daa1b69db\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_63045bcb00602fc0\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Net.Http\c2a702d703816f85cc229d96cb1b0c5f\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\inf\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..nager-efi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6777afadccc8e29b\CRYPTOLOCKER.txt	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cAjU6jR764347wM.exe,0"	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM\shell	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM\shell\open	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CRYPTOLOCKER\ = "MFHWTCJKTUNINAM"	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM\ = "CRYPTOLOCKER"	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM\DefaultIcon	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM\shell\open\command	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\MFHWTCJKTUNINAM\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cAjU6jR764347wM.exe"	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CRYPTOLOCKER	VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_1d32109a8ae5c0edf2f6ffa3a0966ac3.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CRYPTOLOCKER.txt

Path C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\CRYPTOLOCKER.txt
Size 1015B
SHA256 f4a7bd29d70ea1bbef39008aff665ef95749a79b324f285d5a70045d055fd3c8
MD5 2ee6612402605ab4d520188ad02801e8
SHA1 a186780a7697d3b7a49ed42ec56d82fbdd483d75
SHA512 9047ba28cae15f66364874589e3ed681c7c5f352745cb2921391eee262bcb6a7e1699465930bc24572d5ba4f3f93c1b4db8854446d78ad050b4f8489d4051a12
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
Size 341B
SHA256 d4ba06eebaed23831fdb8cbd0898dc5a45c9c1f7a101d7ab39cdfb0b23fbda63
MD5 495cb3f8d71be39df382a2f12569d8cd
SHA1 d0da2f62919ffbc9171b5106ebdbc999831cb898
SHA512 87ea99630b42f973c7f91a7ea5de1fa8e9943402452571b48e22a6ba3efd6f8dabe9f9150ca7779b98787a3ded0f3bec6a15c214d91dc2f12a9822d7aaa0bfd2
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
Size 222B
SHA256 febe50dd0513029ba19926fd0527ecb161507bc13db7f6871fe25c69450d2deb
MD5 85f62d334145a06a7afbf6662c997ac4
SHA1 5b1e3b1bf427557d95437fa303a169433258c3dd
SHA512 2451d0347081ca13aa1abda0a03442516fb528a17909215ff4f173781ed71a944caff4c956607d3136df82d0d93fc543d2af93ce03a7260b7a3a41cddf75939b
MD5 SHA1 SHA512

Submit Download

BG_ADOBE.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF
Size 24KB
SHA256 657ad1e05032ca369faca914aff36e364ac23d7ab523165e8fca2b8f5bb70fc4
MD5 3a93cf92773e555127d3c14702f756f3
SHA1 9614dcdde1f3a2b0fbf230024931c7757d745fb4
SHA512 d777d4a1fe1f6ef6d2085380a4c450cc0ce48f40978244ecfd9ad7bb1f05089d9f9abbc02f0607ce372becf2dfcf8b7a076d7b7ee2c54fa72c30bbd34f3e6cf0
SSDEEP 384:qm+Ko7pigZSWpVP8CfKvAe3lpDnz0z8Du/QK0lugeWX8fDq3GJz2tBa9eVS7s0uc:qm+KNhs8oA1DzAIK04geY6z2tc7oAL
MD5 SHA1 SHA512 SSDEEP

Submit Download

BUTTON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
Size 185B
SHA256 47665373a65e32c1b161b1c57acb930b4de2f8bedabdd7d551478c97b1c363a9
MD5 cdca7f772d4f65689460aaca54f344de
SHA1 c8538393a2e4939b08050dc8c365322d27f38887
SHA512 e56cf8d895eb3b6abc6ba9188768f9be1d8b924be412096e537d9c45f01085e5590391c46e0502e659fcb45ae7c6c3372c7f25c54075b6c01fddecab66366f2c
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
Size 496B
SHA256 dac243b6ee61b99de0ce271f8e0d7bc344f0441c6dd679c2b04aafdf8a0d02af
MD5 57156b2183f209b6d02bdc788fc4b69e
SHA1 396c6345e83e4e27fdcd457e4662ccc01bd7bd14
SHA512 2985ab9fbd27cc8c3a8bf9fc414c5fd173893eb88c2dca9c2b185fa6a08645c02689db33afe0ca998d68a171c6852f1d737505ca212533bdfc9740d993b8d481
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
Size 1KB
SHA256 19437b66c94f415cbac98c0736c27f4f30032bfa72dc0842bbccdf586347183d
MD5 2f3b08f53c94aa8f04811570648d563d
SHA1 6a9cf6c958618a506593185589681a0d91f583a5
SHA512 9346cb06e9528e5c042e41dbd027de6cb91c9262ce002cd60110b6f5f05eb15b8f837b6bb4972363fb8d2a92d45d74c4ddd692b310bb2c304f165ca9dfce716e
MD5 SHA1 SHA512

Submit Download

tab_off.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif
Size 341B
SHA256 d6407c32e5e0503b88813fa0f3331f2ac249c6b901ccbb52e663d10a0cab08f1
MD5 366457d8181e6a87baaf998dff4106df
SHA1 ffd60927dda19e9c49c0f083226db34528cfbe1f
SHA512 bb232b8e6c3cbba3238a307fc4b6e5acbd5297f76c8407bf785f96e12a8b122a8933614923e6f9d7ad2f7439fe81b78c55ea8199a2a813a19717d4465c546a98
MD5 SHA1 SHA512

Submit Download

tab_on.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif
Size 222B
SHA256 b1f130a06f9dde90dfa4afee09a11d793847594879babf42cea3289d96dcd56e
MD5 9110be745c26dbee4de67e478c29bd8a
SHA1 3e70851e645541126911f2bc62d55623791bb9e7
SHA512 a9c63f4b5f69a3884c74e2c96387504facd767b4016ca4d3ad7469828112cf72376f74f1e43ec1678ff01212c4ed2155203cd8f85ca6faee0578cbe7af7d59b8
MD5 SHA1 SHA512

Submit Download

bg_Casual.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Size 5KB
SHA256 850281126f179417f120e4dcffbe967662d59856ea0e84e37a667e1dee846a13
MD5 fb318786d3e78f1ca9076d2a7e2f8122
SHA1 32e26d0f0f51d779d05476946c4ab2f752a8c751
SHA512 9765bd13e47ac2c21b4d8065b6d8c62d6739103e3fc29aa52c55a206f3a58d8865a75425784f2aa12adfd3d3efd843bcea48cfbe6563b8a9a5be8f638364d547
SSDEEP 96:a+RL5wDCIy3BkDLWsH+6faAWEoVJhNC0FgTQuqM/TooFhTuNS/J7OhI1DJl:a6F+y3BkDLBjViNkNvhocJj7
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Country.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Size 31KB
SHA256 851797adb0458c285f56df4a962c5aabd5f4e62e95f94a7cb787456c5bbed64c
MD5 e2679094552cca08fa424ea45600ade7
SHA1 8802205e7ccd9fc08f5e378bb6d633400047b1f0
SHA512 beac64cc5c4ab986c66c46d4edc37a62bcf52ded9fe10b841c3d8316a9765effa582bc9c4f81caff0b115789cf131ceaa4c0c3068072264164b0b151dfaee109
SSDEEP 768:2GVclj9YEErMPCiSIK6HYSbePXKcNSAYlHI:2icl5YEEgP+SFePuJlHI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Earthy.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Size 4KB
SHA256 b3b526bd6e1f0451d547a2250bb8dfb6721ae03391726471e1c40d30c1691c26
MD5 93652a5895e8023dad390c613a13d942
SHA1 8b1cc065970fb36d339fb105a9216342d0602b68
SHA512 089b0105a06bf5696ee7be0b661749fc5b8c8d04d5e1ef8759bfe9d3b17e2e67f8d78451a2ceb30225ab24f9c58bb3b9b3d953584953a2509ffc9b75f6e24141
SSDEEP 96:a/djORcpa8kC3e5taywrJS/jVYyZ9rn+bOJaX+vbgDYVv2JJT:a/Fl18tBwrmV/JaOxRqJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_GreenTea.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Size 21KB
SHA256 dfe4e358cd0c805ca88329da0ef0d9569f631842c647e783721338d19258c5b7
MD5 dda39ef647fbecabf2cd81fe3ba5cf93
SHA1 eff53515dd821bacca7efd4c9dd0232e3dbf3884
SHA512 cddf97a723ac2b84567d7553233f40178a3f06e9031bda158545b84e151433592689908eeb1df9bae7960705fd669345999817d96cd61702c6da6cd1ccca8807
SSDEEP 384:1SDKu7I/xtcPu4IresXIzb2wieDm+TyWeKG5IEVah0dHTDkUESnx4d:6K6KAGasX+K0m+TyrKG5z9dHTZI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_LightSpirit.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Size 8KB
SHA256 008116fde703e2e96e9dc7df9822959e63a770e76586e07673f75690fd71ec7f
MD5 496eec8b2f60f4bde3307ed57a66de77
SHA1 44b6db330db31bda0d310839254c3b62d999de70
SHA512 9290ae598e2d5f2178ddf1ca56b7315a40c699da6a7faad3b42d8882e14a19197a59943edb37cd39df5f824d223da9a3ca2b9c5c355068532d4fffb07134e9f6
SSDEEP 192:hIGuw4IJLkBGreJuW4aIAVGdMQpIEib+TGCLVEehQFeg3GshhxuMDn:hIGuw/htrSuW4HAVG0EzaXsYG2jBDn
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_OliveGreen.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Size 15KB
SHA256 696ba95e745627a935347712c5dfef7c85b91ee36752d48a5cd858b67d0bf7fb
MD5 0389b5b37c6ffa23c333662a4173389d
SHA1 69461bbaf97a7ac5c7a5659271424aecb4e60fbf
SHA512 4b662bed39cb641735889c0268722dec2135a17b225d140d35038b491eb906764b2241406d8e5f0376bff5691cd0554fe881d2917317fe5ef6acd9c70608140c
SSDEEP 384:WAXvcv1xBWu1FAoDU+eJKLkcVHlthrHbcRyxh+u3V7NyAdE:W5C+LLkcVHgw+u3V7q
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Premium.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Size 6KB
SHA256 2ce119ea721f3531c71c5da464c5c331dadfcac408a0ad97d9dccd8afd8ae215
MD5 132565135f41eeeec03f8517bea6852d
SHA1 74e5eaa856c70231d0f0790f8379acf8bcfcb802
SHA512 8d50a2a856bcfa1eb2e1834ba4925b60af9bdd7c94d9481d3bbd7fe5d8a54bb9e7154c53004c6672241113a2819b2a05f167ff1354a7e40a4f018d53e5023f46
SSDEEP 96:wuDq3o6yfqZMUkYluEUi74A8FzcV0Ac7UsqGFNq2CffKrRsHmojpWCvQn2RKpaBv:ObMUkREKFwXiUs5+5GzVn2kaBh/p
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_SlateBlue.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Size 20KB
SHA256 9e703f4b51cc60a189622063510970c302232a575dc009c3a53431fa961ffbba
MD5 76155bd585d4a3a231895a571cdef60c
SHA1 965c3674675bd9f8324fca14dcb6cc1775bde7ab
SHA512 33f05ca0ac93e8c540fb0f87dacee2f6b4e565b714712aa8a84f4dfe4314366913dc69b26701de0c6821af87fff3044594a9469e7b399becf0bb9e04f48ea8f2
SSDEEP 384:mDzUTT/TGPJxvUc00AXHcr+nhF3gHV0Fs4uHiGXiyqk/qWHEAA3yNe:FT/TgJy5XmIhF3gHV0Fs4uHnSZkCWHQr
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_TexturedBlue.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Size 6KB
SHA256 ac614fe29faca68af3fef18c7b2c2482928717ace14772610f11b43adc35e8d9
MD5 658a11e6f27bdb275b69f0636c9e9644
SHA1 dc6748611477a745bdba1b81188768086e494307
SHA512 10edb2a452a358773039fddf67e2d076118b79ad661f653db1020a29b62556dcb38993bb9f490853e1ced7b4cecf2291fe0d358d053657f26bca688ef7e8634b
SSDEEP 192:G1C+mvAdKCukw0gXWYLzvK36r6pR6vAA5+b:lodtw0gXWT6rwR6ICW
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_VelvetRose.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Size 15KB
SHA256 c194e4f5505b9de99f6ef50680c2ed9caef3e3e7c72936367c86e934bc75616a
MD5 d48e5f27a6400b61abd8ac4d437d9f19
SHA1 350cf0ff8643a07b17eb908df78e66cd10d2a29d
SHA512 86f9e02a5e6fc9eb126d6599e4b8d6015a5c211988d0da95deb7359dd61161c90a92fe761ee572f3fbc1c51d9705416f5e077ab5590018ff6debb465736d070b
SSDEEP 384:QyYAvvR/gmNHUPoLiKEyEvE/lD4q8jK9eIpyXo8XRH:qAB/VUPuyY6G9py48R
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddToViewArrow.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Size 2KB
SHA256 e8aaee3f186a5fac491ceb9d321d9dbfe30fe8afe8b5097d3086a333a06293f9
MD5 6a18966125720d2bec4f8d1acf994b9e
SHA1 1593240429eb85a3d9598c4141f17d6a811caf19
SHA512 b1a84ddaf221784cfe1da871396674164544e1321a83920450ea44d350b4a7a3f3b4e5f88d1b33ef34250634ee80fbb105ef5c7c70b48ff9f6425ad8d2b4b7dc
MD5 SHA1 SHA512

Submit Download

AddToViewArrowMask.bmp

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Size 2KB
SHA256 d1fe00d4b399d2c0c7483bccfd4f3d3dddf7787c6c699ef4e7a1e7977a3ea5c3
MD5 a671b84b82863e36b87b54d9f0363d51
SHA1 2c742a1b116b0b591923d084f84e17578cf9b7b6
SHA512 7850159f5888d45a257a9d74506014b2dec34af884e4cf47813f94a752be9d26c69fd209d35c8b79faaebdfe41904cd6511b24b55f9f7c216b24890be6b884af
MD5 SHA1 SHA512

Submit Download

FormToolImages.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Size 6KB
SHA256 2275c8099991fbbceadbf6afdb72a0d42d4df76aea80dacfd4cc9b4ebd581ec8
MD5 32559ddfc56523aeda87393900860b5e
SHA1 6df45d64b75c6dcb30bed4bbbda91cf6e004e9d2
SHA512 d8da64adf22ac23b6b591bbfcb2910cfb66469468dc50007b8ab1c430aa35b3bebb602ee47ebb06b0b72c766fe7294cca8e64ba0a5394279c9a86147f898031b
SSDEEP 96:Yo0ewJtxbvWS8wmgbLO28Li40mGoZ9gjqiAtYBoO3wXgqs1h8PO+zXTaNJDgURhY:bkDbvAwmJK4dfkqiIYOHwd4GKY96XX
MD5 SHA1 SHA512 SSDEEP

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
Size 255B
SHA256 6f4a06196849d8ff6005ae0e2ee5a2a320ec321012eb6f61fea53f7267661326
MD5 b019508df3e535d2d08706941f936649
SHA1 716a437e797c2e5cc13b517f3a9ad18650d8d88d
SHA512 43e7edef4b7430b26b7e3472fc2bcb1fc7471e4152cf8f98245ea7594cc279f79d522c15d8fd0e33faf7f16339f7888cb22ea3deeaa30504ed73600040cf03dc
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
Size 323B
SHA256 ac09df35ebdc6e70498207b6e3b8caf7348e4789124853803bdd23cd13e569b3
MD5 0995060baa1a3162ae161fee55c0db5c
SHA1 db7875e408ad952cfe1e9623cf28be3363c2aaad
SHA512 83278534f6eca4f2cff37c0953edad37acc71cbe81c98c02b4e3c69d4b2006a9f31bd99ed5ae2f451600bbdb55d77d1d729821d2250b8c57c47bb4efb4fecac5
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
Size 367B
SHA256 fb377b69d5221db3636cce16c67ca1c374866a1b4f8b3257043a992a53c7a402
MD5 1c5f3639d85a8e179c7be24d530bc23c
SHA1 0ae3e9d6c63cdda4735d9d03523beb17f578c2db
SHA512 9e797e891edb737c4cd07db86336aad8f6b887fd2460b5b6592f97b3d098777493c865c47dad805732731f33fa4735c3bb4f51e11ae5f0a78f3c8a0ad5252fcf
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
Size 148B
SHA256 58ae1b6bae0ee4391df0ede503103d41479a1882ed45a52d4752d0043bed251d
MD5 ebb93f42483a659d4150cf999a55bde2
SHA1 c13126cd0350dfa8e50588924f1957ff489a3e63
SHA512 0fab0a5c9b27528fc070a826b770a3bb2691890489c9c7b29ec323a10dffcf1b98500fe2e38891546866b7ab502e0b7564a69a57fe45767abb4c80dbe36d8485
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
Size 440B
SHA256 bc677b6f25e5a9a2375792d9d2dae403da9a59fb335d195c963c4546bd051497
MD5 ae817b4a9168c3c0b76508fc7ffb8497
SHA1 528d050e68e75e7edbe5d26a9ad40da1d3e4f10d
SHA512 224b3779b5235f638e49ad5ffd3e38f9eb2a99db6e6fc94eceb88ba6224d83434dc283abd55c6e571ab64f8fdc6a592685b40203443b4099438da9852cba9b50
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
Size 462B
SHA256 76e2e24d89aab1c0f0540ef88bfba0104ed461464c8fbab9ac5f90d969432eaa
MD5 cec467bc1c5ffd1187b6c6b2eafaff38
SHA1 8ef5ed8dd31f7f3ec551145b1ca71b4d97338259
SHA512 d8defb341b09c37f5c70e381d1a96a8fc162405d6d7ec532dcd597afe559dca2cfcb54857cbd6f56477f1641f7320d8aa1de9f61b9826466ee411dedde7ca600
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
Size 267B
SHA256 11ab41fc17099198fdc502e7501a4c0b563e09b1806eca7395d88d0177e2258e
MD5 3e9a7f72b3171466601f73e7956a7ee6
SHA1 de9db7d9e82960afc1b6b88381912ebcebc6e7a9
SHA512 56b5a891e1fd8feeda945ffd225090281880cbd464084eb5028657de9ed4ccffd1005917851166d6b8a777fcb61ee2b5bb8e2eef4d64e05b2630469a6bc158e4
MD5 SHA1 SHA512

Submit Download

HEADER.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
Size 2KB
SHA256 d14ee42dbaa52df6b5ccc0cb80258e5602706ebaaf1c069a1c51e33db063145e
MD5 8f2285fd9b17874050e54500d13dc685
SHA1 24dd754b63a0884212c360dcaf998a6273cb47d9
SHA512 8daebbd0e07ed7acb2308b345349287fbfd7a20ac83e035e95240f92ca0b7889cb617cc9e0d95f2434821c788296bef960b59b350ccb2535066fe7f8cca58034
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
Size 233B
SHA256 cedc94063c93b83e1bc446600ce4269dbab7cb3b6a00904c71d4d163c2f9ff59
MD5 88f0001d8be95b2dfe3a70462692c89b
SHA1 a8c2921b49f98090cabb54bcf2d0cde91c64f0fc
SHA512 05a2161c57797acf4653b4fee4d3f0d388dfb852520eab70a411b48cd8d28621a23d0a7bb284f9d0f138d95fb07553b6a63bb6980a57fc776cd8108e4dc8338c
MD5 SHA1 SHA512

Submit Download

TAB_OFF.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
Size 364B
SHA256 ae6a8eebf58b1e698e0b16dc3007c1b216d6d1e9960e3beb73438beb802e78c4
MD5 1dd4ee44bf31e3a842fe7a6a822eee9a
SHA1 7cc546c150abd797a29a9c474ebc07aff48efcdd
SHA512 91b2d870a0b5005992c9c0c1fdeccb65d742919370ae1d2838d53e5708534719d74e82f164986c23d4a32225074e6d1e456e4b74fd68effab81784210daaba83
MD5 SHA1 SHA512

Submit Download

TAB_ON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF
Size 364B
SHA256 df4110a62f67050e6f60d72c5af1526bb1d66541dff4a3fe330a5c6531ea4d35
MD5 f44d349934f2088d250572dfb031bdcd
SHA1 88a7676b5bedac39c79cf1214b7db3ae34bb7bab
SHA512 48d488f5115365234757c4553f0e5d94f7c8c706bab43beb3ac2628e11a8108b31411042fee7971464d37ed3041d6b92278060d67c68b67d0d38b5e23ca44f3e
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
Size 6KB
SHA256 29426c245daffd0b88ab91d1f2011cc4bd609c50e790d109422e25054360f80e
MD5 53d61f006c64abe3d3acf8156dbb3e64
SHA1 103179c1e81fc3bac63d143280aa2d91c9d51414
SHA512 0600c8bc6efc38af0a285a668274ebcbf3bd2de372ec8b655f86dd3796fc2ca1c436974fa71abc22ced25667f6be3b0ba9e7d62dd3c2b5ca620734cf6ecb3183
SSDEEP 192:vbujulbYU23zCFmt6ufo+b8mdfrCm0UBgJrCQpClf:zuyVYUIXu+3dTK+gJOQMf
MD5 SHA1 SHA512 SSDEEP

Submit Download

BUTTON.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
Size 428B
SHA256 db85024f0db49f653c472f299e49c1dc98a9864881057b59d128922d077725ed
MD5 a6dc710e8e8a3cc69f9aa30d34b41d7c
SHA1 fb16e517910d1815f8f09dd693df3eee5b8fe279
SHA512 554a08166c762f74671550e38173f2a3490845d8a664e1a218fd4271ea0e367a0689ec9e0cdbdce8fa1acaa91d6e4b4ac187bbf9c1c260b624a3ad6e131f0129
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
Size 815B
SHA256 396e76040f602111703e6195e3c9c81ccb0ef253ae65c2cbce30815a613643a9
MD5 e6477cbb2f4819e040f73857cce3e201
SHA1 3aa64f616c8f7f8d7220935341cd718d55726d67
SHA512 03b4dc31a7f1cf306ae9e8f35c9255d0fb504d59f5323f68ff68e4338c77805ecbca3a18193b87338c0d0e75dab43ec49579d26d13806e5b9d7f087ca1399016
MD5 SHA1 SHA512

Submit Download

RTF_BOLD.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
Size 870B
SHA256 7c2058d5bb0102cf49c347c339ab2c5f7ca9a39b4c435e0ca0184011907fe8cf
MD5 852c11fe658acb91b391fe5eadd23808
SHA1 d3389aed28fcda0e8f58a5c760b51afa47a7c399
SHA512 8ce3702efff7d6bc0c29814fdd0bc03266b9e590cee221406d022817e38d68ab5ba73ce76acd3ae4c21f277ea5fa094fbb52b2715b07b90c26215dc38bd4fc8b
MD5 SHA1 SHA512

Submit Download

ViewHeaderPreview.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Size 3KB
SHA256 b66e410c3ce20f36de24b8358f793d1fcf2da2181772522c8cca82e3646357ac
MD5 427417303c8abb51971dcb2baa1f4647
SHA1 9e802455de13ae50bc39f25bad493abc3075f6d2
SHA512 1392457939d99e7f25eab243ff47d1e902919d7260e0f4fb474fce2705df4cfef78f1eb2eeb3497ba0582365e1793f7f429aba74f933ba0542df4fe70fdfeae4
MD5 SHA1 SHA512

Submit Download

attention.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
Size 2KB
SHA256 156004d9d18090f1ae7e3ec05d43a4ac68dd6adde3d54b7f1471956db487f33f
MD5 6ab178d0e06fca567e6c46d89cdfa253
SHA1 058fb0afbc2936759fcdce09e32615fa89a6a038
SHA512 f96539c9824ab8caede5d13d04677b681dda32c9784ea5f041f607c33f00f26f71030ae445659534e5d3c3a2ddeba8c412d6562beac4a84c90179271c329b963
MD5 SHA1 SHA512

Submit Download

bg_FormsHomePageBlank.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
Size 19KB
SHA256 e9c85b64e31cf27bc7544603be2163072c41045d5334d3309727764c04ae6114
MD5 283f73dab904d6bf2829545dcdaa13ec
SHA1 412dddb3ab18d74b6036af4216dfd64e9732dbe1
SHA512 c95580dd09a3fddc59ebbdd880faccdaa8cdf39c0c84e2373a9fabd3511caf483b1bde446343e1473d9b6a3a63347f283cef9551808fb3cf4846a3c8c9a1c229
SSDEEP 384:QOiRYWTXw9Bi0MqbVd1BIVX75zHTdDVuJH0CSZM/pyEhpM9q20PYlzYzl:QO8YUg7j9CVXxHVVUHx82pyEvM9ZdlC
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtf_choosefont.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
Size 890B
SHA256 5ff32a06a9d47a70da7cbca7e5c2896c5b2eb87e75a54373713bb913bbf94f3c
MD5 bc9e95ac2b2ac97f2147918f539cd4c8
SHA1 897d356b77a15eb9cfd58bceae4a8df3fb4718a6
SHA512 2196977e72a4bccb262f5be80cf8ac6643e66e9a17a34fd30fb1c9788bb9c88710e591c7d3a996971929ddb5a2334c0dec6530e3954a045126a6e7259df930ff
MD5 SHA1 SHA512

Submit Download

rtf_italic.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
Size 852B
SHA256 3a2f1a8ad0f1c0aa388871a83f5fbcc3b2ef71a83928ba65d087e21ac3f17eb5
MD5 b68145266d1d823912bcab35b27c234d
SHA1 e6d85afc121c1bf85f8a6c1395281e3f7300b76f
SHA512 8a2b5e851dedc6c79340c45747689c5f3c5c2a5783f070953a348a54c772d64fe09dfd2bf1f03b6ffb3c23e1bf7c054b5866df13fa623ad9ffb2e335d4902e0f
MD5 SHA1 SHA512

Submit Download

rtf_underline.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
Size 860B
SHA256 243c06f5c29da992169b362063e8da35eede25b99d4b39cea4333245e73e3d72
MD5 f98bf908d7cde09aca5bd4429cfe209b
SHA1 5102de364b6f33afe2d7c7f3a083a9f7446f3497
SHA512 00dd65a867d01219a13d64e77c61c19b394adf51ef3183191d352e62b9b82048185763b720dd16ed20ff148567a7d43b6ce7f5d0f74e87adb1363c675720d3f9
MD5 SHA1 SHA512

Submit Download

ADD.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF
Size 580B
SHA256 3ad756642ceecef837473c1795bd9c9b67c1949ebf746616aeda36185d262d78
MD5 6b150cf0579e14d25c4b6a0d26fb4321
SHA1 cf10cecb444821b7903f11d584534826059358d4
SHA512 1171b568eaede4e6ca293fd47946958393547d6f3100004a76b0f9e91cb0789ecc112ddf782aa07db50be6de677f1b29164f08bebc9721ce2b7fd1f1c28fb098
MD5 SHA1 SHA512

Submit Download

CALENDAR.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
Size 899B
SHA256 8f25659c9ee6c23cd478101af3f2fab89e2ea7984d807bbbca10386d14861e3f
MD5 f046636d6f85c4a9f384cac018012a06
SHA1 7aa2d8ebdd470732d4f117901e733fa6602af3a2
SHA512 09f20ccb36632b40daca3b3ec7a4b7736473a084322c8c373f89b1e8466905cccf71891b4a3936e9a933a3a0f8929946a909951cea840d2ccff643c6dea0a925
MD5 SHA1 SHA512

Submit Download

DELETE.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF
Size 625B
SHA256 0470aa315758d5d1705bec39722b411214ec1b5d4434ad6901a68d46adf2250a
MD5 20df2a69d61a9f6bcdbbcd2f675040e9
SHA1 9c24a6312289c27365eb568dfacd52982af0e2a1
SHA512 2c681313ceaa6738a1e109ce503e5e1c27ca33d58b97ed544d67b33ebfe42c336f4a042cee0fb30010b4abf2073614859506dbebfb0f0e1597e71cc39840b066
MD5 SHA1 SHA512

Submit Download

ERROR.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF
Size 873B
SHA256 37b5130bedf221e6b2fb7a1ce662d30b73dbeb882622dc1e79a0af9fbce747a3
MD5 af6d44ac55d7e34bd62fc46e16e1bf7b
SHA1 c64827b85294b459be3adb6fd31c24b8dfc5e5ad
SHA512 3f2d55c06760be31b85f6cfc74affc77ff7b69c18929a9c83e873b8ae25fc7b6703f0d193d2f62c48e5c45ca6e68fd3c36a9237ee2e9ab8662caec37de3432cf
MD5 SHA1 SHA512

Submit Download

FormsViewAttachmentIcons.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Size 5KB
SHA256 8d5f1d406adcd4be3b797179e81907bff6da79b656588a7a0f5bbe0413aa4497
MD5 e23240351e6d9c9b86ef0602d78fb5b5
SHA1 a871a674adb04e1c6cb4c98a3216722462b258ea
SHA512 77c6856fd7256a8ce29eb1bc43a6cfadccde728e8d5574656387bcf2c796f25fe365ad1a336dd6dde3cbf16abfb8c0338494804cdf1b528ba67ccd855ef4e1f1
SSDEEP 96:mo0QqrBvUQe+y93mOUpQMAAu+o6aqcU3HbmHYZZRdiFu:Er5xKmNpu9FTtUL8Yzn
MD5 SHA1 SHA512 SSDEEP

Submit Download

FormsViewAttachmentIconsMask.bmp

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Size 1KB
SHA256 66549f3f9aed3432fb803beb8cc40b6c93ddcda6cd54a6cc242e245910a2b261
MD5 dfda33bd2fe0108f70799145407c3b65
SHA1 dbd480491140e5223b97a556f3623d1d4f826b40
SHA512 75a9d2f32fef0f3d99d5dbba1ad961db494eec49d696d394a01448641500fec4cf7e5b96edcd50d10fe13066bbb0402faccabc9d3ad147190e9a48ef1a193ced
MD5 SHA1 SHA512

Submit Download

LAUNCH.GIF

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
Size 615B
SHA256 e5b1aa326c7b83823dd4c42544e5b83f99c309790bd3c9f7afff1e121f02b5b0
MD5 cf33399724e606afb964e75dda8ef89c
SHA1 68b4fb7e37be555b4d545ee0c66777fb0ca2c74f
SHA512 1dce6d229d4adf493511d0ae179f4514a9dc041b638cf6126fa510b074a4f7cb20ad01e4dbb733a89f56a8355fe7b261460115e966a382ebf413a7141c5109bb
MD5 SHA1 SHA512

Submit Download

rtf_alignleft.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
Size 848B
SHA256 51dc07e0750011337e5330b0facd72145b5239a395bf4c7c7a643dd1ea6e6b99
MD5 047cb2f379471c717d00232d805bee0a
SHA1 221f86b6574fb78d795eb2589068033bdf737696
SHA512 989fb850e705ed23e370c5373223c5249243e6fc241aec802f3413ce37cc7a5af6f67531e2cbd78c0a3e8fd444c206f6ab878c7b28e10c7575e688ce6798f357
MD5 SHA1 SHA512

Submit Download

rtf_alignright.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
Size 847B
SHA256 39e8c385e86521f082cbbc160b38c031e7170d12972b46301e33c16b602be061
MD5 f0d1bf8a1c234c181ecc0cb64950bf13
SHA1 06e9bfdaa18d2790016ffff4e275515fbad1bb11
SHA512 3e57d00a4e5adf65f4fd60259ff86ddf8f14d9bcb2715defe6668035c98fea2cb78f93cf358f45bf0a60fa6f40ef7f309939e7ef766e7b774a171f130ca6a0d1
MD5 SHA1 SHA512

Submit Download

rtf_bullets.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
Size 869B
SHA256 aaea44fda8f04b165b38cccc8b95c2835c5372a04de3a4b0c56bedc991aba496
MD5 b39f46a4064883d246cffd47f0578af6
SHA1 34c087e98120ea2e7568b72ae1523abb321f90d0
SHA512 379ddcc1fb5fa57fe67d8801158e1001c672a0f2e7d837a0a562a434847b3f4424608d50d6832e73604a798e5748098f3b09e71cf7da5e35c287cd85c0d8464c
MD5 SHA1 SHA512

Submit Download

rtf_center.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
Size 847B
SHA256 02a6c56a31b1a85957e8ba2e54c3339837af0514aebf2e58a5046e9f31a2ae0d
MD5 76ff21d20a3cf8e57fe25fa42b3b76bb
SHA1 7b637bf38076ef63a0f67439f7cce0e21941295f
SHA512 28746c08f5df2a84a392df306a5d1cea6d81c64b998d0a2729762a1455b666bfc560e2583ea8bf3de706f19f1e1c7b5a95921162af205fe91dd401016b212267
MD5 SHA1 SHA512

Submit Download

rtf_decreaseindent.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
Size 863B
SHA256 38cc0adb0605f1d9bbcad30a33fc7d2eef66581c1465ab9e1b306168985a192c
MD5 ccf65105103975650806cc466741371f
SHA1 b0e66674faad61788ed5a06dd00c78c5afe37a85
SHA512 7a22f02d4675cef1c63cf223dfeecfb20ff30fdd1fb814d299b42feacdec895c8af160c9392e0931191b5a50ae81e4860d8cb34e6ba4235eb366b2d59b6a01bc
MD5 SHA1 SHA512

Submit Download

rtf_increaseindent.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
Size 861B
SHA256 96fd901cf4e92980154e3be376a116e651d8616428d93eacfeef729f4b45e5bc
MD5 b27c17d16719f6b3326129b536ed0f97
SHA1 99929604560c658f3f4f342ee40a8e279a51be30
SHA512 7a670c22fe5212267601f78087ff2293688e697b8df54cc44e487928a840c21f1eaccc9662415ad32594d60af45a1c1ee9e0485e14e3f6745f0f8e3318f98517
MD5 SHA1 SHA512

Submit Download

rtf_justify.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
Size 850B
SHA256 43e2021ad0b9d093afbcd50816b3ce58e865850bab7aff8021df9085e96b0c66
MD5 c1db85337a146c829f6fcc46c49e53cb
SHA1 b90b95a9c26c48a46edba72dd1ef46bd6ce27bb6
SHA512 f24f8f1aa3da435043c6b4d836049224e44659888e7b0cd7c6b3fbf4baa3ea9b2cf22e85f07ea62c444a93ca5809da52517c714b92000da068d2e0d4aa45d28b
MD5 SHA1 SHA512

Submit Download

rtf_pressed.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
Size 883B
SHA256 d2a47e23538e72dc0a8e70413b69b1cf0207ebbb7e4c37545237c516d43abf15
MD5 dce5c37fb47ac52a3d90881c43c8ca65
SHA1 71e24ab58b41bc9a35f198e14dfae2cbe30a7750
SHA512 1916c851091d4c922c1370d3562ac735124675180c8332184d382a9fc0545c16c0f9fc72481b98d547e7261b6f925da67983dcbe31c2bb0a0d93c58ae0b0f6b5
MD5 SHA1 SHA512

Submit Download

win32_MoveNoDrop32x32.gif

Path C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif
Size 153B
SHA256 abbcbcb660948adc36a5bf4532cc47eac25b7029e5d429955188fdfd45510820
MD5 1732b42275525fb9818f66b232961bc5
SHA1 c7d98bb3f0ae12c0868ff1807228325659673123
SHA512 d909d099e3243a147fad52891d06e92b13cd6961b62d03f5a0d77dc75045e8f59b8d617a4acef9bbada88322eb7f52265ace4786718fee4d54550e8b4b65cb80
MD5 SHA1 SHA512

Submit Download

epl-v10.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Size 12KB
SHA256 ae8362a457050acc3532c2a86dabb15e6c72fbf7dd4805c66e96fe420d455ea5
MD5 eb65f6dd96cdb209d116dc619c3b0a24
SHA1 d865554087cb958883ecf1176bd724573f11a151
SHA512 475ae51f8efc6e7cd43b36e2fab3c979b11a91e1ed66ce5855a10553a166d22fbaf7af0d0058597696ca5cabd2593da2315e54b5e384b1258be5f61c6d7db312
SSDEEP 192:Bm/tfzIRsof2ovfHQrlDHfQl03ESr/EjZ5dFsBkI+ZjnqplTAvSnx:iVsRs+3HyYl03DrcjZFgkrnqb9
MD5 SHA1 SHA512 SSDEEP

Submit Download

license.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Size 8KB
SHA256 cb8de7ca30e2058a60c622d6c4a611bd742cbbd1cf61bf333c062215bfa812e0
MD5 8fa5ff1aa8ae2ad98d95e9f5903121de
SHA1 7b57aa9314b3c866971d111edd48d024e81d1c05
SHA512 cc878ba995a73c5a6fea1ca446c9750adc564a264c4239bf6fbceeb0ddb8a28e758da52ef94f781295396b2db53947e40d9a65b1f4904b9fc66a70d31e07b0df
SSDEEP 192:Le1ygMPH1rJj+r00vO/AZUKiGeSa7yo6sa6Ja5ymGVL6MFBV/aQA:aygCD+Y0vO/8iGlWp/9NhbFWL
MD5 SHA1 SHA512 SSDEEP

Submit Download

asl-v20.txt

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Size 11KB
SHA256 8f9dbcde469ede6edffac27636ef4032648a897524c40387e6cb26dbe1bbd4e6
MD5 20f948c207717cdae09b136e685fa5fc
SHA1 9951b105423a6f0640481ded54232759db60d99e
SHA512 379a6c735ebd15a70e75d897e3f16564d6021ae7b93f29595002a03ad2c2d970de03f2a966d46260793a8d2ce59537d0c6ddfe75003905c6597c1d49dad0210f
SSDEEP 192:nU4fY/ZwBrNmbxAF8cZKMLUuuHU17vosusZfZkEyc1bSG5Qz+0pL2e:U47rYm8cZ2GvoffEtbSG5Cr/
MD5 SHA1 SHA512 SSDEEP

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 109KB
SHA256 9848a18a58bf545d75f4728a821574ca99cdeb5d2b416c716e4db992e779112c
MD5 92ae3330137dac04858dac3319d8951f
SHA1 e4b3910baf10b2f2cb7f8cde19ad598772738948
SHA512 5af8bb174a6275119f5bdac8848aae68a8f7d9e06e29f4ffb66c7248b0c5dd76bfd7bdcffc35b4d870e6e25af7d19921cdd659607af88470a707f4aff13c985e
SSDEEP 1536:Z/wi0B6dKyHsmon3y3dvUMvPqK4/u7MfRiJziscKFiG6MZDl2pyj:ZoPytknCt8GqK4bQixjIZDl2sj
MD5 SHA1 SHA512 SSDEEP

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Size 172KB
SHA256 db4b0bd414d37a33886aaeee141cdf56c244dd6fcfc137debeab4ebedaffa7c3
MD5 f720a30af816737df2b1189b28475846
SHA1 5951f027a01b022a60ed2c2a3f2d6af169c1efa6
SHA512 0405a6c83d66d080b1df698ec185cefcc32af30b583b9b10ea3c3bdd5680d829bdc51393ed9a8be145c0c8d48e59396a8bddbbb97d8684aa21e5aeab2797d1a7
SSDEEP 3072:QgSWwVIqY9cTAtNtjmL2d2NBFg4/ilsRJsI4MFBJwB3xpD8o77euDvmp9Rb:bTqY99djmL2d2C4/4sRJCMFBJmpDP77y
MD5 SHA1 SHA512 SSDEEP

Submit Download

ASPdotNET_logo.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
Size 21KB
SHA256 0675b71df1f7e6c8915b0ef8d8e44aa103bfb3c415bd161d53755d8435188e6c
MD5 f0ca99488fb6039a72c7b507a1b2f2a4
SHA1 61c803dfa555c6a641ae04ec9e90e4865015c244
SHA512 c55023fb6ab86ea51eb0c8414bf0d9d2962a153d9d32768680dd172997163b2a0318c79dab42dcd067a0ac55d26f9e22bd059e0247b590232614f528985fad6a
SSDEEP 384:QuJ485rYqc9gdkA4BmpuVf1a3Bhcb5hu5v9vJ3+XinhpsbO0ukrD2uup:xJ4WrLc9gdkA4BmpuVqBhSU5vruXihG0
MD5 SHA1 SHA512 SSDEEP

Submit Download

HelpIcon_solid.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
Size 1KB
SHA256 a4a5561b3fbba342f7ba60b099810c3a644b23d3cc85be718fe1f8b35c9c3abc
MD5 27ea499ce305559a39ff62ff8633b274
SHA1 c3b2b883090002b61086b18fa6b040d59f31fd26
SHA512 aa181227a565bca1abb409d742c95478130a035895dc8cf8bcf254176bf5e43cd1e85a290a586455c413df7856f9b59413404360b982af7e0aa9bffda4b1fd62
MD5 SHA1 SHA512

Submit Download

alert_lrg.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif
Size 952B
SHA256 1c111e476e85c145505404c2799f17bf5ae37f8830ccd65daa10ec17e05b9d02
MD5 e1883b50d6856e78d83ab000343ad77c
SHA1 72ce958ae66d420b3ee5038d64907759c4b1a1b8
SHA512 b1dcbc2d5288138c7c1caac96b126704581f80522ab7e83d1d6defe2af95a7c48be9760ff530bcb47762e04203078d632d33761b677d285e2106a597cd0ee2f5
MD5 SHA1 SHA512

Submit Download

branding_Full2.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif
Size 1KB
SHA256 296acaff47fe2297b43518b1d22331f5c615428394376cffc96ce68fa535153d
MD5 bc7bf9df7ddcf77d23d1ca99d024b533
SHA1 f6f04630141c47f2381e729554fae0cabbd2b1f4
SHA512 dc45248bb9227c0e0534ada4d530cf9f53464c05c844323459d08939d049f62fb99de70064051a06f498614a85a921c18d21e793dde656d56226ffd82619485b
MD5 SHA1 SHA512

Submit Download

darkBlue_GRAD.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
Size 8KB
SHA256 bde950513e3c3538065caf9e5db8e7d98e459db61de9aa6bad45fbceade7d38c
MD5 ca4ea55929e5af73d54abc5d1727c106
SHA1 7bd1d84b7bdf2f1ed216ffb43b098724c99be154
SHA512 375ba875f849f3dee3b61bca767e66884241fc91ca506d4f42f8850f279c7f18374a58b059f6c7acc3dd8777a78f225dcf56f7ec140ce64d33025c3b5098d986
SSDEEP 96:zZGWBQ/8JIwioD7DXlOLD2h4mK9IxIqYprp/:9GWi/8J2oD7DXYLq4mK9IxBy/
MD5 SHA1 SHA512 SSDEEP

Submit Download

folder.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif
Size 914B
SHA256 9f46b5d4dfa21a8c19b49d83f3070fc38fc746257cd0107ecee4d6b2b831f88e
MD5 1a10aca71b7179b6368614467f5778fc
SHA1 41d4c61e33b011e9f9dc0ed9c757a727057a59b8
SHA512 a9af052ad745eccf11bc38dbb2b9ec704a5d08e3017d90b33b98f21f244cf886b2790b71b0f70033a62a578f45af80942294dfa44e202cac721820e82edc5a22
MD5 SHA1 SHA512

Submit Download

headerGRADIENT_Tall.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
Size 328B
SHA256 476a41191e541c1d6d47b76369c9b82a8c570c87fc431df61100e1e5734eb805
MD5 29a19981596b1a8590752e405566328e
SHA1 c1bdfdfedb31d09ad2c75a27f6de4b7d08113b85
SHA512 241787d4e786529c0c42d030a5cf5084b38eaab9dd4663c05310188c3c128c5359fb64d070695f704e6fe3c14444b4b18b2f710fb77d8e870f4a1f41b8d4114d
MD5 SHA1 SHA512

Submit Download

help.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
Size 1KB
SHA256 d33b53ca1b9b8d0bcf84366b102e65f84791bee45678b91c0da91dd7b64554ad
MD5 f4edd39f7e8f822b00f19fa86a541122
SHA1 8957b13fd3adfef4e8224fa730366859ffed1b8e
SHA512 52597ec391a9493488e5e55c4b56e823aae683f33c675cc122bd97c33b13e252e2797530a7afddbee160bd85315d32e3d6d6da222360ef3fb336bf1066b7c675
MD5 SHA1 SHA512

Submit Download

image1.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif
Size 162B
SHA256 d5ddd4001df35beeeeeac572a9c3d42c0d467f2ead4e847882288d601efe014f
MD5 0bc06007eba0456b2857698c4fe6cf2a
SHA1 17f7f5ad3fb003b4b77b63891dd57a02468131d0
SHA512 642fba0c6a2ad4e4e3ace091253edef032762b57d8fc0d5b2cac7b914e74061ad50403cff0028120e526d39adab4edd8f9f43ae6b71cd34c72f6b578a4e0f9da
MD5 SHA1 SHA512

Submit Download

image2.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif
Size 586B
SHA256 57efac8a44b04e3184e419eb2a7256ba24cc91ca3ece8cd1cebbf1194c5b175d
MD5 c58b4df7366c68a25d9c477e7b7f4da6
SHA1 592590c7f259a0cfb309548958a959b0d122ab70
SHA512 8b956c46627690683b6fcfc522f21b57eadb3ec036e81abdc4eac8bdf3362eb82d6ee25f976425a988f30a26b86ab1f52823a1998242094f09d01d84293b40d7
MD5 SHA1 SHA512

Submit Download

topGradRepeat.jpg

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
Size 8KB
SHA256 3f588dc4aec11f236d56cc5b8ba82c03b68015be9562b06c32059335a6c4fb30
MD5 e29d70a5e31ca4a33dd4735970b176a7
SHA1 0e74339a840675d9e42c02f16468fdfe724b06b6
SHA512 dd66dd130efc8c576a5c057415c8d30b81b81e45c94953a5131ed29181ef2042cfeec52e57cdb85abe1638185c96786f81063d8c540eb428854dbb10e0900574
SSDEEP 96:Lg7XCQC92xNz7QIfXR3B2z4cWw7XDZXE9gPgOdsYYYYnYO3qqqqgJxDu:ULC2x1NPDpcH54uTOw2
MD5 SHA1 SHA512 SSDEEP

Submit Download

yellowCORNER.gif

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
Size 880B
SHA256 bd841fa55207cb0a690e5262e53c2a02ebaa87f12f9a5cad103e05d82c72eb3d
MD5 ce0e23f37c8d2b4cd6c48e8b2d746206
SHA1 d58cd315d6bfe82440d068e3f7e744ce7d972529
SHA512 52fda068f2c08e8ed07e82bbbddb796511729264800e24f368cc5ee230481b7f7743e910110bafdffaa56390804caa4d439ce334c8b7322fb08fa99f571ae154
MD5 SHA1 SHA512

Submit Download

memory/2660-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2660-8409-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2660-8641-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2660-8642-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2660-8643-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/2660-8645-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads