xorist | bca7b6aee28bdb9e76e868af12c1f59bef0aad5d53e2052fd5ea516b70a221fd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Size

91KB
MD5

169c60b6443a0869888bd8531bd16860
SHA1

66f17dfe56695a72df59218908d31b94e07f9610
SHA256

bca7b6aee28bdb9e76e868af12c1f59bef0aad5d53e2052fd5ea516b70a221fd
SHA512

70721de477ed8e4aae17d05f1f01dd2e4cac2aa28323ef68dfa4005119f29fa546f98466b5953b4d1014af1074f0bf75342931e69112c66d6372b6187ccf0ce2
SSDEEP

1536:YORS6106666666666666666666666666GkB:pT1Y+

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2124-4-0x0000000000400000-0x000000000042B000-memory.dmp	family_xorist
behavioral1/memory/2124-9020-0x0000000000400000-0x000000000042B000-memory.dmp	family_xorist
behavioral1/memory/2124-9134-0x0000000000400000-0x000000000042B000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2199) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l81BIMUhkx6s92b.exe"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\hpsamd.inf_amd64_neutral_84ae149ecc9f8033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Reserved_Words.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netw5v64.inf_amd64_neutral_a6b778ba802632cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\oobe\background.bmp	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtdkj2.inf_amd64_neutral_0cf7696e2236ca4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr008.inf_amd64_neutral_0540370b0b1e348e\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions_advanced_parameters.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_type_operators.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr008.inf_amd64_neutral_27d1c9a28eac4eed\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Column.bmp	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr002.inf_amd64_neutral_ce2134188ab21f59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep004.inf_amd64_neutral_63b22bfb6b93eaba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ql40xx2.inf_amd64_neutral_b95932400326817e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Assignment_Operators.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlucnt.inf_amd64_neutral_642a5ab3f2a1ae20\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Assignment_Operators.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmminij.inf_amd64_neutral_7c300346e830b2dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc003.inf_amd64_neutral_47e09b7cc0d9e993\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_WS-Management_Cmdlets.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_wildcards.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_methods.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NetworkLoadBalancing-Core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_trap.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_profiles.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scopes.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssession_details.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyxel.inf_amd64_neutral_ed1f16b3d0cae908\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmega.inf_amd64_neutral_f9c441ed24f00358\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_debuggers.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_scopes.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00z.inf_amd64_neutral_aea50acf04a2db1d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\synth3dvsc.inf_amd64_neutral_bccbc5fb46a05558\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl002.inf_amd64_neutral_e204d4267d752eb7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_modules.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Line_Editing.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2124-4-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2124-9020-0x0000000000400000-0x000000000042B000-memory.dmp	upx
behavioral1/memory/2124-9134-0x0000000000400000-0x000000000042B000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\System\Ole DB\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_windy.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387882.JPG	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_RGB_PAL.wmv	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099155.JPG	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\buttonUp_On.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tt.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746G.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\babypink.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Mahjong\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\browser\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\39.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB01741L.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\bandwidth.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382939.JPG	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-hot.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Optional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21377_.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\THMBNAIL.PNG	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14869_.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\sd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382969.JPG	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\15x15dot.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\LAUNCH.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-background.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\Windows NT\Accessories\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0387604.JPG	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsPreviewTemplate.html	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\38.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Library\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_widescreen_Thumbnail.bmp	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\or_IN\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\COUPLER.WAV	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_ON.GIF	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_tr-tr_4ce801e2e67e13c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..ruetype-segoescript_31bf3856ad364e35_6.1.7601.17514_none_32eade0d03ae2a68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..emsupport.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5ba94ddc6968b7fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\403-19.htm	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sonic-directshowtap_31bf3856ad364e35_6.1.7601.17514_none_039bc6666639d183\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1705fa7eee00a599\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Cityscape\Windows Notify.wav	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..r-name-ui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1522a221b71a5bb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-msdt.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_432aea5346a5738a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-t..onmanager.resources_31bf3856ad364e35_6.1.7601.17514_de-de_5c2bf034a17a5b6a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_moon-waning-gibbous_partly-cloudy.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..qlxml-rll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f361dfb4637ccb8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx35linq-system.web.extensions.design_31bf3856ad364e35_6.1.7601.17514_none_080c725aa9b358c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..inter-mof.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c57c8d348b11f375\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiaca00i.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c0839d0f508d2555\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..up-prompt.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0efe910a20ade7c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e686c340855ae9c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-x..lugin-mui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c266b0a2cb83705d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..eprotocol.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fd4cc85296b4e888\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_split.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnrc005.inf_31bf3856ad364e35_6.1.7600.16385_none_227092d2a7af4a58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_c118196b69901962\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ktopini-accessories_31bf3856ad364e35_6.1.7600.16385_none_480c0d8bd31ae43f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..andprompt.resources_31bf3856ad364e35_6.1.7601.17514_de-de_d898722b014e4052\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..s-package.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_291fcdc47374947b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tcpip-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_32fce046277d287b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmtexas.inf_31bf3856ad364e35_6.1.7600.16385_none_05cab1c7bc0a0a83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ystem-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_5f405ec67f38d749\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-appid.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9c7424fcfaec8d6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-aclui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ce52f37bdc6a3877\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_black_moon-waxing-crescent_partly-cloudy.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_6.1.7600.16385_en-us_569111fc82cff9a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Linq.resources\3.5.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..izard-mui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_77155a8084ff9c21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-wnewue.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e8ae675973298a07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_cb8b658d143b76f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_Throw.help.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_msports.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_92d1a7c00a2dc68a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data.Linq\1efa0826492fcfdac41786f53d12106e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..uggertransport-1394_31bf3856ad364e35_6.1.7600.16385_none_bfc048da0d93859f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnky007.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ec8bcb2481f4eea3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\flyoutBack.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-winrsplugins.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_b81618a9cd0f7ae8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_es-es_57e82fa3584ccf8e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\DMR_120.png	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-opticalmediadisc-api_31bf3856ad364e35_6.1.7601.17514_none_14133f190e6d86a7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wordpad.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4f62d31eb392bbca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_hiddigi.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c1b1ef2fad69c67c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8ef6955b846a9670\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7601.17514_de-de_4d3b7dc92550052e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-r..ne-editor.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0a82216671c9b806\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..izard-mui.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ea6a9156bad4ae9c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.4940_none_88df89932faf0bf6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_hid-user.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c162de87050a6649\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-snmp-agent-service_31bf3856ad364e35_6.1.7601.17514_none_5faf9128a3432508\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wpdcomp.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2ca950a644fd00ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..iewer-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_fc3ac73abe9a97ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..utilities.resources_31bf3856ad364e35_6.1.7600.16385_it-it_74dbcc4d41ee8006\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-garden_31bf3856ad364e35_6.1.7600.16385_none_f7a4bf1e15863e21\Windows Pop-up Blocked.wav	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-u..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_de-de_774a8826c5baf766\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wcf-m_smsvchost_perf_c_vrg_31bf3856ad364e35_6.1.7600.16385_none_9206172424ada22d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_beb1ea48766179a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Messaging\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\ = "CRYPTED!"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l81BIMUhkx6s92b.exe,0"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "HEINWUGFDQLEDIM"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\DefaultIcon	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell\open\command	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell\open	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\HEINWUGFDQLEDIM\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\l81BIMUhkx6s92b.exe"	169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\169c60b6443a0869888bd8531bd16860_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
721B

MD5
88ea7ff802627f22e5ab0bd38ff32481

SHA1
b800121671ec35e864c6c1e35bbf1cce1679d23f

SHA256
a873697e74602fec75c20846c0fd0c4778369ff9e2d02cfcb89e657b4addc1c6

SHA512
0f8ddde276aae0865c64899afbd893936c2dcfccded526a600f4a743a86c9fc1697a1c15ddd4dec83aed32d8a7884c5e5ab8274868543802c3d21ce04d9535c9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
f35dfb1953d9001598b8b12fa5b8b801

SHA1
a8e16791cba4c80b333ae9c158daa47d0e77f26a

SHA256
34cdb7525b92db73c4c78cd6b18015e7551e31ff03e0a4e8e01d81287119f66b

SHA512
8eb769b72fc420659951e6fb7e65e0192e0ee9a502a4760e33d2f46d0f73b6c729c73dbd11213fba60b840c3cb01ec67cca21107a80f130ce37b0762f9e8fc92

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
700536dac1e435919eda4441d004e8eb

SHA1
7aa65decf023a0ac7e451a2d746cbc9f79b53163

SHA256
92e83efa809c1b7e7ab9657895b944548f50f48df39b6975cfaefee202876fd8

SHA512
30b40211292bee3b9c6aef525a83e5a3b48f47aa5d1394720255d4003bf99f73a86aa319a704c0b5918f2f1abbe7bdeba340bee599f15789e261e481e67c29cf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
8672fcfefe4c4fb31802e76763a39db6

SHA1
0f3822d69dbe4470f4e5a387dc4583b9ddb2fc9a

SHA256
85f385dfd9d53553bbc4dadaecc19ef8ccc6a23b05d0af72ee688af10de5059c

SHA512
c762eddde9ffd5d6f130f60c937c82950abe264237a8acfdf0574b114fd6ba7975ea07ad52d8b6802dfd6a2d7e506ecb00b482a2e5241f2ad997fe303ee95c09

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
da500eb030764f10e4a2114b82c6b1d8

SHA1
e75fd062a113e68a0582f072722a55ab1447b5d5

SHA256
4dce156ae3c4aa8c4b775f34491df82d6e2e0bde7e30dc1bd0cc92660239fda4

SHA512
86cebfb875a43fb86ec1b1069f7959a3029e41ba5e3762a9e46a259d8cd8ca863fdf9ae9f8370cc29ed6b647d6a88e47e39febaae839015c06bfb7cff20b5da1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
2b725ac2904d5e89654a9d45d641da8c

SHA1
30a72dce3094f464f02016998049039caf6d0a4f

SHA256
e7a006c2c92f0be3d4cbc89a7a6050be0b3621ac5bb76b9396b85b7e6b595285

SHA512
baf41681247da189bb76b791d62c5bb5948886063dc463cf138949a94220fe2700f19945382e00ff96eb732c6cc8d22a90e49c9761e4a3be19ed7c5048f9cc8d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
560d8dcfe47a4c6a04e1f073db255199

SHA1
4bf1404198916a6df2d1a04ed4097cc6d8d2c9c0

SHA256
81d5a8ddb94c5736675f87f392f21a89f0546f93d71abbe0abf62297c756c225

SHA512
378c9495434ab36b7832d06e3615d537710cdab302cfe2b0cccb40591f52b6bad4e304c929be999e3b78640948b1a78141449df2f7cf97ebf08c3473e9807996

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
7ecb3f5a78c805d60050d7bd64c358a0

SHA1
86f3266634f2d1bb95385c01cc67a48d4c85d7b5

SHA256
3e74afbb94da08391f2b0ff1a2c0761b9fe608da19e5ba6ab335c735c6d4e79c

SHA512
3a69a177ee5cd14ea009e3eb704e89d30c4f82e188c87fe6b9eab42b793d5ed51168153a62d32a4433c4774cd939b3a5eab2a645af1411077f0c6d718de1c181

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
2abc2c3460414bb1cce58896815b175d

SHA1
0f05819d5f493774d17039bb6a2c542105966ee2

SHA256
5a18c3fee6f91aa9f26575d2c2c0740aee48492db05a7d2841e8982b8717e7d9

SHA512
19236159ec27bd1cefc8ebc3f701faff84b1b9ca87bc3488859e32e7de5736a9f5c275702b3a21fcdae8c309fb03a3b761885eccc65a9e4e6e42462d19844532

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
09bfdf276f870ad59002af53f2155703

SHA1
3d78f93e96164016ed497b17489114552d5b0567

SHA256
06201fcd532902673fffacad3204a5857fd482af824de810223759ea2ce7d8eb

SHA512
d7be04f4fb9755b275a59cae36831c9b20998119797d3ececbe7e5a5714b6d07e74ef64103fda91f29f2f1a880b2513d4ec7af0b0c3bc60b404dd50b2e4c74a9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
39b0aa12b048790d4162430ff26a02f2

SHA1
d17dc7d30997ba9f4587056a0d8a29c93534140b

SHA256
65dfdda714d6c214868ed971a8bb1a0dee816fa9764c0a2f3267380ba3c36d2d

SHA512
7896b9fb7bd3b2dd63b6664c1c01231f70e18b15fc368107a0cd84853671d3e4cf44eb1f4dbfb7052366aedf5e2db70c8b335e06f16006b609e81e977bdb76db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
3c8c207cf622ee3d19295384eb6d4ce8

SHA1
dc3893f3abf8c5f59a24633ce0352b501a88313e

SHA256
844f7410aa04fc96c924a79f7f42aa4e7c5689fce41aae9cfd295b2b3ef3bec5

SHA512
93513448feab65730a93c8d8a015d53f7f479c7efca4d21c5ba64c5b2b16ac8238fad9b5e8d5cab26149c806e0dbc6c766ba25b5f59a45d5d716a83795547e2d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
be123359210d49a0215af7ea82277f1d

SHA1
e0e6daf3f6a22824da7b145685a0ffd25ba588db

SHA256
9bef0312191a23307ac44eb9c286ea5f87ca41ffdc52f090ce532199d5d7e9d4

SHA512
50f1dbf2ef720bad2ce2534b629a659eaca5ed32040028b6d9a5e2a734da152bc352b3028bd8ed6debbbc55673731238c89c0c498ca39bb008df48b450f60f5a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
c6dea96d529ef88c6220c5e3922dc6e7

SHA1
e9ac8007e5e5932362255fb12aef79f3d6fe5b0e

SHA256
0434e142916367bd3500f35a69f4736171003bc6db772dab4254f905d3dfa1f4

SHA512
bf8eee06daf70afa08b3cf06073bdb263b3b4d2629902873dc150b503baee569104a74f2f9a3918aae3deb1e197529cdc3a122654f08f309954cf2fd049fdbca

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
854e14331f9acd486f1ee701d2781df8

SHA1
36a9fa7f3a49c9e8ead7a093d314585b17e5fa09

SHA256
de008a95ec00c26c81f32de54a9b86ca33140c2dffa333640dd0a027725e34b4

SHA512
29992f965cfdcb817737a52b101bb0a791c3f559b968661d85a3bc0ee96b4d24cc5f111dfde2c454a0f4bbd522a8e2723c1bf1d5b850ed3be44a9d56fa1de128

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
efb0021a5b9471605fbddb0b390a8407

SHA1
d6560e4705a2c085610ebe86aee4e7c5ddf1d00d

SHA256
630b1618dcf520fccc021b6c42bfef16382c659a5a8f550aae15a155ecde77ef

SHA512
ab16acd10a5c07b011f4d1f6baa33441be756429efc4415332ffbe72b04fdbdf38a44925e7bad2688e1f23867d982d80bb176425873d67fac1d317760c1ed260

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
a3f4785794bb13809eda11e0d76042ca

SHA1
eaf97aaaf7e33fac3ae8ce994de5c9abb817d906

SHA256
d7de72148fa64377165d864b207dae639f5c6cd4009237c2354cf7340e36ce81

SHA512
c255dceb298b4180b8785d6d3758290cf448c48cd287e905345ac13ccc62cccc20bcc5ba6ffa483059f822c0f19cfa602895139b13fac2ffdc6445c0964f41a3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
6d55fbb27f83a014fbf55dd839bfdbd6

SHA1
03ddce6109cb614c62d36ab452208f5492fa5604

SHA256
4fd1ee422b4451c219a58fd5ac6d58037eabb4f8180181a13404dfce198a4837

SHA512
b2707272ff503febcd4f012627cc03668a09d7cd46baba291dc296bccd440cbd2f13afd8b425c69cd8d54901bb79e9bd47beb99c9d20d08a131374c0e0c374a5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
f2549b4751baa0b47b8b9fe971dcaa06

SHA1
c5b829151b8bd2c8c416d16f7ed39f4472985df8

SHA256
90a186316d1e4b37974296dd87eb4e5cf6de89c35390ae27d9a3db62476e4c94

SHA512
827783f8225addc22b5eb47cfb1ef2713b8822d04b129b6f603647c6ee4749887cba72a29a433c94481e0654652e85fd797aa392cea633a2a6d5d407fe5a89e9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
850f45fc23fe517d9b7c85e01cb36b04

SHA1
cb8f0c18df4a16d139b846f526f6ce89b229588b

SHA256
efcc38e68a0075a99a25d7eea6aa1957f4a84c17d086dd5b30ba0ec28e00cedf

SHA512
fdb82c59cbbd7fce1f45f4a7e108c46d5ac1f708d69ef70547275f1ff5f4996540d2de8cc4674a62259bf90442ad60134334c801833a4650d3a7aab38719d52c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
da9cfd4e4d391ac2570961d62499abd8

SHA1
2b3fc25a7d940fc1d205eee6ade1da91b370993d

SHA256
dba2c286befc9dccce3cc2bcb715666b00e8b339221fb7dcf32b2e9c0daf036b

SHA512
d73d05ae28e0861f04c8c4254d143d7e44c172beb84fd91469ca1a659daea2aac9ef1f20a16ec4204a256528ac62dff6713d8c0f1e843bddfa978ee624e0ae3f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
8bcd4b3b23ee01a4efbc8e903ce58177

SHA1
9edbc4e560701b35a56af9daf5c752d9bcf6e293

SHA256
63670af284ec62944a08ce1a2b97d6ed6df5cc0c32ca50c95588c48d4dc2bb70

SHA512
0608d4bbfc9d6a61cb1d06b69ff67fa587ccbc983a7113386650a1bb9557c8cef99042111755d46cdce59a8f7ce009b5e59762dbb2f9a52a2a227846972c6ec5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
aadc5c5489d559c96c7dc51fdf02e84b

SHA1
418e4c3ed815a76160b9247ae7389e3ffb30e284

SHA256
dbaec0cf2b72a6a4f37fa72cc7cd53d3713a87b4022a72368a11f0582b7e1d05

SHA512
a0ab266f606e7d0de36b10c998c9b684ca54cc21abb1c01a837dd17f17baf1d8de905f06a4486341421c18d2eb9aed4b98b89a52586f5edbcbba8712e49038fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
8e855e33069f88539e7149c492d8c835

SHA1
9f02095e5fe59d1413f413324d58f0d234ef544e

SHA256
829e78b0f0eb90c57209aeaa614f0ca788b13f6e54d4d274ae039175d91b2f67

SHA512
b6d912e4841c6d494581408e21f97291950ff67c0aff6833d7fd5efed6097494f9242676e1e1a7958f47a5f26a460b1da53d5bdee676c6eb6827cc2023790597

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
684334b949e9f111c116252283920713

SHA1
81a9b165c65102189084320a86d8cfd9d71d0916

SHA256
c0763fbcdf0d6db4644e09590e2f4dc4e58f9a5816fc7cea394fcb91f6e77088

SHA512
fa1524c7e9563e9f7115a2588563b1a44828e62973bbe943877533c9af9f7a585b510bf21f6a732880fcd18c08a6f96dbbd2d43c3572d3f7f35962bb214f2fc1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
10e1df4ff3c5127b0d6bb42fdbaee9d5

SHA1
c84a897496693cdad0872373f2a18cad89c9086c

SHA256
7924bde3e9da0ad40419c248e93d3ddbaf315f386c9eb9bc4024f7afbd8b3442

SHA512
274ae68fda0c110b3fcff37747b57664ab9664f3daa51a6424475ee8a8aaa98a2f9723ac420b61d243d2b794a9f17e801b7a57c29cb61c6068575ec08913a32f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
6d37ed4f70a2af29d9960cfc4112db7e

SHA1
b210da71b58cdb79a50a2fef7a5714bf80a4110f

SHA256
344ec240bbb5c1e508f60e2736ed2cac8e367483d99a3ec35a400f30b064f4ca

SHA512
a4a116d13ef4e13a18f4b02c06cb068d879079d09aa98bf56c1da68fe2fde10f4e104a59d976bee7f0543610f6c536154e2d0937e335c6090b54de840a3748d0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
aefc826318efbf52ea0a6a93e7f6e0a0

SHA1
1f480b97687e543b16abdc09c1d5cd9d2f51759a

SHA256
79cc350eb68d6148c9d9edb2688f37ced16e79e42c26750a15b2454621739818

SHA512
cf4fead7382ec29b048bf6dc3d702790089e052673bd2fd3af39a05e6290401c6aae2aebfea7778e0f61f36e52dfd4f379d522e4263cf213d3a8b03db0e94323

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
99396462b435f51e531f78ce6f2a9b35

SHA1
ff3c4a40efc5081b926d41a06685d0a02e1dbb2b

SHA256
9569389a656e587531cae9e0db8230e8855da3dba803402a1787cb5c228dcde4

SHA512
93b7d38433940b80968e8c02cdc65a46191c5ea04da8b3ebc0eb3f81140fd9d70d0754154fdfb58d7ade3aa12771d93359622c04d41c8c26550b6167f4f57538

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

Filesize
3KB

MD5
46754c7cc47d4efe1f8d5a14b4e67c04

SHA1
e21eaebd731ebe7ff8de52816818501bc7bc9d90

SHA256
527bcb41dac57e3beaba8510499f1186c7bc701f548099be01d9eb70726d5b36

SHA512
7abea5afe714221fa5d73da87412c116928cea10b0dc90217d41ae05dbd3c7b338a7dc0a940829d9a368232c67620eb19db3d40e7ca25820943354e6c5213d8d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

Filesize
462B

MD5
18fd19ee19e345a6b97e956a27bd21b5

SHA1
bf4832d075bd127f98db5e1f0d90ddf801473ef1

SHA256
61c779feda659a7e92b9d7dca2ec44b826ae9d4f3de2462baea6029b1499ddf6

SHA512
70127ac3ffff744c487e8d783d3764d6cf3a22c06cd8e6adadfe375fbe71145c51fe387011e8939430d7912d47a4efba05036dc8d22aab28a3e6f407c081c3c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

Filesize
264B

MD5
248fff97a046ce581274e7b56f00cf0a

SHA1
7599ef9bd32c2f74c1f2e6c9703121d8059c415f

SHA256
19d2e2258bd7e55ccd676d0aacc7e4e4a18b86c8d8a831d95cb37307d3568af6

SHA512
9125a17dcb61e9f5547b3ac8b67a1fbf19a1d300c17d75ae8eaa47a3d2654d7ec19bc214586ae13f791060f117f8bb3a6494c061a8440b38bf6a2817c99a547f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
7bb5acb1527f60f7f5e722eab80d872e

SHA1
fcebb6ade60767e923a3193d0ffa357143464abe

SHA256
fea50aa0ff5ffc7f5a721937cce84d99a450a39a5e301b2b89bb6c015f0f7bb0

SHA512
d1b343350d809460110bc34c7efa651ef2263059516ce3013ee154fb74dc7c826cec1950a47d928995554ce1ceb461416088eab181c51f2e07049e87708c01c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
493c79dcc142d7a09ed63c9747c14e1b

SHA1
24b31a6a8960367e175ed2bedef1984a09f12bbc

SHA256
7c3e910f7a0ada3f5834473d25e446e18a63401ce73831b588a6bde0a724b538

SHA512
c9e1d6eb9f7867528d207ee0687961a882887bbf67429a07ded322322e0086b11a594537ecef77b3cade832904dd32e5e34959fced82a1e0ba6a8cfe8604f505

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
3d4e31b5e986970f305f1d5c04874ec0

SHA1
c07196278d1e24b04ec400b0e7fe0c50b985c992

SHA256
5f3e7fd002b9a5f59c1884bf91cf79c2ecd6070ec64a50fd9abcbb1730b58cad

SHA512
33d165506a760b3f68f4a16861a950408f789ada8956c356f4400443ef7d6c62d0e74f7e6324e77a33942c3e1dec7a9c9c433ff37860e598f3bf1a2d552a00eb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
d94ae2b8e1f5524f41970f16ed66373e

SHA1
2eeb1d227cdc1cd493e6e9c54c081d52ee628d0e

SHA256
306079c36bac579041a2fe0724f52197f997a084d885653cbb49eff8e024554f

SHA512
cdf4455c7155183777bd6867f616fc937c5fc3c2a257f4a60ee50f801c5d0fc5853a35b60451bec52e7c5f35858b8a3dfcd5726d21218fd71263c50d38fb1151

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
7e282761c10e0e5aa0a8006f5c9384ad

SHA1
139fc02e05c8f7b9743f9dada9981787ae99629f

SHA256
267c19f599f511a979585469cffe4c7d8379ca0f66c9da0b6b7a3b97a7dc502c

SHA512
47abd6beb623f28a16b1fe39ea8d40516f673086a89c0de9015aeb1aa3c42d3eeffc0e34d48e7d559a8d4a672775a22789f8a7bf54de96e06ed4a9e1855ab6f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

Filesize
26KB

MD5
4c1e4bef8c698e4f7fda669f762f438c

SHA1
2e80689181e96e53ad820ea7f0665d8bd200ab39

SHA256
df910df78f0344e8cfd7c7c6b3cbf1b6d2109afb463540305d67ee5952827cbf

SHA512
09ca9740bade4f5ff6858327faa3818bbac2fd2076d5d083dbd5eab0fe13b8c15aa7af8981facc38a9f948f805e43a8d0d7a45eb67e9976e1e3dac94e808016a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
d397f78ce5fbbce5390dd4f6c52c8af4

SHA1
b25e8ecb27dbc344462b1ef9db7dd5a3b297f965

SHA256
b0cf681e654ae1cc756307ee3bf1c719c048c98490d18b6c0eaef25c5035b68d

SHA512
f5f4cab22a38a666b7d275b759ea2a96fd0817d9aa7d31447c23c709bf035d935101c38d8517f31ed5a88a19557d316be3be851b459ebe4b0a6ed96a787dabc1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
f349191b89a06bc50deaffc7f1d520d6

SHA1
faf98bb51a40b677568fb08e186114383b500b21

SHA256
eeba4f16d2eb65f1d656053cb80b0b8d27e677b7e8af4a2f1ac594a96bdbfc70

SHA512
ca6c70fb322259a49c543184deb4fffff0682e24861e128b56363ef7d9c548475609f8821dd382ab707f131b7c5c284a398132cd5accfa0ab17f8645c78926f4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
c81b7fb3c7196c4fa00ceed2078883e5

SHA1
2f7649e994acede754ea214a3a55a0fcce1a993c

SHA256
7ac3ada2cab3b9123f1dfc2a7b2283410c79e85145044965f66125bf54b719f1

SHA512
37bd473de9b45d0e9785ebe37a276f5101eaf6942712daadd1c5486359b87be0a9cfb939ad743dc628f5373b8c5e40dbf444cf52c05289644b924bf6f020e95f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
81686243f5ee576229622fbcdca0673d

SHA1
68fe8e1a19e925647a9d1bfb71a7351856cda981

SHA256
e2c7c5d0f8d91ebc35881ad057451b3202f08be31ae21a039a93196316bb6646

SHA512
b3513fe9b4d63ba075c2e3dd9f335ce4e203375dfca8f5785f26c085fbf6541b05b764311d1ffef53adec1701eaf07de7def7458c61b0f25cf04c2a4b298d10c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
225480af79fc07090d67d3f6d363c827

SHA1
1c6c89b774d4219a1ff98d7cfd7711643f67b584

SHA256
41168c1ad999deefd97a09bec2a4005aceb08ecd9ba9955c8626c22d1df7b910

SHA512
3d6cb44cb22598bf69498b54868c12b5af784855f7482e6578712b3bf349bd010cd3959f83cb5de1cfe36e622b3251fab43ac5f74156e1b271dc3b221cfb7537

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
78b2fbb5cac836bfedfb322cdb673aa3

SHA1
9d508f0c17bc946820b70e8104d2f68997b98bca

SHA256
8aabaa83e1ef4edaa7f9068d6ac65e9510abd49460a50fe4a77b02457a0412f8

SHA512
7700e26bebb97649b3d99cc40bc0e353918834cbcc8af6a45d944680ea55746ab76a4068d998110078d5657c87c6ad892d4b9f0d9b9e566edc44b9162b9220d5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
84bfa523af6ba94168d04335abc8b719

SHA1
e725999d695a15d8832a33bbf8dff7d68170a5ce

SHA256
5dee6a2998260cc9cb67f95096b203287f5e490aee46fc46b7835eaed5c9e214

SHA512
45ecbc19f61949a680cfbf88e9ae338e04f342b196ea31fc5a2eda460fd083dfe8c0d81b80709331b369d9401129d4606892649ec44dc65b83682cd15fbaf7d0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
0d6b24fc02bccb403352efb05833591d

SHA1
8d9ac4e9482c9c85c26f48c79815c2a62a3da7ce

SHA256
7be840d04bd11c702b8e289c4b5d2754b9c709dcbb50f20654e7e16313403753

SHA512
08c618b6117711a5e8c025dccaabd1ddae611d06c4a0b7d9f0b1ca75d9f5695c4af3999e826ac93e93b497f4ec06ec619e4966599cb8b880bc37a89b28c7bc63

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
d260dcdeccaa0f64abb68dbe64bc8eb7

SHA1
7ce86939e306d0fa28e3b41b80be05fd5f17d189

SHA256
35e76d137a16d672f436bfdd98a42e0672b376ac37a5c5a7b72b55be6c850b03

SHA512
c89f0175fb072e6d9626e0a0a68b5045c686e2bbaea0719d6708aa741a93cabe49ab2d28f4bfe4dd8e49c7fd37c2f306a110333b9300bf8d12ae6e48d986886e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
73d6e148d944f4a794bf74d605df8efd

SHA1
a5026006f58b6a8a818e1ad3696961d04361734f

SHA256
af00bbc3fa491b36a12836c67ccd9ff1b710bcb5ba4c58fb768f0635749f5cc7

SHA512
82d416fc8ec0c506a3c82ea08b93d88a2266ca8a0c04da2f4131a3f8a68af95c0ee41af09ed1e7d52e6e4e0b62f0f8f37bc9fbbdaeec67a0fb3023017ddb6f06

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
b65890db1d5ddfc37af63bf4bb98777d

SHA1
a3a3ec88dbdc27bb2b0864b170a9f34dd97647f7

SHA256
bfa692e77c84b87e0c5fbe1c8d21534f025607009b070f0ae8fa210950b2a7f6

SHA512
03f659d888db7e5c2875860ae54956843829ae32c395c0b120b569137b0b02b27a48b23876d2045312b9f5c03a1bd925d1ce5c584aee4d8df760a616bb2adca9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
b8e9488037e502d3dd66c3c6045764a0

SHA1
47616e2d51ca35b5c552cdf7148241e437ba3de3

SHA256
41e85b0454082f8e2d4f52f0c35269e8076d3329b2e2aad7b1bc47a75af5ca0e

SHA512
76b07ba62e5a81c74c9a3abc130d746711258f40017a7b40b6390e6ce8fffead2e762c53bbb09562bba064ca4af363f78dca6c32f0ee3a0e42039e573c4af703

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
20a1d0b9ebb23ab2030c379b08ad03e8

SHA1
4207771366e9f913aab68fe1bb26854053444c10

SHA256
b77ae5fbf138aa8cafd8f52839e3c96223821a524417ecc0d4b174d05fbca15b

SHA512
7cea6c043d10a336f0269e534e3ebcd84d4e277b9553871656388aa0a8260f5103bc1033228df1cc281b28c0c1be521574fe5f564806ef88244c7d1110c2a84c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
1a09fcefe9ab8bf4f058b64cc47181a3

SHA1
93cd1d9ffe14f9ef07e0daf83532e95b36b8ccb3

SHA256
70ba81799aa6c21b9dc2656ae15bd70820fe860bbec02f6272d2935f17f57c70

SHA512
7775e26e0e02452d2c037f23b9734fd95fa1cfaa2f7d974781174c789f7752ca65bd23892ac424183b1112780bd287486a80e48d471f2ada55f96c8fdd1ae594

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
d80df3c2e187b7f5ea53bf68d8c91255

SHA1
8064265c81535fe3437ff63636df1f3b0a8b954e

SHA256
7fbf8c6602cc73be22a997aecb1af13036293ef6191699f9d3b51715f06d04f7

SHA512
17538b5dcb75a5d6ff279abba1b5ce2a46664ac450da7f21fb0215ac402e5db1bc1caa5d0047251633504e0522a29d1f294d18cab45483eec8b8493da367f0b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
6ba1f4d8b9c2810f6520ac39a02e7502

SHA1
18d01d3327e71c2184270d29b17afaa2d6a945cd

SHA256
2c5a53c7fb6fc8563a2f6327c87981074ac517f6aa66dd855120a66dbcc73603

SHA512
e6ab60a3da88fdeffdf78d53164427b9d41e47b093569be6c32e2bc1376325f45f5f61fe4cb7858828b67745e7229bf9610de3d080d5abfafa63851817e86b83

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
a019cd04f064e53649bb274f6fb54c5b

SHA1
bdcb0824140e49dc0c8044982e3e6503e693950a

SHA256
39f1a293ad75eb751525bac475830667433c87473548e9504987e2811b420c47

SHA512
4790d4eb5be80d43ef68f7f624e6aafbfeaf4a99e2d5c20ac585d82929d675802654bb3d7d1591c8f8eaa99dbde9e8c9ecc60f054e0383632ef7e415d6ae57c5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
a6f27aebf368ae10d84f5131c1562382

SHA1
140107e3d48a2b12badeffa2e036c925371d2d3b

SHA256
7c95ee32ddcada7600dd240afe7bfb08acfc51e4b081e382506408d9c1d30c92

SHA512
8328e3a68d9eea081536ed0161218c499492b83071b6cbd1f2dfb7d6a5a9167d5c1e8949c1e1ae386a45f0f6ee90ae019966683a91259944c001d2f018279af5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
7ef9d284c5b9dd52624b4c858c96ac0f

SHA1
46dab7591246999c2eb0469ea642b7e0f3a65615

SHA256
418eb7070ef4d03b4329a310a87c3a464392852e0e23d805240595c7b85e17cf

SHA512
31855dddd672a46fab88edb6828d86a8b4a31d74303db0f5be85739fe6176a4a1a9d8fcccc8e87e1be8ff09ac955f76bf537ae9db3cbe92cb6decdf3c58536ec

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
4f2957bc47fadd45c4a9549a5b279f40

SHA1
4321a93c13d1d6f0399802a551a7f3f56b623f58

SHA256
11e0820703a4ee46bd1707bc12d9afce07b019467d9ee652647b981355baf14e

SHA512
f73d05d489dc9007cc343abf68992eaab9ae37ec629a4294f88e48ae4e25fcace892e84dfa186e89b7b3ffdac75e95c2a2395d35718c9951cfe81579041cab1c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
f371fbc684afda0d15ea5ee8ce3b5c25

SHA1
96efc4b3b74c214475ca35e801e540aed4020a25

SHA256
b4140f458f69dee57f3a4a8196238e516030abbb8bb95f44e2abe7f0002b0e1b

SHA512
326e1f288462974040af64f562af6ae94c6224ee00bfb7b7dd5cf836d657a5851318975c42625ac60c86fc8fd86788a367703329d21c77df525a49d572f3f374

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
f57793a8b837ec45939193bfce203993

SHA1
c79ac51f0bcecbd8b0de275e1f450fff456143e4

SHA256
8eb2133d07ccc4e5de807e790d07acfc22711fa992aa8ef4dca3be1208bf5fa2

SHA512
113b1f77b25325626da1d51a32d88fc2953a62a8e503f637a711505bff2576443240f9fdf23b2df2e56d419ad3367759f7e3bbb5890c9da161a6a959ae08bf9b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
99b2dcc227db4e77406ac7ff32bb0b52

SHA1
6aea162254ce67b3bd6651668f3b37e0bef4d663

SHA256
6375d48a114d4f8c055d53f6a7adc4a4ea30b88c5ee3fc1d43a362f381a7dea2

SHA512
4148962e626ae1ab24787a5c39ec7f36a5943d99c2f37d8b2c153be80c4b454a66c62cad373e9d560f085c438425993101ed31e9c3e7e939f32f34ff85f6625d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
933a5c7645e84b4f52025da492cd70d9

SHA1
37eda4e9ac960cd5974157c97398d70640496d85

SHA256
2dcf364085deeace7b11e4a438f30bb6196dadc8c579fc88b19b1eba55769053

SHA512
5b916ef871f51639b3b055690c2a8d11e790170b5242ab591edae0ac042634b4eaefcd4758c1775c54d1ef5b59baf82e7faa85fe1e5189751f88568dc6f99a80

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
cfa86ea0e1d35250f2fc9428d16411d6

SHA1
309e93bdce9592a85e96febf11b6c71940ad0efe

SHA256
e5d430d72d2ab7482011f08793412791fdafec752a8061671202f54cdd5b8a72

SHA512
dd3b01be1d6bc5130e899f4b27d108de9d3b1814291960c307144925ccdd9e402e40697b922c279f35bad51358b328301920086a03f7c4b06606e5c087dcf0a1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
b42501ecc741b95b1bc4ad7942f5d9ae

SHA1
e711d511fde1bc4e23fa5aa4f0a1c83a6abad861

SHA256
8a208678629e0b18915bc011aabee1458eca56a59d59c79068c32bf01eac4c60

SHA512
ac7498f660ce78677314901b714ba5d0107f7b34d2ca837eb1f6fd236e5164e2951404b76c8099e7fc57d08cd783b14681ee85a4f1b026bb21157ad56363d7af

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
19a73cf43469281307dac928795a3e42

SHA1
98607c9d137fcea4730500fd59faa298437412f9

SHA256
996985021181dad6e425cc0cd10a583da74f7bf3a1f821a2cbb9f2496e3e7103

SHA512
1c55e7386d729b3a7125ab067961ae446a31f62a328c3ba0ef81c53b77526b212df1a47b3625ce014be917505571d991479824ef65b8094c3e298f948b961019

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
dbec365c6bb19f27ef9e8a22c704411b

SHA1
fa0483e7394ba3a049ea8c73b742e7bafefdac6a

SHA256
c1dc2fa355f27a83cbc456b5046e0e90ae25cffbf87bcbcad472cc4f16659994

SHA512
4e87bc291b40ddd7c44bc193c2221f253a8d0f2dc898d749298eb237dcd4b69cdd64199fbdbda17668869c5d8d9ad1752318e7a29c064bc9c43a1933a95c55f4

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
9813cb9e0442a5cbe447944fa2581bfa

SHA1
8e01f9b56d1039f3a5f7c658bd2bdab84bea3d55

SHA256
fef29567de5b4c5d08d604676ecb57ec5933b1a5ba0c2a54bdd54474b31e9e41

SHA512
f85b01be64ba12767a7427964d30bf8f00bf8f5037455876a93e8adb78e0c58073c442412a7c85a1379c4ff2218bbc525d9bdc11a7f7fd28c4e6fef2c956da9e

Download Submit
C:\Users\Admin\Documents\UpdateHide.xlsx

Filesize
10KB

MD5
e64da67709d371052194077083ebac8a

SHA1
6ab4ebaa80021c66df535f201c803f58e97ddc0f

SHA256
d1c0fd1eb996f1c4bcdf93f9afd6b9898b52bde284554e74766be5a1491e9abe

SHA512
3285f8d30eac73dc509c5d635fc5ae099ce01bc7a5301f8e4a0d35b8d587ab3d7f2313504227b07cba3f47f0998221a46884bb859fda7b9b1ed593ff83f93fed

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
75e152a6b732f31192212786bfd8297f

SHA1
a3c272185e5e86d83d0ea47288d6af48cb5ecac3

SHA256
0c9fb87d51d7b0758ebd6e7db158fe2ef2f08d89c91cd068cd3aa854568bb217

SHA512
fa3a52fa1d0c92132fb13be32f4cdf9a54866be0f6174f5f6ef17162679c375913d056f0c504dd104ee2f232b64a1eca0036b04546f237e70d974bfdba1e1c91

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
6ab46028c5b7fd35c044a9c54d00d750

SHA1
f3a5c0cb690f9b68a5b4d5c71699f072978c0cc1

SHA256
1be819f2c58d17bfa94581ef586568fac01ae2e8fe32f7426818b2076933b48c

SHA512
5c327889e75880fe2432acc96125448471cf336a3d6a5b9b446788fad8d21b25eda5a224f6dca2b85d7f9495a94656dbd82837c6d37c65ca32e8de190e70339f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
600718c3971427ce6476e439db78f071

SHA1
c3ae356d864d467028a9efad4995692f4841add3

SHA256
3a4576eeabd59361659e35611d85139e705c81ef8221e0936c477b44824ee04a

SHA512
53b20135e9c42a0db75d9b95093be71e9665fc51a13bd558443dabe14d411c48939c45119a855ca7eb16b1c76b4dc11d019011f4f81096275c99fa03059a9d70

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
628f0b4765bfb6e3a230c437590b41f9

SHA1
466fa721797a80ef0a6f2da8f18739488cdad0a1

SHA256
67935cb7d52d4f421ddece5765f2f43d96395211d281203b3ed3c616525a100a

SHA512
3a198d29091432579905cf8f679dc293c71f0e330145cf37cd1612d3cfe896efe288f92aebb531901fe1f36507cd80e34e4bcc09814d29cd5ac31cc7d6eb222f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
d615d276969884952ce87c67118a41b9

SHA1
0ad0aec79205408ab57bdaea49c99f0565fa3037

SHA256
d86dbe2af66cea2da74d871eec69b24b002e07a2139f9a6ffd36290221c3e0e3

SHA512
9ef02ad18a3ab27bc9a2984e4e928275c451843945dcbfd8fab319b4dfaa70e00eef263f8e2a9c9b6e515fdd363f359de2d624de0dc649d23ebcf91f8867e886

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
811b4e8a8d5bef2ab9dd1be9c903f5b2

SHA1
59aafd95fc6c200002af76b3bff8c2ddbb506bb2

SHA256
2ceb8ec8b6a939de23d40c408f39abddb9724caf13489271537af019ad7124d8

SHA512
5563be58833113b2885e0a9ea73f51d9693b483ddff60e062edb327b6978541c0385c4b76bdb7fe5bcabca9862ce87a3f448148850652ae8b5ea2ec8c0aadf91

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
e4cb5308b5aefdbac9ee247ce3381bb8

SHA1
5ad7c3d62da38d9140c2172120f711d9cc3d1fe0

SHA256
3a7b2ab7956ef0a5a73df0a12984b11a0c9ac75c69b2bc40b3138677a73d0118

SHA512
b43fe1a025507421de502582fea4ae446261414c590ddad9a75960b912242045ab919d38e0ab04f61cebef24fc25d4ff87f594ec8a3de4d347f0c20bd39aeed7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
8bf81a82cc12a3779f68a519570d8ec0

SHA1
3d4b1312eb2c3632a1b01467c831d58c8e33ecb4

SHA256
63ca86f2dfa706253cbc2ff14ed575d5d106a80cdb062354640c348c55c42c47

SHA512
6c389892fb9ef37799c32a8626b0619836b6b96e9ccf75ef86872649f85870a3a2008b34d5112480372eafb1d44bd3cde16c554d46bcbc00490517a4d5c1d4e8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
53ee969e95afe028440facef2871cc63

SHA1
89d4065c951c0b46473ef97f4dd59dc8d18fecf2

SHA256
f392bb17ad395c842b5cff321a7a739ca3d2a83f12ecc96b4b033043af82b64f

SHA512
def5e148894a6cc433b2cf588a40d9192c26d380704d3d87b19cd2f3430addf8c0f7a4f796e0309cad5ec425ef9c2252c36cf15073c418f9dab8d09c3bc668e5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
597fc4347077ed4316567e5a11fc4fa6

SHA1
f4bfa04dab1d4c429d5e03a77904df5024db58a1

SHA256
2e9a586450da6bee29ae6436613357a248d3e06472f98bce9a835f34aeb380cc

SHA512
b768af3183be5e651d4575df11184d0028c4f9950aa0c2984fa949029ae72907955857209d607d92b3af122bc5a035ee7bdee51e357655e5c0c198e544dce421

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
83e9e928f05d3a8d6ed8be8c38c25da4

SHA1
29b984742af19c72481839aeda41f674fb75c729

SHA256
b69df59d5d4cc434118ab0a9ad33c43b641fe47feac2526700785be4b271387c

SHA512
cbb1cdc61fe34f5e7c4f0ff256f4ace2ffdcf3537d10a57ef89a1340c70e41b0b4a345ebbdb827ab51741e0d25c509a67fde5a184804a6bb83fa7d58b93d6734

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
1a7cf73985099e9d554ad7b09e1a43e2

SHA1
0a6f3999ba1c9716c9b513abb90c494e62e61e53

SHA256
97e6cccce3f5fefa227cff96114dbedc0c5b16b5d3b1b518b4868cb69c4277e4

SHA512
868a51c1a5295b297f8b9554518844d5a3e4a6a2922189c72e319a7003ea74f754577229a9d7d97ef4ac4c9db901f94707de0a9ca29095d7d17bff8bbdf5d413

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
3bd2cb33bb8d59c06961274ad4b1fa59

SHA1
f027ceb3b40cac82c989f29299dfce0fce6fe01b

SHA256
2c64ffdf6a3479e005f5350b9ffb92c412073af5203b44f9252c343300370e9e

SHA512
91200b121ec91019c54047df362e85d9bc25e005511d2006fe4d537f13dae2a872eb3a2d5938578fe199da21f2447baddb1cda107ec9e39e2aa959408ef64010

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
966413d0ca7695f72f1cb83c1aef0511

SHA1
7eac563330afa21627eaf45423a7f7214a41fc05

SHA256
8209ca6ac9457a135baca662c510a5d8f33ee89fe5b93e69f8c18cc42c672511

SHA512
87ef3718ebbee87f02f1448fc8708840842d80b6d936b0a531c9dfb3a823971f74196def41da1577d5b7b41616d68f5b835d35e95d3adbec5c228907238ae808

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
6239c41d3a529020ddb48a97ef950d82

SHA1
b3a3359c5f48321205c348c1da79612e5214c5b3

SHA256
739b98a468758a8982f5fc4972311cc32d8c4a755fa01720aae2fee231ef34af

SHA512
99a48d2004a1169bc31c5f84c77320c666b5dedcf2176826962a8694e33872dee82b54fb2b71a3d17a6490e75f65199b3f414633bded96ffaca60f61ce28d5ab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
faad4eeddd14f043a91b2aec5770cb78

SHA1
c4d484a54ffce8f5a177c30567be5b913bb2d8fb

SHA256
786e9d80086d2263c6faa92e19ad3acba5fa81c89fb015ecb7b2278e394cf062

SHA512
08ef8141533162cee0e8ae77d1fb56493db2c3f5e5c61b849b5e434a8dcd12dea2e01512f8bdd78f6d3813f2b050c845c6d8be0d59c5ff18e686f5a400c1d3f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
ee1ecf066fc4be14503a615bb25e3b94

SHA1
1c4419044fdbb1938a24a42bf32ccc416f6c3ee1

SHA256
63b68830541fc6a828c1bda081bd4bc3463629e2280af8dc2cc02dc44114e336

SHA512
456560324604e6ed5e0f29fedfb8735c82576aff831db74cda85e1a40de6e54843741635ab26c8c1a8ae70ac16e7e05d8fff45a342027216989320d3ae55a790

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
787552227978bec2dc9b8602a8d725f0

SHA1
6951c6545809acdd35212b14ca6d30b8381f05d7

SHA256
0d9bb8a961c38e968cbc640fd9fe3c7731b527f3b4bc5cf97768fd98aea60eb5

SHA512
0092f38af9664278495d023e5a22d9757312f1d3e0c97212bfc06e2ad5cda174eec2b69b86e7706cf9519bfe5fd1d349f816313f9736371f809e986e5848b5d7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
0846142707480fc4b4431f1beba76494

SHA1
5199bca70465cae12bfb763651c39c351cb35183

SHA256
040002a4c56ae38fa7bdd88c5b863edf56ee84ba46ce1821968633c65f001301

SHA512
f7869d9f7ecb2560171b26e6d09f75a36905ef05cc5473133aa7bf26926125b60b1ae6e483dee7da5afc832be3d590234e28910e8668bcd2751c84aa24193e82

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
792fbe57687f65326371d50cf6289a66

SHA1
df62e3ad110da0009281522f0c7b3841dc645121

SHA256
dbed30abf2f86986377e6dfc3f0010c1b8e460b8ff2ebd1c558c0a8e706bc65e

SHA512
dabfedb07b97f46cd1b23ea646c85b2aafe5db5803fe9465d7a0ee783a9f2e313faa3194382b2173cac4adc78b21611e9c09df8f90c087d4a1f78d7bfbc462a8

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
7ca4fd8cc3de35ae16610e5ba176dd42

SHA1
9cd7970f11fdd68b059f45fcf5821b66c04b095c

SHA256
19974e5a60571a72df8bbe8d11076478e2350a39cf81b2c284525fd38820cef5

SHA512
a10fba515a0e006f64b25df7c5f85669baa624c458bbf885c54b0b5c519c42fe98f82e4b840fcf9019345e0f9fdb1fd732f77b111350f8cdbf2b3a56778e3cb4

Download Submit
memory/2124-4-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2124-9020-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download
memory/2124-9134-0x0000000000400000-0x000000000042B000-memory.dmp

Filesize
172KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads