xorist | bb2af509e0c550876fcc7b44b052f9fd9e76a872dfbdd5c9ea987fc9fa335a9f

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
10-06-2024 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Size

40KB
MD5

0d3db8fc7b4e9c299e613cdf2809e840
SHA1

53d4fe38e838e009dc0bbde5209be3d939059894
SHA256

bb2af509e0c550876fcc7b44b052f9fd9e76a872dfbdd5c9ea987fc9fa335a9f
SHA512

65d0b9fcd86afa1dc354599c53b78be7b28b7c0450a53b2a7d43e6ad35971846ab82c75bb654015e72ba19562a60063edf68c864c55dcc3d6355f7ae30f7068e
SSDEEP

384:BebFNw4Pk1itKkpAjjalrU5BrJEqYvjS7kDCgSl8HXMB:B0FmBkpKj7BY77DC1ek

Score

10^/10

xorist persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/1600-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1600-9143-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1600-9144-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2191) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1600-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1600-9143-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1600-9144-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QMw3uEY442717SD.exe"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rawsilo.inf_amd64_neutral_8eb7e6403ddbb7a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\Temp\{522f6bf6-ae20-0f66-d982-a746d010852a}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_neutral_bed6224f27f5c478\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Command_Syntax.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx004.inf_amd64_neutral_2cf95f307381e481\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_scripts.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_troubleshooting.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_script_internationalization.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_format.ps1xml.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mcx2.inf_amd64_neutral_8cf9cade8f7bba56\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-international-core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\winrm\0407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidbth.inf_amd64_neutral_8a1323fc68ad84af\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_CommonParameters.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\fr-FR\about_BITS_Cmdlets.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaus.inf_amd64_neutral_5fa4270b9924b918\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnle003.inf_amd64_neutral_c61883abf66ddb39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_parameters.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_environment_variables.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\MUI\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Line_Editing.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_jobs.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcmdm.inf_amd64_neutral_af49d2f3ffa12116\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_requires.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_scsi.inf_amd64_neutral_cfbbf0b0b66ba280\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnle003.inf_amd64_neutral_c61883abf66ddb39\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_escape_characters.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_script_blocks.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_jobs.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wialx004.inf_amd64_neutral_0a3a62ae6ed43127\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00e.inf_amd64_neutral_edc631ff41a34218\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\migwiz\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_modules.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\angel264.inf_amd64_neutral_04b54b6322607cce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp2.inf_amd64_neutral_d218c42ac8635704\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00a.inf_amd64_neutral_d64d696193e69d7b\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Ref.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_History.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\catroot2\{127D0A1D-4EF2-11D1-8608-00C04FC295EE}\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx006.inf_amd64_neutral_cc725426972d1293\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnne30a.inf_amd64_ja-jp_b2245ba886355a9f\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wpdmtphw.inf_amd64_neutral_a7a22bb0bb81abb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_neutral_eeaccb8f1560f5fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\SysWOW64\MUI\0409\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_methods.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scripts.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115836.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14883_.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR34B.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Windows Journal\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382959.JPG	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\ffjcext.zip	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\PREVIEW.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR23F.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_ON.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImage.jpg	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Windows Journal\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_s.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\flyout.html	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14755_.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\greenStateIcon.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsFormTemplate.html	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ms\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01607U.BMP	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14983_.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsNotesBackground_PAL.wmv	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_output\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145168.JPG	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02073_.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_ON.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\ARROW.WAV	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\SmallLogo.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\RSSFeeds.html	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341636.JPG	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\icon.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent_partly-cloudy.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Microsoft Games\Minesweeper\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Program Files\Windows Defender\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_ON.GIF	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\it-IT\settings.html	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_e5966adda19f72b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-usbceip.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8486b98bfe31b276\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_32fd74c7101b30c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6d66e79a46059144\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_a86f224d5acff0f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_prnky009.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_44f53a6617bf10ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\wow64_windowssearchengine_31bf3856ad364e35_7.0.7601.17514_none_dbd4d2796675bc72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_ad816c4fbe2e97f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..hinese-imepadapplet_31bf3856ad364e35_6.1.7600.16385_none_faff6acb5cd29b45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ndis-tdi-bindingengine_31bf3856ad364e35_6.1.7601.17514_none_401c514f83c9df99\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Special_Characters.help.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_es-es_6bb9b334fc977631\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-infocard_31bf3856ad364e35_11.2.9600.16428_none_3cf29274794c38cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..izard-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ea6a9156bad4ae9c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-v..driver-tvdigital-ks_31bf3856ad364e35_6.1.7600.16385_none_1eb3558ba4abcf2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\wow64_microsoft-jsintl_31bf3856ad364e35_6.3.9600.16428_none_b9648c61e9b38e2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-fsutil.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c51eb2f5e88a3281\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..tptracing.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0589fb6f979647fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-proquota.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_ff8214d4846602a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-qwave.resources_31bf3856ad364e35_6.1.7600.16385_de-de_29ba50b72c09f655\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-stobject.resources_31bf3856ad364e35_6.1.7601.17514_it-it_801d681e2b65137f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmadmoe_31bf3856ad364e35_6.1.7600.16385_none_e2b5641237601cb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_smartcrd.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_84595286ac75559a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..age-codec.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0665c5b4a1b4ba0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-pnpibs.resources_31bf3856ad364e35_6.1.7600.16385_en-us_57823863b622b466\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..nter-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0339ada13ab4fefd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..on0viewer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2919f8ac8dd27b64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-j..buggeride.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_2d2015d81f5d8671\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..orkbridge.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8f09de819b0499e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ginworker.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3add512823df9cad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\PLA\Rules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..ding-shell-ultimate_31bf3856ad364e35_6.1.7600.16385_none_209493e8e411a4e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..atibility.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4f98f37af1356a3b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_nettun.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ddebcf254b5b6198\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-grpconv.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ecfdc804aee76f0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Ink.Resources\6.1.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f55897674210e0e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-photosamples.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6efbc2a188b32c60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ndprintui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5db7df5b307ffadc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-previousversions-adm_31bf3856ad364e35_6.1.7600.16385_none_41d785d4f443b620\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..tfmonitor.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9d69cba81cf3c498\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-uianimation.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8a8c4b4f060507fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-utilman.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4858dca066c28d97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_netk57a.inf.resources_31bf3856ad364e35_6.1.7601.17514_it-it_0a001cb9db6f4f2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-security-vault_31bf3856ad364e35_6.1.7600.16385_none_57b2acb0891ad7f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..otmailapi.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d3e4cff267639013\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..ore-other.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d40846137721c773\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..cess-control-driver_31bf3856ad364e35_6.1.7600.16385_none_22f4887244c226bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mfc42x_31bf3856ad364e35_6.1.7600.16385_none_4f09bfe86f3fbfc1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_taskschedulersettings.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4f2d5991478fbb5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-t..tservices.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a67bd6ed5394dc75\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-duser_31bf3856ad364e35_6.1.7600.16385_none_5a4b046c5dce176a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..omponents.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3503ab6a5815d0d9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..ionrecord.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1193b4bfce8dcbdf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\NavigationUp_SelectionSubpicture.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netvwifi.resources_31bf3856ad364e35_6.1.7600.16385_es-es_08f35f7c514c2343\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-commandprompt_31bf3856ad364e35_6.1.7601.17514_none_e932cc2c30fc13b0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\background.png	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-netproj.resources_31bf3856ad364e35_6.1.7600.16385_es-es_18e5649238c1a9e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..mostfiles.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_bc258009bbdc418b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-20285_31bf3856ad364e35_6.1.7600.16385_none_b0eecb42fe1eb148\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\403-5.htm	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mfdvdec_31bf3856ad364e35_6.1.7600.16385_none_64a6ece3617cfb74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..iadisc-style-sports_31bf3856ad364e35_6.1.7600.16385_none_c1c84490c211896e\SportsMainToNotesBackground.wmv	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QMw3uEY442717SD.exe"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.enc0ded	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.enc0ded\ = "GMNSYSTZZRFDVSV"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\ = "CRYPTED!"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QMw3uEY442717SD.exe,0"	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\DefaultIcon	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell\open\command	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GMNSYSTZZRFDVSV\shell\open	VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe

C:\Users\Admin\AppData\Local\Temp\VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe
"C:\Users\Admin\AppData\Local\Temp\VirusShare_0d3db8fc7b4e9c299e613cdf2809e840.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:1600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
638B

MD5
bb09a26a25c08eb560c21095b5060300

SHA1
69f699019e6762b4dcb60d7fd100735c38780672

SHA256
3d11fd4c80d8ae84a688a9be80060024f9ac3bddecf3d4e58cefaefaffc90403

SHA512
26af31f1d44a7b6df0411bfb4c502569e126daad4df359f8225c6d792ed44611221f0bbb00c72ad178ad1ac658dc8b57830ded932e039260348cf7f9cb4662be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
a56144faf26c16d94e86209fa1644a7a

SHA1
792b076c4b3e78c288f17b859eb1e9985df813c3

SHA256
45a07b047e31a43df60cabf91a2c9b88e45be19cdeadceb1da7e8983027ff6c5

SHA512
ebd3d8b100bc20211dffc6f5795890c0f7d17bcade4a8c8e7c725d3c7919021a4203521cca194dd7f3365507e1de3e6756d1025bfb2e860351b837a6409325e7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
69a2bbc5ab4465f1cc370405c1bc05d3

SHA1
d24af01ab4369d024f21d31b03c0ef3340bd6f28

SHA256
f60b8f8d53818d518d153be4463b35c44123d52fdab5fa0476aa1ca2f6efd769

SHA512
cc543a90c61c0a7f429696979078af78176c897f842cb70a3e3ea5aa3b66447d8cd3879a13eefe5f35ce9ab73074075e024484bd04d45f013a3cdda0cd26c793

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
37ee8572a47c11541ff228579cc6fda3

SHA1
6167378ce2008e6f0e14be75a4e571078f62afbc

SHA256
e940f34253186e1235a5973d1286e4d10ea01b1812a8e94984bb72700248c903

SHA512
aace2b596e7b8b7114844c7fb3985e05a0ced99bf6298a96d97645b34eb261193405541e58175c7c97fd521fd921a23b772c0348a0f8dd3d0161524fe04da82b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
900d806905b79bb4c466bb48b30be9e4

SHA1
a185dad9a5b9e0ca8d0c7312de8ce9de2b2291bb

SHA256
c185d23534fd662637f30889db9d212e7e26eca955e58be04d3ea8bbf37f50ac

SHA512
7adac1d5bf77b9980a40ac5be984df3140a751554499de028e344b95c2aaa486f08c21a620b52c181a7072d58fa7ce9547cb6e1e9a3aafad68654494ee584836

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
e2f56a9bcd9b1d47690e1a65b9657a9b

SHA1
1a707ae3ebd4362c364a0d2873c92564aba6848e

SHA256
20077d61261eca5b6f429374eb6ad8307b6f2ad864be66867370c53adfc60d34

SHA512
3c9d09bf15494972bca087114e5fee6f3dccd54ff4f5b27f732827ef18e62069de9811435340475b3866480ceadd9e92469fb9fcd2c6e4e537116bffaef91ff9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
a224febeb0c1d8ab8ad142be1c7619f7

SHA1
d0c400c8c2d0ceb7a86eecdff3b597a4098d7d62

SHA256
0a35c18acf78075d0c40426f47a78b78afc2630e6369f38598e09f996235146d

SHA512
7251a83184d17eb21fe38c39970befc993d5a359f8be6903254fa06e7e5533cae2146c09bed366561b757402f4492d584d4a59da4f576231397609f045528d27

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
f166f0f8dcf50d1b2d4f973738bc4ef9

SHA1
a57943ea825a3bc53bbd622fe1e67417624092c3

SHA256
9f4041df71682d69ed889b5bef2d834816c6f5de7cc6523e7691b350a1cd9f68

SHA512
61fb49419a12ed1c2a47fbe1492ecda254447df5ec3feb753b33922b3ebba923e2151063149de0abb474b45b49e97236db8a26a4073ede94c0c109d6bb83ce03

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
6f490c602b1f8bf0fa7f6c4909240ad0

SHA1
d9346734c83cfa0a801419a47861acc95373b298

SHA256
afe18d04e3335e6544b45319590cb54f59e9db64fdbddb9cb5153fe789db9256

SHA512
ca97cd6b42bcb30b64c7404de173b38273d0c0485df07d4483c8796a5f812f5060b2b3e0564946e3d3d7b10d420a78502d7b55e269242ec214f7519af25b4a8d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
ef95b2bccf5dd22564345783cb1bc858

SHA1
19232f839157789c04f71057094fde50244f0248

SHA256
fff36d8d3a43cf67fd82160e8165653f09175b019a7124285dbc3c5b320142aa

SHA512
2d6af7584230391caa35a11053e25b606a81ce68d5ed3e1875421e209eef1ba5148040eb45cd64adb61cd6392182dcf47c6014bf5c747eeda6f30c601a0540eb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
7b838da5628a3de361e161917862384e

SHA1
cfef783ee094bf0f9e04e140b4cebf9eb9fe8074

SHA256
077924bbf5686760a1ec4ce527e35482361d86198863bca05f10b9ce93d09a9e

SHA512
57a29dfe35229956641cf263faf4bd776ae63167cd6d8bdeb138edf1e3fc6c21529269354284c0136bdff844bc35c85d4a28e20fc735b51c009b9a8e508181d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
cb9f5105ea6f40557d79f6bb5e1a9ac3

SHA1
ef0c4549d77bf0694ad6fd50fd8cf81556ff2c32

SHA256
90002080abaa20070e0540f49efffe65f63eed6111d75769e95675beb36e0310

SHA512
2079bf2aae6841a4bc34e253f8662450c98ed5f36a171ccad2453fea32b133b6b6d49db1d705823cecd539ce78c7ac47edbbd18e43510f7db3938900080346bf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
66c4ac3fd54984631956492b78f8e263

SHA1
eb1476148299efd80679d1f7bbe159cfa69f2740

SHA256
45d531a78504939ba17c3e4dcd1a3f4bf448b79e9f38ef0bee61575da9fca1c5

SHA512
1f97c16e6b5a95148d1adae549729a74e12b54c27d6216a1a2ed279e43c4c5fb20896e76e20f64c7b0cef152a44707583cb4c2ae7bd9e104558c8e54b24397f5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
15fc612dd4489c47a24d66a6daec2b04

SHA1
89d30b2cc428a018144802136d9176b708f11b10

SHA256
0803268be20e59b071187c180e2d93a5d3e08a60f9fbfae6580ecec7b74acba6

SHA512
026fa168131617897f4649f91b3ce43d2a6d64aa54df30d7a2d9547690696b67eafae812a294650691af28986a99e0b240203b93b027953cb8fe768f04f2376f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
eed9f8529be17432de6fd1c0060e7ba0

SHA1
5a1d1c49e416a8ca3d264233eebe3f265c6044b7

SHA256
f7881543b82040304d7d6e5996fdb332a0250d87e59595a69851f3e5d896b4a3

SHA512
b2d1aa8689494facc318bca125487d88b0a34506dcf2161adbb55d40b9d19a4dfafa92dc3e5592d2072b5580c9086537a3f1c7d544fd864ab71441e77a1ffb16

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
9bef7b3bb9d4066dd61b23387311889e

SHA1
82acc4eca264d065456b000bf66a0ccea8af68cc

SHA256
e25db367ad64ec2f12129707b76dea5e4bdd1d6833d475d58edb6863f1fdafe0

SHA512
63216a60c4ee4eac3e55f7490bdff5b69ca954ad0a0e307246a0c4a017acfe3b5db09e394cd9efea570b6928b540dc9b2ab26670fbe70485be8322daf785da52

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
20440d42bc37c2d180bc711aa7e7d243

SHA1
aa4a522a1907395539f9b5479c316e060b84cecc

SHA256
38e096455a0c92044dc14391333f2202411f9b60358cb51170a159ab2be2d3e3

SHA512
62e63e7bb0b76aa9c7a0a54b7ddb8405bf3881d69bdf4b611430fcf3faae956c6eee7bc9c798f393845667a2ec43136a8708f37702ebf495cd8ff7205ca2e324

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
51c11d8cff53eeef5774beb73ae2eba0

SHA1
1a720fccc64ca80984da323ab65efabfd1e3234e

SHA256
28528759c4f79abc2ba848a9fd93a33e7199285b3ece355f96c334c468ef415c

SHA512
e1fc5e67f7e43cae22a32dea9da6dca870a64fe0254abeeabcb97e9b54661ce999ab2f3732ed6bbdf742cf0730f3262d6688cc6a96c7dc0194e461a6217fcd34

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
5dda8df3cc60049ae255cf95a3a6de29

SHA1
df1d226d5e5636c9eb388d58d2b5e92ad5fac480

SHA256
539fd21c8d2b7327428ee51afbce28c2a19dbdcc0b3e6c4ec73af3013681b5a1

SHA512
e0b9e87cc83c9cc618a21b8a01d22c20648158e3152a2b66f375d62039cd10548fd033e105c39e3c651b69640f2e12d55953b1f90603a14558a083f33683c895

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
05291ad6b78c7ed4efcfed4b724cb3c1

SHA1
089b19c40ada63c27d28d6d6be18fc4328da88bb

SHA256
8844670db618cf0c0749d1fd1c2f78fe7b464d3cb9acbb60148fc2fcb56b3706

SHA512
ef1328e8f820eed7c10a97dc0cb26cba572d190082a2526f3018668746ef9c038b897291d9d93f91dc2d611f74fe78b528fdccc45e52f774d494558bdc67c4f6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
3d3e989504d4495427d595c065aad45e

SHA1
a4872e92053b12b1b66fcd6e3b18b042f77c2b75

SHA256
c872cd5775449c00f2076c062a9d19656637b6770eb7a00ecd4f30a166b77771

SHA512
74460b93a7b67839b04837cb2c0022be8a40e3c690d5690f53e26e30efa1f963727be5149cb67036812ce689406f7202968e8beb806a6667c45aac89db0634be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
8a242610697529b4be59283737c94776

SHA1
6a3dbba413c1055966609155ee34570442754590

SHA256
733b18d0dedad5739c5acd4258a76037ddab5dffca49a47e00ab95dfb474d4b6

SHA512
86067c564a0e7dfd07604677f13d52a8bd19054259f985969a357b64e9b2ae87363ac9b0666d7e0eab6b2070c8666788c18f2c4385a66340d9f2706f29f550f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
a5bc73552ef81bd3e078cbee670117ad

SHA1
37ea213a8919fc1706f3d497b01124a6e0201e54

SHA256
a583f1eb95195ba9f394ab80cc7214ba0da8fe815170e7be7a257d3314acb301

SHA512
12856cd2fbc8531da4c224d22483e3326cff48286250745dd59c4e82cfe53e6b7c2ab9d6de01c473b74b2293d86172eb717688eaf695bb30c949befb3b2fcc27

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
67cc2dd0b4fbab40ef7be8fb34f40f4c

SHA1
4b4ad9754e4d719458d6f60f11f3299e52491608

SHA256
75d9a727771a08b451c4b0362c5082d47a20a97d6e0dcf2523fcec2eb6adee49

SHA512
7e074de96cf09ae7e6743c3d2ba12caf98c8cd521696480f7fd5a76a2a8e8ee52cd870dd7b7801e061db6fb4f5bb2a8e61a7e6ede28cd5449362ced4ed06188c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
d774dc81a25d4749f82d90f9cf6c6ff4

SHA1
a7b4f429fb8cf20a146aabadd0c2791df761cd77

SHA256
1c424e72771d6d8f79c40d94d953eeb637aada5a94c8b9b10f3f0fe39330f6f7

SHA512
a57631cb2b2d48d9508a036cfbaa0750f0dcef6af0f84533b60ce430ba85a764f9cea075695860740d5856ab0475433dbfef7dfe1da323d0e8f5f4e3a4815212

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
2612dd66eab0cc613b10692bd9a181a3

SHA1
66e7a55b44dfe3949c25b04d36806bfe9bbc9028

SHA256
e35723bdddaa52e89eeb528ad3679c4beb4ed46007e316347320dbaba53dd4d8

SHA512
8c3eed46a7998a2f7fbe9db27e19d6e09842f06f2a69b154e58c9cfbdb7f349b1dca046573b49a72a77d1f5cb4f70fae0135d4c8eab3e20291066d835e9e0b42

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
11284e2816d9bfb67361ce53851d4e9a

SHA1
e1e5f7b790e9a6ef9bfb4b534fe1119f71937557

SHA256
8440d02328592bb3d687a6a0f429906997a958394ba42a23a5b8740b2a77966b

SHA512
d9989ec3ef378b9f7a79972a4a26d65c2f5d7cc2f0c16979d028a758a34af9423d7dc8a3c5ba04ca2d82f8b70ebc74b1aa8e80e10e5d28e4612f6de23636e0c4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
a8077f24d306ca625fa7f50e60e9e63e

SHA1
d0292492ff50f15bffdf7d91d12ee4a642dbd0b7

SHA256
3e318adb1e1022379b87354a6597db1d1cd4419410b7ff31f1540ba87f374155

SHA512
8a2ed8ec8576e655327d7cc3e3bcb9ee2ce496391a16bed6fb49e8b23cb88bbaa1dc87c32b7a567ac53ba79cda23361640aea701006d92dcc28a27de0599855c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
6d0b92e78eac6d1a748420641803c96b

SHA1
bf8fc384efc4fe0c1139fa04947f209be1792359

SHA256
5f9d90974e499fd60ee5ff234f6fa1fb2ee132903f2fb2d7906712dab8174696

SHA512
9abc46dc2dfa402767940de8290ef24e59e07f22f10e4c6505f70289690ee8ca387a4c16e4afa3f9eabb20fafc4e54f6bcc2a0775e92c7fbb048d63d982cd653

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

Filesize
3KB

MD5
63994be2cff39ea37f90848687cb99eb

SHA1
3417e4b830de88e9b41eb729d4e2499a4bb4e9dc

SHA256
dd74fc345a69344f85240a0d44891905431a6f8ad4dc592164502055156525e1

SHA512
d050a50501df9f349aadaec79c621a99bab5c6ba644bcd579fbcd916ab64d08a391fe80de9cf5b93ccce8ea4312d5e298d758ce181b3361f87d77e31c4886185

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

Filesize
462B

MD5
e6c9e3ff9532fa9b9ea07954048b89bd

SHA1
660a5429cbc8124198f8de3c3e32fa30d8e0587b

SHA256
189e7ddbf645d4a2423e7a61fc38e5b6cacf9d7646d9fb4724176b7277bd4836

SHA512
541babad5a0bec2964a552a3bc012a08cb3e561864f7f07aa08833836262d3ecd7dab872c70657c81f078d04a265c007425a09720683e91f648e45761d3fc3ed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

Filesize
264B

MD5
4aa45a0cf4256c23d2b615bbff02912a

SHA1
1420ce4aa0949c1186fd46c9081887ed62f124dc

SHA256
3a776ceb5d045bf8cbd353964249480f4f523eca9173e71b9c19123630a8d697

SHA512
925e5430a62b3c9c396f4714b2c1fb5722f07ed33f5b47e44e42efb603bee6bccc8052c8741ab1c7956ee3ad9237c7aae258bb500cf96237e93e4da033fccd8c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
b4779960bca5f9d9bf5bb06580e4fb89

SHA1
8b44ce2ca05e401002b8a31be9e4302e06a7af00

SHA256
870108b94b9530d8f73af0e3cbf95a5e64c6e77c624449c99022606c1e436478

SHA512
d55442c44d6cf565cf0a8a28857acc47e4bf372733299c6d2ff96ce9624cbf72a17f524b4dbb91bcc60deaf39fb2dc58269c1a22d03cd0120742ab027b76c96f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
8cde7dd68769586f0c410dcf342ab438

SHA1
6e1dde5428b67b3304f2b9b2eccda6b4063ec530

SHA256
79549a37cbc6258e42c55d76aa736f87a6c7f1b4ac6e9557d1626b35deaa9570

SHA512
d36a2a4187764e19a4042a5fa786c67dabd770fe3befd3afbd3f01c22b29c541cafd282e586c733c4ea25cbede9e68a991944c77ccf594def064fcdc88695811

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
a1a49e6ed055a7df5d64c3f9cc2bf28d

SHA1
75f891c6b653495051d1d0e3f6dcabbb4f17a75f

SHA256
c054b15ddbaa8ce02b074fb925cddf75aa8db8dd1eb9c14a323f2363bfd1134c

SHA512
7297a76509e9f71db12411eb9f0323b3b4b0b0baf9e8ad34a950a907bd497d5cbb0d6fb9851c29b09bba9979940be6a666d1c83c480be0c783d766382293df92

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
8b4c56e7d5cf508ce1ed10427bf55fba

SHA1
934512b7f090c0cfd6dadef877ffde9d5afdfc10

SHA256
de17332a563ac8fa5f3f6262a76c18978a1aa2132b35d514e067c20150f021f2

SHA512
c6e4df1c0e7efd1b84184793d06a03e3f27e6813e43cf316692118f20c203c729349dcd10c5e08bee32c11681a065e7b8437f5a713c6a06c6ca0dcb9867e2ae9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
3ebfd736246f4bd153aec9fd0e6e5d01

SHA1
7927aaeb7c82887a5d5f2da4df023c635c15b799

SHA256
62e61e93c47e61096c09a16e14ff7a75d30b9f1ca7dfd569530373cd9c2e126e

SHA512
e1c6cc1196e106adecf6dfc687fa6920c446166e7fa3a6e3043679d0e4d3cb6c7bf47e286bfd86fe06009666ecb04ef7f1ef6c32678ef03f6a0cee422a113123

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

Filesize
26KB

MD5
26bb3894715e12100728d23c561e2d7a

SHA1
590a8587f89560aae99428922c2c6bdc53b7fc32

SHA256
d233b67fb8336f4fba4663ab563b61c941b9d71a53d6b9b84af51375495b6c68

SHA512
71402aa6b8c3fb826049a362e8cee2d793d576df0c33128fe7fa38b4a0ae249e5ae17ade375ee2e77d36f0804c7e96ff66eaa5bcf4897c88c5981c76349802ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
5db084e62f7b44df6a32ba3ca55d8bf9

SHA1
13cc0a08c5abf0fd16df02a3faafd739a9b6fb4c

SHA256
dc5c441d60023c4353a3078387497dc3fbf1d539d25f224197b2aa254abdaf18

SHA512
d3c768215e68d5231d4ce2268e93218cf5476359e42c7a1761860542c6bab040cd20630c072d2e64012dc0065e42c3c609ed8e71a27afbb658e2497027ef5e87

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
447a7cfb41639d8da83cacda525411b8

SHA1
7fabdbc988000153c42bff8a4114d98d3b32dcfb

SHA256
04e5cb20b74aec20f62562105d1afd9a176de0b9fae7a7ed2aa20d0d9e4a828c

SHA512
b0875c7b70cdfedc25b8e9c88cd364e7c11c7eecee092e61c102d444055cdf417416d5812210e25b03113e91b95abfbe846df7e617898233bacd566f716fd121

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
67873cbd90ece9d82f8ef85b5383eb2c

SHA1
7f3c845f52d4e3648a978e9aa41cc67332d59a37

SHA256
0c25f7662ba72d1c50dd588866ef929f373ef3b719783116b13c485b6060eac7

SHA512
e306e7592185066e14ca5a73a42dd6a0669fdb2e3c3fddd10229d1790ed306bba3e2ba365c5c2e463a50e8e1235f35b1f6e1c3f40551fea8c9027ca07a50ea71

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
807821ed9dc10f8f80e62bbd307381ca

SHA1
5c377c9bd010baa9de8ea0bc7e3358e7dcd7a758

SHA256
f1754034d3fc01ebab0e4bda2c16b4bd877ae1a42f8ba485294b75684a6625d2

SHA512
21dbad0d785f6ff66d1901fe97ed2e5d45493081205fdf33b8d2b845255b54bf2298ab2dca2106d0ec88c35d8370bc73d937d0c53661c4b472d60d86ec57a094

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
6fe024461cda899b94cd045ad3d01738

SHA1
1da00011a3b42c39b63bc3fb3e435b54517e13a5

SHA256
d3d173b7447111239262cfc4572d054d72913f80d8815322339d2fc6530d4e66

SHA512
2bd36d32356f70cf8328b81f9fda880fa3b44a757b83f013a047d4790eef2ac8af47bf87390ada2641cc5fa4f1ea69aff6fdbfbd775edee6160fd61cfe8c6e7c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
77125616bf472f1e03f2de6a414bb96c

SHA1
f309cba20c7cab85aa6e865054f9a9a88d3db1ac

SHA256
ec123a3eb57c385861ea914f99f88dd2813520563e29c6914b7cc698641ba8bb

SHA512
aa8bbd5c526300ad01ef3df7f571f4aa513c22d508cdef8f120bd4c0e0a37297645a12b261db70bbdeb6bda6e43cb7de105b58b599cae58a8b524d874775d212

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
3b9002933e6c1300bcd0efa357d34874

SHA1
f7a04e9d51159c58c7de5a86826cfdd3d496be5e

SHA256
98ea08ebd1baa190b92e24c155e134c66ac89d8aad48565aeadb4972589b315a

SHA512
edeb04c54181b45f402e8ed6d090042171fe8461ee5c50ed765254c9d26d50578d62b19f6fd9bb8e5b2d8f34ecc0d5f692860481908c8c7f24873419ba8970ee

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
71cdbf8c5c5939a10b9b97dede3f0d34

SHA1
a1190d731fbd4ae017c28ca5744e34d3a85dc0cd

SHA256
867e667ff0abe1d451327c29372be213e129c61322ff11438fdfa08137499498

SHA512
1c124a66c11f395a2805648ce3c7a1e5ae00dd53ea7960bdf8cb58ae7d8baf2c51770344a3824cc752e52f59f50c24adfe9c66ea5542a270afcf278b3a5d9d5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
3c8735d4cd637e7c05aaa7dd91b8c328

SHA1
d9fa9e98e753e2381b850adc4d6ab00d24385c81

SHA256
4d5e8fb79d4f61b178fc31b5b8d0feb63e3a9e30d26ab36fec74245513a55a7d

SHA512
bcb5eb6aacf199fb94d342eb3463fc729ed6ccdd62e3c55421cad91c158d54b707d1d4f8da1240468856d9f62b085b14db223979c0b09f5ba3255f3ff964b9d4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
ec6c2d81430ed5b064458192d69e4bb0

SHA1
84016fece2a50aeec89827cff6860d36956ed70e

SHA256
8043b2a3b486d94da739ba2228a1d8529ef7f7f0c3a75ba809e6f2d7ef77a9b7

SHA512
c157a309ba7e92ef5e5cfab5659e2fe077c237fa16b639a3f0314c1ec57d805a6cebf5a8be39d4f6f50815454251b5ed283866d32b49db9bc80c61c61786628e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
33d62dbdf70795ccb70f235009c7adbb

SHA1
2d6d41fb3e07f515dfee49ae125172348a332ef5

SHA256
cd6a9a09259a0b45766bec1f6499dfa45ebb2b1c6e2ec43e38223708e29a71ca

SHA512
9b52130145c99ab0289a91992c96e0fe4dc07f6095c7a9ea76b570f8d3531b9d62f695a2dd987d73c7c09dc341f5e377473223e09c4227606f78a0df688ff32b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
80927f89181895adaee1d5ff3991271f

SHA1
3c70dba2a414578e914e93225a10c5d065ae7a50

SHA256
3727dd9395589c541666ca55a14aee6cf77b5ff9f50c1778616de5723cf88fd6

SHA512
b4a4a7724a529657d8f115867225f461e441355efb886f2867267d86966fbca7a591da91749506085d4e537b002bffce0acd05cd0fd60a9d4b063bf7382380e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
b1b6dce5e97476c00c33c30ba9d879a5

SHA1
4c25239b3071cf01b1368f1ef27965f6a437081f

SHA256
7e277d12f76941caac2180832b8947260e145bdc81749f13d751a9094fc7ede4

SHA512
2c1e094c644f0cc5d7ff7f1372ede720e42d6d7555668131c18dd7e162eddf62308484770fd4d53970c49db2be14b04845ec165c460a9f54081173d13df65fc7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
33dc35ea1cc3b0aef1372cce6029c89b

SHA1
0229efb2a744f19fd4bd71f10d3313c1b6f263cc

SHA256
90fe2c2b3b29ffe613a257e59d3a027cfb139b5e808d2bcdb4354197a82a9d29

SHA512
cde88778a3d6fbe9ee8ed3e738ba450f79df2437d89544e4047735ea96365cf5d90c7a7a96df42594c4e76a9c2eb6e6e559741a1b9a4e46c3994670a1e47ade2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
e38deba5986b34b6b548d6ceee40662c

SHA1
37ab0cda722f469ef23fc79a7ee68edc1cdff2f8

SHA256
6069ee8ef8fd27e0c7d79bb04ee45ce8100036c507c4bbafb58a1fac2459e8ed

SHA512
da6a4772cdd1ea3f48f8d1d3d39f05e8884ddfaae53866dda08d757f2f4ac207c347d6c64258523a762c6a4a6d3dff8d09bc36ffb08b5dec76b80f8140a2bd27

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
a8f93a5a68cf5819e2cc7351bce44cad

SHA1
834576a0249147766ab13e8574a5ebda6797c360

SHA256
3f1f5d98547573e34c975c18e136c62d811efd250398c566e3e5d7cd3148b615

SHA512
bfed8be3d70314ca91b04558bd5b1b88dabc0119010f8dfedd18ba2769a4be977ce2400b4c6818891ca570650d9c75fa467c8e30efb05c6826139c0d346a366a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
9d040611d9c9cb5df717437143aaea0c

SHA1
d2c5f70679259a3475c563d87d5d33eced7d0f91

SHA256
b6f43c633b37a5e2d16fe95e37cd23f940e612066db79fa23ee0831e780c5875

SHA512
f22ad8ef3b50774071a85fad11c8022224adaa66dd15016e28c5b6e6aba78147d25057ff06108c15e3ebe376731f88c60fd3ccdcb4f588aa5090849ab299daad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
6c681dbbf1013df351150d939f5c3aee

SHA1
ca8898d383fcb940ca67261ea2c679038f140cd1

SHA256
3e096f8a2a7e70a7d960d221235f85f41c9f630ce3ef6dbc6314036741fdfcdc

SHA512
d82fe61f6d8a63dc1a8d11383c7b07f87637b21f711a2dbd642e5101f690994143b8e21805f0ed5b680363f87f5e0717846546d0015a3af354f3bd614ad72826

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
a99e18b06078b334292a3ce9464ac7be

SHA1
12a2c9b3bde668f7a57af43ba25dd8eb9f4ba718

SHA256
9f1a17288fde441d44d3b24b030262aa3bc1b717cc4d4a3dd23859a14fba72af

SHA512
aa6255f8c46b8d2a7e53a9f30c175df731f8e4661731a5ab9d6df4d046ef07bf9bced4e53c41b32b697535949f289a88b1c19babb619ca6bb4618be48108948f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
0921dead43fa0c6c3a9aa143d1cc54aa

SHA1
c7cc53b3c742f08615fa7b4c5684c9365d37923d

SHA256
0d81cf48afe8dd63adfc336843afc827e0edfae9d580de6777482f9ffdc7542c

SHA512
838c533871dfd3255e6a242cef87222f9f4638624fc90adb8b39db05744c4b5031dca6495bf4300c9881f379d4e2f45ac1cf983691c41adcc2b460b94d80c1d8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
06a701d83d01ac88d241a5cbc6d64c20

SHA1
3d132c1b359f317056e19ad05ba27ab62c0d1848

SHA256
ce3d161012793ecac79a8c8c811e38f891890591ea6240128d9580b820aa453f

SHA512
bbd99c50fb53c03a4bd17c0b81cab4d0b8a2b601a9f1d4baa7c99cc9f7e07b41aca47aa10cc88375d7181b41eb046e8c729a79ff7c75b3d19ca6d5ab3fb73eb9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
bd2b4220f4e239a75208e1bfcfc39aef

SHA1
c36f9c1f76802d4bbb8fc8106d4cfc548059087f

SHA256
591b8028f90c399728654c2d5138a3f77cd9d1c7a901c84a1e04965966df2f32

SHA512
81a541ccce20bcbf44252bf2be7474e66235118e63c8bbb21da9908684d9e889978ca92d413a2fb885f4604dc72f725d69ab906fea4fd6ad855ca5b2a3e5a8f0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
968ddd71addacf438c73fc947185a7f0

SHA1
f5656fe9e1bffa39e6c69ae17d8ed98e5d28e97b

SHA256
3350f59247fd2a843389c878d228a4d0f95cd4d0867f48aeb9c9e379ad589a9e

SHA512
dd0c6627d4cece91f58511ce09686781af72f87eedc6b32c69b54aee0b603ad9ac147f5a7b09c049696f041841f6c664a3441ed4dac3b45fdf134235884c59ae

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
b36d90942adc9ebd0afaea4d323862cd

SHA1
f610dc1c40ef710bdf04d6a145718afdb7cd1479

SHA256
59c6e803bcc14d8818cdfb14c70622bdf730043a3148c96c48b3e2989ea85744

SHA512
ec2ef77230abf72706ac6b4ad528b68f8e7b5359438122cd2271572e8aacc1f70d04294cdbeeed28036f6de54098fd92a95497736116cfc92dcbbcf7ebbf2e78

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
e145f1609c6738f37f2939f6ef87209f

SHA1
a602bd1402fb2d21bbf4c9ab913b95d59dd80fa9

SHA256
a72fca0f1eb7b4835e974e17b46b39edbf5d9692d995fc5d665b496bad579296

SHA512
9cfd037320009a8c4bfc0da220cb7f64ef57113116fb60d61fc48194bfb419efbe458e1be74b3f447731a241f649734f3cfe951262bdd0a893d10c6de7cf8a03

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
2edc0b8c6cc75837aa97ed539b05e927

SHA1
a818f54f27dd5b2b461add235fe83ec56affea56

SHA256
39f2886650509bde289cbaea6bf028cf7e6175d807dfeb6cb442a0c9dd931cff

SHA512
c77f668688340d479f7d19b44591f44315fc021f73b9b81ffbec3523f4495817d7f8f8e1f1173ec75e83c0b771d938fb3c7aaa3d548cebf49a28da04a24b2355

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
0fd432ba5508cf7f2ace04d3d9574d45

SHA1
6cb6d3f1fb6b1b4d8c2ac40820768001b6133adf

SHA256
a5977834c368fdd909606bdb8cc173b6ef6803063c0317f933fb422d17b8300e

SHA512
e5ef5590074ff88ffd27d105e9481151a61f15becdfe2470518e540c653c9acee0be56a477461b03b5c472214585498c3757ef276556e98e3fb04642f559f889

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
67c2f0a6f117b5350b74353aa5453249

SHA1
4c618755c77f5a559ef047d69f25ca549621e488

SHA256
4a7b31a87e1206bdc59abc429357eacd4a8c030514dc36f52d879b6ace1574bd

SHA512
e99e1c1c6abb37887ead36820ce36ce0104612eff129dc01a88e8c7ccda4d4f7c3b70029a7b822f0c18ddb862ab80672c842a274c7b67d13891c8e09e3e82180

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
bded2382447a79a4531bed7fd3841885

SHA1
5796c0043d3941f85c4b5f2ed47ca2452591cd83

SHA256
1436b905061850336c3fae24115c62e08646c0e7cc457a37b9916df71f764c15

SHA512
7899e2a09be7f8715e1b8df1f55b295c200ae3926d60fc95d0746a8e29443f79852da8748195840678e7cb5da52269276a8e61bc23480d990fdb0316a882ec28

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
883b5513083d4eff41c48f4c92b83a6c

SHA1
d08884e1477d7b0a7fa4c58e169f8651619900d8

SHA256
41e7704a6834adf359c223eb7e2aabb8a6430a84f51b787db5e6c39ca17a8a8a

SHA512
44cd8466ef52a6e7aa2fa103cc3df0f8efadc322eaf98976989e4866d3aeb4012e716201900a98be054a2233cccd514dec287ad20c6b5c068a654f42ac370477

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
49B

MD5
31dd84f2873edd77a1d2afc4fb3db204

SHA1
a12a06cb1869cfe6f55f17dca9e4b907637dde48

SHA256
a7fddf140498fc5b8cd1c25babf073d10f635190b873a9f636ba7eddef7d6b60

SHA512
d1aa9dd9063714b7cf4688d7783aa15b1d65bd2664020fec06f1f0c01784c24d756b19fec39f62fa8c830d9e5080e55deb3629cb0986d7f0dfa986dad986fbba

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
7c2cd93886100224f7bcf25f40b903c4

SHA1
396961880ac1ed25c10636ed156d479c39ef8f33

SHA256
90b71a305c7d512209540ee0bd26bb385d5140699acfc09f776c1bfd44625c12

SHA512
1d254c85c32a25354f64d2db0820e784ce92b6b0a20649e75f953dc3aa8ff9083620934cd4b873590d394e362ade6ed2b7b4775e9844724714ea735d79b84a4f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
fcea660be688452e2c274bf37f19bb63

SHA1
07d2654fa890a98760b726ad37b5667d03345ad7

SHA256
258979840542f727685d807f467a941307b4f20128d5dc812e030f4545b08b7c

SHA512
b4d773ed7668d777881b1a6fec4ea71be23e7293c32f19809b57855efcbe1fc217b59d63b0618ecb374bfc9ce207c6a8f2ed5a2a747187d9e0b9407860a93884

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
a729af738655e2ba2258f50e47169049

SHA1
dbf070bf81e479b5bacac1a5706d1c2620386c43

SHA256
9958611235183b636b50d02e85b1a3aa9a07a290acfabe381b0b37d10af8bbe9

SHA512
377d9cd60e969cb65fe13a047647c28b4c7cebc34b2171c0dce7143f79c79cb12187e1971c8ff0b144987f4e366f63c09256f4882b9af616813998eed7b94f43

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
69cb72ded0283f2198cd05b219e28ec3

SHA1
b96040426a7f7a6f7ebc7b44986d71ec718c1568

SHA256
acd6ce9b4aedf156c09f11aa3f7c9a36022739579d2378e6c1a51ad6618266f2

SHA512
d25e51fb37adf31ec3d71e6f6c35ebd6f57e7849ab8f219fe1489377b5d7f9b2995a979474eed947f5ee7f31251e8643ef69a2141ddc8cbee928e61fd1a180e6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
0c9d2657deb3dab0cb4d7c71be3a6504

SHA1
7e9179dfd17af3dda0618d8d0c7157fe466b6ecf

SHA256
6b5a720dd4f4858cf2d624b062b94c1621446edf4a54994976372a878bcb1eed

SHA512
e052ed915a4ada3670390735ebaa6fba7062aded911553ac6c0dbf005dd3bc0394f441f91525e6c24b0afbb933f704980bbdd647f65bbf038827cd4bdfc29b1d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
6a77512f7a8c84d94aad0f89e7e0265c

SHA1
09fe84a1284f758ab766e3e8f9122750808850eb

SHA256
c4e251dc98b2bb5ae310b5fc3e6509ffb1eccb40da5aa3a403b5584d685fe0f3

SHA512
17b854c3790787be3801341df7465de528dd26e0a1c9093ef7b8bd103d0123642f9f554f348eef1ad8fd7297bee1eacd2e6d07a2e658533f75ffad46a3315408

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
711c4282c3c91192825bacb51ba18b72

SHA1
e78320fe0591ae0249c197c701a4c42c5d975a6b

SHA256
573db3696548f79086e13e58491f74ebb7a03e0d6e32324895dd176b2d621121

SHA512
9fb56591ad456f925c196afec291cfc0bf77377d9b89a6f04e92dc2fcfe42a05200e3e28eaaa731014d022fd4ad22e39697c07f60c6408ad58b0f7c7e6d818e9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
d2bfbe9295587d3186a2afc6a00b509d

SHA1
66d1fb64a881752b04950fc50a0ee7b1e15733e0

SHA256
786a6a6c705393ab3e0ac3d948aa3c85761a4053d1b592ef842308049a92fa25

SHA512
2a4ab37895d53bbf0d5f99fa95a271a928b284eb69e41e1be04632ca515ce6af924ef5334d14d42582c16255adb8829cee4ae586185127bcc9f89610a3adcbc3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
c0ac1e83a11e7fc70a87269593434568

SHA1
b19edc952fd18d0e08ac5d42ae323a9dde3fb936

SHA256
ba1eaf2ccbf704117c8c9ea8723d1226695318cbf4cc4796b121e5ae2b686129

SHA512
def048917b3fd92cfd7836f8f54c47d2c4c6fe463a283c693384d76ade7799df2776f55294947401496cb599d23e0d0c67bc9e6027f901e89d7a2f2d8bbbc4f9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
c5d189af2d8b5696cb2d2ca4689f8661

SHA1
35b214ccadb123a72952af3a50a9b0297c3f5127

SHA256
5bb5d1f6623387b663753e37aef920af0e1040b8aacc004bc837e9d9bca397ce

SHA512
b8c22707b2b4c7be1d875284140a84724bb7a3c06e3ce0485efeef7cc7c426d491fc05cc56b677dddf596f2bbfc3284e75fa8307d9d72c12eff14c96d1628cad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
678aab4cd35502e8aca3f3fae6a0d210

SHA1
78b4a16db8a68b6d6bf109e506b0b640407f634f

SHA256
76d87738a5f6f1469b685a532251e8fd8e86769006827ea601130d3bdb40f516

SHA512
d743d777a698bd8932840c94190f97831370377488f80ad6386cf00111e3bee3d98be4e65de2a230b8c95e4f555eb376b7dbf18943a4e696d580cac1e0a0c71b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
84f5f4f00158c3806f18e269652c9ffe

SHA1
50dd1bc96837c38a20283f792bac35de53047154

SHA256
901211fb4843aa48e74466be65b859ff544e0f9807aa82f563f575672ad888f6

SHA512
18d4fb5bfaad20b57a63618eda2f59ab26742701e907d1d6834de4ac16503e3df468caaa7b9742d46134af0869c3ef3c8342ef252d884cacc79e8c021738a820

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
7113ff941581d685c395c826651c9b66

SHA1
31d253aa523f5064db19429fc18de4007b1e00fb

SHA256
983055729e1d53375bd6a98493c71a7d5e36f6149b75644181cba9f3633bbfdd

SHA512
76e73194fc918ad065312d9e5334c9268ca4d0ef68748e50c1d52f9c0f319b105c8f201cd41332c1cc845a5dadf5aae9f5a792d7211812b0993affa7b395a90b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
0d6e5d6a5e82b2ec599e0016a771e3c9

SHA1
b7a8b3fd432b18f16d788beed1f076fd542edfd9

SHA256
fa86956fed6a512cf5134b384a017c13de9237b6628c3f3a2b4198511eafdbbc

SHA512
6e3654a1535bdab655be2c13068878a1677ad8086570547ed435d8c4fda468e7ce8b7e7fb7325552226f24f505de7624bf78c9ec980fb409258d7fc624d8ea5f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
7f9a3fdf526dba1d8b1a7220a7fb1897

SHA1
91cc315e1c84c516046f9ae1acb405b506ecc009

SHA256
50529e2a5ba65e5f2d320849e9cd1e98cf4ae89c062d0059f40e41932a2d069e

SHA512
c1e842f82aff73061936bfcaa30190d34f979b856ef9a57206831a92cf62f50270ab6c2e07c224042fd22a5cf66ad3eb0b58cbcaa28f42e981b5de96c87c98d9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
ec50d1cdf97f0d103a35f88fe62e36fa

SHA1
9ff9c5c7dd641eb1fb52d66b4b65908950be708b

SHA256
8b3e56fdff4608c85cff17b6b3c26fbf7aad3b1c5c14e2b79ef14c845a3e9043

SHA512
49ad19c83870a5fc7a19c9cf870a21deaaaa309be8e7f42c47f10112620c100f137d992e3bb2e3f614212fcecd7a01770163002b36e459d3cfa6aa712b23c685

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
8f670b66e2e798da8beac6fe0f7ac47c

SHA1
3121b017bd092367017e4bab17ff86e1991527ca

SHA256
6a6cb9fd6fe73449d60c4776e0231e71a80e134b35a1309da131a636f73b715c

SHA512
be951af29cfba997be8c6c910bba8b80ce8e8d46709f038139724649874456bc62e7c0a0c7b75ac13b3697a562ff96e021f6c9604df87e7650a1dcd689b5a0a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
99da6eea91824fafb8b93e0bebaf632d

SHA1
e50aa605bfc2b1ffeda722ca6c88308e6f2f1911

SHA256
83089636d004caa0037f21526b2e1947787390d143867671c155c88ebf0888d4

SHA512
a428465730b0b4f16860e2d0fa76871437c0909035ba1bb2d0a5a18946f737917bbdc0039ec293a4a25beea348796e7983923224ae22d19f7b9d8243a28c794e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
7d6e077ce111bd910e9f9960c4860071

SHA1
d60392ef0a04178c83e1f5858a5f5770b6e53ba7

SHA256
0b5070df976775ed7116fea3bdd1553bbf75309e08ad7134b26c3b763db57996

SHA512
73db765b41a1aab1c4b66fb5c96f9efb4552ae2e02dab50ea5cb4726fa59c0ee55a72c4b85754ff3793034c17cb32120a8216b314cb99255993f55e5d2f7a971

Download Submit
C:\vcredist2010_x86.log.html

Filesize
80KB

MD5
78ed8cadb8456c1e1e14a2ee97eac28e

SHA1
4cb9ff25e16619ce6b387a78c00d41066d3bcc3f

SHA256
84e5c1d563a6635b10c53ecc59d3b58a8d7cc3ff49dfac7d2cfc808fb7c61b62

SHA512
dcb4b82bb91507e0c8db2fc83b5de363685620a8b6e208cd3aff9436f32f08834ecc6c82355d6ff8a67c7177460bab9631d2ad014cad4009c531bb50ddcb6c58

Download Submit
memory/1600-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1600-9143-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1600-9144-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads