xorist | 119b55447703c19541eddb96500760104893a136faaf87b46c2871c5a1e7d926

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05-10-2024 11:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Size

7KB
MD5

177068f72d69a4594bc3721fc9c1d6f0
SHA1

a24fe2857a2386e2413afa1c7476110cfa7319b9
SHA256

119b55447703c19541eddb96500760104893a136faaf87b46c2871c5a1e7d926
SHA512

de8b5f7155f330d60d17d07c6517285638148392c189e5c8470e1ded83ccf16b10d7499cb2994aed5d514d5fedc980f72bf7901dc98d62e8220abea6db3c79d3
SSDEEP

192:czdrrOFG1WDCgmjPZPxLTLzdtPJftqGMUA:cprrOgkDCgS/HTFtPMB

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 5 IoCs

resource	yara_rule
behavioral1/memory/2696-8908-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2696-8909-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2696-9197-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2696-9198-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2696-9199-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2214) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ckh95j1Q2bHKDZy.exe"	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_WMI_Cmdlets.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky003.inf_amd64_neutral_fe7ea176f20ab839\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmx5560.inf_amd64_neutral_e853cea0022c059a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pl-PL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\channels\OCUR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_output.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_neutral_c239ab5d36a3b3e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_execution_policies.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Special_Characters.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_neutral_aed2e7a487803437\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc2.inf_amd64_neutral_7621f5d62d77f42e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky002.inf_amd64_neutral_525d9740c77e325f\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Special_Characters.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeiger.inf_amd64_neutral_492d4e047d14bde9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmot64.inf_amd64_neutral_1abbad2f29c8fa08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-DHCPServerMigPlugin-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Core_Commands.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_wildcards.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_neutral_54948be2bc4bcdd1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_types.ps1xml.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_script_blocks.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_prompts.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hiddigi.inf_amd64_neutral_12aaf5742a9969da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl010.inf_amd64_neutral_46f466c9e68abb4a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00l.inf_amd64_neutral_f1fa021d2221e2c7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_WS-Management_Cmdlets.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Comparison_Operators.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Core_Commands.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Networking-MPSSVC-Svc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidirkbd.inf_amd64_neutral_2b561a02e977e2e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fi-FI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_troubleshooting.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_scopes.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx007.inf_amd64_neutral_0b796ee4978458e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-ndis\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00e.inf_amd64_neutral_0a4797d9b127d3a7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-IIS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cxfalcon_ibv64.inf_amd64_neutral_d065aec3fcf4ec4e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxfx64.inf_amd64_neutral_3336ecb2950fdc45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Variables.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2696-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2696-8908-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2696-8909-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2696-9197-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2696-9198-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2696-9199-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\ta.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Windows Journal\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\macroprogress.gif	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\FreeCell\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_pressed.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115835.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_dot.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-disable.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\README-JDK.html	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_ok.gif	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14753_.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00103_.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Services\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\VisualElements\PrivateBrowsing_70.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.jpg	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VC\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099198.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50B.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR7F.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_windy.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\ParentMenuButtonIconSubpict.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\SolitaireMCE.lnk	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\drag.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\logo.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\videowall.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\PurblePlaceMCE.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_bw48.jpg	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02074_.GIF	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABOFF.JPG	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\1047x576black.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..-statusui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2cb8073d65a4a823\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..on-common.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f7423b7635ef0882\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..ement-client-v1-api_31bf3856ad364e35_6.1.7601.17514_none_4623a247a9e41c27\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_360e4801750ca991\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-x..nrollment.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a946f0dddb83d182\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..odepage-57002-57011_31bf3856ad364e35_6.1.7601.17514_none_3b7302d236956600\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\SecurityAuditPolici#\7e530f5e8b7aa2d04f08ddb9a1597007\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..hinese-imepadapplet_31bf3856ad364e35_6.1.7600.16385_none_571e064f15300c7b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-os-kernel_31bf3856ad364e35_6.1.7601.21863_none_6e8a5c3d2bac37e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wcf-m_smsvchost_perf_c_reg_31bf3856ad364e35_6.1.7600.16385_none_8c4294ee286200ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\AppPatch\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\inf\usbhub\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_crcdisk.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b101c5afe5ce5e39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..rotection.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1b92e3b8a9b2f3b1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mstape.inf_31bf3856ad364e35_6.1.7600.16385_none_89fe250f2f057e08\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..utomation.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fad628a6865fa618\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..xthandler.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d4db9f9e61ef1da2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_32b04bf58a01b6f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netplwiz.resources_31bf3856ad364e35_6.1.7600.16385_it-it_17fe62c09f16de60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..framework-migration_31bf3856ad364e35_6.1.7600.16385_none_4ce62d7fd1cb54eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\47.png	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-tapicore_31bf3856ad364e35_6.1.7600.16385_none_4a83748394a862f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_47f32bdf2bab3be3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..-etwinstrumentation_31bf3856ad364e35_7.0.7600.16385_none_a5c694d1e97ad4a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Navigation Start.wav	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management.Resources\1.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a0b8ce5c8bdc72bb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_609ccbfc3879b51b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.powershell.graphicalhost_31bf3856ad364e35_6.1.7600.16385_none_3f6d939064737a81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000465_31bf3856ad364e35_6.1.7600.16385_none_44fca9fa7cc56c13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..registrar.resources_31bf3856ad364e35_6.1.7600.16385_de-de_cf7bd7e2d47f6b5c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\microsoft.build.utilities.resources\2.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servb00a6512#\ad984d55a4110a6602766230dad1b189\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_a697016fd7bcfa1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ork-msctf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9004e99d9d2151b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-a..cing-infrastructure_31bf3856ad364e35_6.1.7600.16385_none_0bfcc31f07a61f6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Calligraphy\Windows Exclamation.wav	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ion-agent.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0432f296d313ee9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.servicemodel.washosting_b77a5c561934e089_6.1.7601.17514_none_926b6eb99e01f9ec\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-t..utcontrol.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_00ddacf0b41e954f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-crypt32-dll_31bf3856ad364e35_6.1.7601.17514_none_5d772bc73c15dfe5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dot3gpclient.resources_31bf3856ad364e35_6.1.7600.16385_it-it_018676e68e1fc109\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_897e705b17c06c94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_volsnap.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fc02e5c66519f4f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Ref.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ed3c551ce72d5eac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cryptext-dll_31bf3856ad364e35_6.1.7600.16385_none_ff6918de770cb659\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..tion-core.resources_31bf3856ad364e35_6.1.7600.16385_es-es_843505044e632a49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnlx00x.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d77096a8d47ef589\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mmsys.resources_31bf3856ad364e35_6.1.7600.16385_de-de_5d24c4b394c3c0fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\recycle.wav	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_it-it_31f2bea73f8ae0c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-babygirl_31bf3856ad364e35_6.1.7600.16385_none_b2bd01695c9021fd\flower_trans_MATTE_PAL.wmv	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-parentalcontrols-adm_31bf3856ad364e35_6.1.7600.16385_none_e781f92c9603a93d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_it-it_16e1e8ac01f98419\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ashared-candidateui_31bf3856ad364e35_6.1.7600.16385_none_293ea1e3e6bc5364\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-eventviewer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_af6b455d40c0223c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-mreuse.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fdac51847f332122\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ndisuio.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4f5709eb6a463a26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-raschap.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b97ec357ecf98240\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-kernel32_31bf3856ad364e35_6.1.7601.22091_none_f213e511864c70f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_data_sections.help.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..localsessionmanager_31bf3856ad364e35_6.1.7601.17514_none_036ad230212a39ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\SYSTEM.CONFIGURATION.resources\2.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU\ = "CRYPTED!"	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU\DefaultIcon	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU\shell\open\command	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU\shell\open	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "DBTZXAAQUGVVXRU"	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ckh95j1Q2bHKDZy.exe,0"	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU\shell	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DBTZXAAQUGVVXRU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ckh95j1Q2bHKDZy.exe"	177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\177068f72d69a4594bc3721fc9c1d6f0_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
69a98ef655778f1cb3764a923acbae80

SHA1
22683321e95c9a631039d15fc49ac5d3e639ac54

SHA256
2ff127d5bc4c7333c8f522aa4b456684eca97c06d452bf7d00b6a99b49b11b0e

SHA512
610fc09f40124e1a74ff303ddd95ad5809679be9e0c381e5d367ecf8e1e137c3da188142de7a2c5fe2b1225e12482245f2b5c417d43d73618108bfb1c32a5ed2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
c4380db909e395abfabfab625d296c6c

SHA1
b122a45b77bd837ae0bdc64eebc49dffeb9f2d3d

SHA256
edf8aa2e20a3717a85fe7d757dc31edadd2c447b971e58086ce76de31c57ae9e

SHA512
c5f33faf32af9956bc940c3f0f6b05226681c106e22a8f98258ff3a0d97a3e62a4049ecc3fdd44aa2b47030a29b98c064eaaa6b3172da35675e37dec7f7e5927

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
913028ffdf3ef365561ee799f746259a

SHA1
c3d748297b30d68c2878b9deca98ad30c2db6e32

SHA256
868fd842af72a6cec2af1235d330f9d3fab3dc701a01526165bac4b415346449

SHA512
b45ba7917f16f4eceb0544159cc711867817dde66761e851680fe2c411aa3bf1e81eea6a1f1519116f95a7655203bb1d59f2d107314f0645f3e62417a7eab829

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
9554981877f4ed6aef0c9720a3843d7b

SHA1
86f3958355ee593f7b4f82e5ca2fb5c4c2052b0f

SHA256
e23d3670146faae7b59070e51bb191973005ed08c6679c9cf9c12d1fa66e9620

SHA512
82c111b264560e38ce6945525ad12cf36fefa227e1c9cd90fe1f74d9fd4dcbb8600f1b5e29d3754606bd1e03b69858c52bb7599d40935fbe3486a132bfc0f82d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
ff6368bafca6771044ad315df8a665cc

SHA1
9c7d9cb6a06d7b0f462f60b698e5269d6da5e679

SHA256
55b7bbe569f6e18c737c2287a7d8388d4ed2fde2777e9dbf433c8fc42ab20f12

SHA512
f29cd0b0b66f571a852e492dbca5e007da9ae1ff0538872fcc5c3eeb5a5fd22ff0c5d9523b405b1cfcc6303d46a28a54c72d42f76c1b838acee38526592ea7e6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
dec7b928736d5542c8222fb8ed53707b

SHA1
354b39c05f8d2a41ef8b71746eddecb322ec615a

SHA256
17074d5b568e8ce17e2e6bfcb027780452fe463f907ca6f8bb5dda072fe40b5d

SHA512
f215fb0907bf46bdbb60fa77ef5a1cb0f2d4d0dbf70dba180abe0c2e6dd4e43330cb95bf208b04e3305658fa7748948ef131a38d8a9c460c12ac991901425e0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
f517ceaaeaeab7e292cf7ead36fd4220

SHA1
cc016cabcbeb20b52a52973a13632ffc319c79da

SHA256
014bdcb441b9cf542281f95ec66ab4a1913b2efb973a370c2027d49eb0e475e6

SHA512
7e3f623afba72785cdb8f3283040343ecc668841ea8c99b9763bf1abcc547a01d110c88952171db2fb70491ad4a5e785a8d6f11b696a4e48eb83e60f67659eab

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
c32ebb4c8a7c5f8fbe4b6281f656d734

SHA1
b078641804d961b375e8aa10190680c2a08fa470

SHA256
79194cb09d9ca3869c0f0e27fb8ae82ad30763c739d5eab7743b12748e269254

SHA512
35f9dc14c7224618b33d0f782de50a3d5e579670faaf67dbb364f4a0bbe6379bd226bb14bc5bb295639bd3055372d7994a0b7b043611d4535cbdba184f1056b3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
7b23067c226e78413620400d3f583a8d

SHA1
f7fbb452bab9eae05818659b165a116381a9efa2

SHA256
f80e1bf465b270cda8b90edcde0b8993e65c6f69f36d4342a66a9df43e8e0f97

SHA512
9f586048d44e09c2aea6791d2a878c3c22ad5ab6323ca542a08d9104464cabb528103c32dbf7e7c39826fd5968c1f6c6ce19281fad50ada00598c1e8443fd747

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
05be6d36c1e94a83bacf36576bc9fdee

SHA1
44642d027a8456034bfd6e2aef1fd5339a0550b5

SHA256
256d1d53a03f1e2299957f19f06a4457a71066479bc8b7e3e13067641c15c513

SHA512
018c640358c22bebaf3bb73bc04698edfacb18adfbef9dc951a92b47c07cc4665b8fbf538d89a91bcefd58be67168470da2f7af8971dd1e47409d56cdfaf7b87

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
d83183fa335e42aea49c5f18993b2ec0

SHA1
6e7433d5ce96245d9fd769778dad8919b66ea3ad

SHA256
1ec6b23da8a72e666b1aae4a78d0a2320712882fb80501e2368125b331bbe1e8

SHA512
41897625d2c672772a19ee94d0c1f2f09f377b604aa2a2c1a4504e122cba7f5640d31e721d1c13c49b60710a37ecf17f191a8a97ef2b38998771730ed46260c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
9b04eea721b82efb079085510c688230

SHA1
ecb37483261af74e6e141f9a57366898bc8fabc4

SHA256
624bb0712ce21ba603728d7a03736d6040176355443066f13031a6454c92d0dd

SHA512
fa87f7b7fbe512abb17a2a2a57331cdd5d9715d0c22a14f06fafb5ec10f6fbac1761328ce4186fc207a845f613d059d5427b17315e318f94bec1a3d0e3aabfac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
6bddbe7775615afe1d629c7be8474d42

SHA1
be1058be2f11d1d841f5f8ee3d2ba88c54b0116d

SHA256
3b41acef7c0ceb463028f20810450e68f29901aade6cfd278ce37549957412da

SHA512
342227983b5ac070b346ce651146f70694528833242a10829a65d0c299b71b84d1446ca5a6491d759bbda4dfaa96200198babd931dc589d14e5aadde9252e0c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
830058d2b0e778f07229aae2c47ab55b

SHA1
7a17c432d8773231f06cbd7b041980b2079be94e

SHA256
18f90f3d3081f3f78cd7ce942a0fd46bd84f4f2af1331f1bd422db4b5fe7e0d0

SHA512
49d1c1fad496e210f139f809bb7985025a4f8ad2280edbde1908cb7a6da67c57f4fd88f5aff5bd514b002c29925d9389673eca3ecbd83d07df34398bdd903bb7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
c223c081fe407558368445005a73191b

SHA1
d3bdb9b8df054fd9130c6c3aa48af8e26fae93d3

SHA256
0f9dfc760fe6395529e8ecfef4a389533c784dad4fff071c961df86cfe477717

SHA512
91a0ce4e2bade01e60a9c2034ab6671be60e7497388bc1f5256e09cfe145b9eead9fe26ec27341226d2ddd201dfcb5be66c2e60009c02176fe20301369849fb7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
334dbcfa938de145c6eb57a7d3919d8a

SHA1
7bf1a9ae4428272f56a9f44d2e29300e0a853a07

SHA256
33c248dccfaef7f5189621651605d71f7d82b65f2ff9ffef25eabbb8d364e355

SHA512
e63ec204be4a527ae0733735d501e6c548635a2766aa527f239531deb53278dd76ba73712e381bc8db76b68a74f5679b9f40e730c68d2c06362b581bd9178148

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
dc73d54afc49227881966ed0cfbc71ce

SHA1
99ca87a2d19a9b518d9a100cd9fb9e6f8291a7a9

SHA256
71a87da3840e878a9dd74c8a7ea747e81881da2c2448333919de50e0dd70bb24

SHA512
65426b3c6c55a31d6e4df3f9ca34ff38ee4e7b8f23e864de1adb8f3b6a837ffccf624b14db5e2e746bd617e0f6c4c6ef5b30644e1d1ca3601ca1aa86d91a2815

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
780b48c09bce5096a2d6c8931cca9f83

SHA1
8ff42ab5358e2a89f0b51b6ee265c74d8fd60946

SHA256
6d990dc1c9bb7b381d7426031601a2a8e225d3633d9391393230f14d718c8160

SHA512
7defcf9eb5e67a09cfbf318ff3256cb436e829b9eece8ca176ff1b42999b9e608ed6457e3177d4acca62022181ae4d4b1816ba4bf38cfd456f900840cdf5c058

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
2136ad74d33006f78cac5f02ae1df9b2

SHA1
d035026aaa56dda6357249f1e0858878ac83fc7d

SHA256
f2ebc547f43b2163fb2e320625b795855da098dc055ff617f0d78f406a4cd597

SHA512
ab21dad064a5522813b870d02ce5e1b713209dc08d882870ae7100c4ef6187003ee7355823d353e547fdb131b436cc645b97b5fca22573cde673a8023dff601d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
e9f433d13c3d00cd1a0748af7b3e3658

SHA1
69ce11c65e32a75b60d4dacfc3a64b17e1eb72ea

SHA256
2683958f543e10b798c1461968e4837e24994ca1b0f2bc436bca350f4a9ab54a

SHA512
b06b502a41378c5940b6fa34af6d5a67010b5d50286f30d7e4dc315732756f4e23ee36450f32e397ac6d7b02a747e87210e02e672ea6871c9e165ba393892a70

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
fb2a0a883a4a00fa361c10366dcc4b0d

SHA1
8d6a4029becdf85278786b1f4926114fb1ba9044

SHA256
6aaab770e51e9ca54ddda6579c9f82e62a5de9d5f28b3b8f55f4dfed3c12e439

SHA512
d72e377fc5b28dff7c896989a421e049f568319f42a5d809e930337a5f4da2a971dcd86cdd82bde46265bc714840d5de21aca1b3833ce8109261c5693bd7b71c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
d22c5217e7ac4ed0ba5bef75e646a7e3

SHA1
8de179c8b4380923bba12daecae54cef42a981bb

SHA256
4f8d602b04cb7f4cdd6cba722158463bea0f8f4cf2d5bb905b8e1a26f814e0d9

SHA512
172790bcd8bdbd393fcc20b9f2026dcfe11cdaf2a58262c3480d006fc3985d017bc1b94031e3a9ac778d697f1985fb42f76b990430bff3a76b19fea061fd8bf8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
fbc328288b676c70c387667eefd0f61a

SHA1
1dabf0dd6171795be91e83c14c3595374281559d

SHA256
df8c8451baad8b028d04aaeed67a6881189e1bf87c7b6d49d7018b3550cfcea9

SHA512
c5c3f52d4040c1b208857cf88937272f8ba91049275a65d5c2f8dcdbf4a4411ab8268cf3a4f34b564d3e2a080ccf759e09ce8485916acdbd5333cad1b949bcc1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
0a243c862d9f4d3376e3a7bc208002e8

SHA1
39cd9ca71bbbac7d38c36f6136d3b170cf0f2383

SHA256
e2034a9d4987a66086243e852c4cf9523124142300758c3c6ec06e83a7040ea9

SHA512
5c6d198e1beed3449a4e5adc13eae375f6e711bf792cc9e00ddaadaf2fe17e1a6850f7e27a890e8182bb38c75ba5e90dac29ac7299e15f6c007275122f39cbe6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
3e1c00cadba006c7e128bdd9e867d62c

SHA1
f6db3ab366d167466669f4a78f1737f3eca91c3d

SHA256
dc8c6a6075176340ab9f5f2461df5e1ff96e95706879975cac978d9fb4a396d8

SHA512
4504909015594f5fc4743403242f998ee2fb4eae14f1d6ef40cd2dca7a7622e62803a300adfbc23d0dcd1d75325d16f23a0aa01aa978d51f4cd1cfbdeb060cca

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
7fe3c83abc20c312b3d6201be7f2eea5

SHA1
7913d01f91d64af88843b6bcd343e7511750f88e

SHA256
08da339572adae9cad520677f1e5adf55926b91c4d82c1fd200a8e29e034a12d

SHA512
c937d59d640a60acc9033728ec29ab53a29e1b19680195dc675009435cda6b6cbcf2a4b11a5033bc51917b7a50ee41b755035f5a1c2acca3cd176fc65427ebfe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
fab0b6f1d4dd936c2653709f9b68a654

SHA1
c45a21611317fd646804e775e8893d6ac4026a07

SHA256
a45dbaa022dc8db014a0c3b91785a921f5b6a425bcf9e25d4710ba9c383ed563

SHA512
27c2c93dff3dc9cb815eceb2d3ef50e93afff88cb4d552e4af93f2b378159f60153161cd3a164bb4f524248e4e04a860f8c1272bee7120fbe53ddce906d25dd3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
7ad28aacaf327472248027566e5a7e4f

SHA1
addb381e3127b66178f5ecaa095c72c01afd0665

SHA256
f370dcfb1eac3ce3a69ab7f342117fcdf502e15c3dbbe028a49d44e21882e5e7

SHA512
0656e8e8d22eb317added5b81eb9cd9cefb8ac69e341451ad8b7f948048598f80e577d41fdf473660281a319f053bd55070e4fe72ce5bdd6433f16b9b0ea0fc0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
28c83d284ffe10a8e5d993a4170dbf4d

SHA1
a2e952595281e4d18ff82d8549da4c65ce3c442b

SHA256
4c4552c665dacd78f1a5efb65cf066b48d063babee6f27d5f95ba2f0331b8888

SHA512
1ce9592683d3f6bb7e5470d724cb6b5965307cd8c8d28bd416aa00da5372e7d96bbdc15f9ea22e166f84d043634d3049af5b310beb0407b57d8e8bdf13e5f2cf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
470258c02d0f6d013db269857f5faa48

SHA1
5e75a4ea60b1e08778b4f32d7590a75e3d0bed34

SHA256
c28507143ee65ac2d5b68d8ce7f36fdd262ea546cd28e75b913caecaf9db40f8

SHA512
881490aa577dac799e14c020205c7ef1d5eaaa0ff149eb3b4cedb1146420293e51268f4b776cc80ef7a6b435be2e5055797802d7e20a62d3029053fe744833c6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
f285deca2e0bb52959d2a308a55483c0

SHA1
e8f16b462e8b1cd3b1275151afa2dd4e50a72bf8

SHA256
56b4d5c2a1254b01eefa634bfd2de39ce462fd55074676ace3de1797c8a98a13

SHA512
3a105084e6d9843a1e5442cad53be1f6185e9bd27bce0dd4a15bcc72a3a24365b678f6fbc544a0bcea403a97c8da2e14fa86ebbb1d4bfa4909f8948afdf23b9b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif.EnCiPhErEd

Filesize
233B

MD5
53d4af4a05d9968ee21ed24fba23942d

SHA1
85d96a7eb11e47ac53f4828082ef3b3bc736d698

SHA256
83a852090adc2ba261442199a7e0bcde67eeb3fb6ecd33d49e6ff5ca7d113637

SHA512
3150e45839b8f6a4db9b3f8994d89b9ec2a403edd8320cbd0901da4329bfe8b7ca1f98d414645b3b9369b7c7933f9d6554b1d24091f821865fbd138afaea72e3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
0d6e68eb2fd88028bf408547c70f252a

SHA1
e4ac69385090b0cb03513f88c8be9309f3e6fd98

SHA256
39575f6e64e265a336e24b7de92246d983604e32cbc50777d1eac8d33cc3e2a5

SHA512
6ae613c667462a739701189589fbfec634169778ac59a7afe003c14ae1c4f8a97fa325b70fa3dc1d8db0ce1b1cbc2f831ba80c060a64cb633d40cce050479137

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
8ed8cd869e00073b703b2ab1410ac3c4

SHA1
acaf9c3e05790c5845e65c8eefe33b2534235fd4

SHA256
72f1e1c28373ae560808db903ea422f0b19567763aaf0e589d2565a799d6b0da

SHA512
bfe112b409db35b0e9e9fb50c4cea88808d5d23f9887162dc7684fb7b83da7c2e1233eeab8dfc78e92cb158d26c42f6c3bb8fe10afae4bdc373222589ace48e3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
f1ed444a984bc2e87ff40e6dd2490c46

SHA1
5c9011fff06e74e63e2da61ca490891d2f4b51b9

SHA256
06b988b12626db7f4cba2492fdaa38d64d713e51d26b62059dc26b5359ba4d9c

SHA512
0cf85975324e2c9c9631be189d7052171e0a60f03bbedb16d3b0b1f674bd6f460655c7d348f72d6a73c3f0068f037c8fac109854d76e86642bd068cffca79e56

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
1644c52ec6774cbf7f916e9929153a87

SHA1
55e2a64402e6f324f4f8e4be00daccab35e6a5bc

SHA256
83c1392fbf2e669c6862ae6bb3615812527b7c2b0fb9b26033077a875f50d146

SHA512
91a51d896854a6ac335257b75ee94b29df6bc57478938bf6241a6d891785991286efef86d20b27c208989f17eb5f6a4e57378b44dc09ed438e93230b239de90d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
f391b192053aee89158def953ebe18ba

SHA1
892304f092499cba08b54d0e3cc5bb6115d26963

SHA256
60e951827f0e68b9dcf908880b08ac90397bcd0c135d12499521f419901b72c6

SHA512
b7ac28b394a5e2302614bfdd42b3ab0202c35f09f74d1d5411c5243a4eefcd8b227a2379316dedf6911f382beb80031200296048a8dfb0a86b0517d658d52b80

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
2268b133bf7df2a2fb2b970aaefaaee5

SHA1
8ff1e80b16246d389fdfe5e240a5128bf87d9368

SHA256
585cecf04092855641933f3b4e54b9ed1d368c2895c49ee322fb4300c2ff9a6a

SHA512
54423875d036eca6533248152d34bfabb61c1721a6677d6d09ca469d4f0d8508e59a9e933e6f5e84a465bd3c04fac5d3e7e3d84fdf39e1ae03826dc0273fafd9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
b4f187cff6da08c45bdd59b4583df8af

SHA1
b80b70e499ec05fdd696730966d596580785836c

SHA256
2e90f8d1207518cc798bcd29da9bd39bdccd2563078b7e68d0caa8942ebc6527

SHA512
cb33ee998b3d6fbffc688e522d4519928298ff227e38a05cc3d2c133a6c014f3cf7e238ff211b8d15d8202812b71233221d54afee27b90518c116ba6b325f657

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
783e6423a50ef79f92b3bc8d7148fd14

SHA1
5700144a162fe058a3f8322b2975f36bed6ffb3a

SHA256
0c6acc55d4cc4a4c0b3e97126dedbe5684cf36f78ca9a6df7260c432ef607ee0

SHA512
829f86b1a884a8d8df84467b1f2b9b27f80357050b31869078b5f36afb10045eee3020207e7284c71c3f725e38eac28768d93d9e6acc74d24f4eeb0998234f80

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
cffc4779f055c787ae7b26d3d8b58272

SHA1
1c747e7ec8ec93a6d0b5c9d83810c54982ec2cd4

SHA256
b6ebe365d623a810938c12505d95561c767463012d904141785a784e77ec86f0

SHA512
78ea81f948f831a36bc866859e438d5e0d55eb8da27895fdf889bc82a88f83b0ac3b0495827edbf21296618cebda316f1bc4d912397a2a8cb493207df2bd664a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
27ded65b319c542fe9a2f61079e6a833

SHA1
cac3a1566d9550c81a80d3e26e88f82b78c1d296

SHA256
40eecefa4e820e00055388a026667e313a397ee4c6a4daeeae27943001ec17ea

SHA512
601fd395908f2fed77929495c462ac2f8e0f741b25a312529fad99919bda6e9fe5e30f883e5453737383648927a06891d09cdc729ca47c8abf52a7c2146592b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
99aa30f230ebe802bc0fbb86b0d4baa8

SHA1
1deb70d7b5021107c3dd9ef548e1761a3f3db1a6

SHA256
ce7f7c51992b7b772ac4ff482fe48746677d9d10bb4840e5a979a31f3ca51ba4

SHA512
ba64a4666ae49dcf72df8f2557f0ee06169db6bb8af7885a9580ab38be6e738024d14081ff918d2c03d9cd6c1f37d7e0e202b5613e6e5d9cba457bc56037f5be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
104143cb9dad2710694ff7e59dc1d257

SHA1
c171af64d803df4f438ccd78fe390d7be51ff35a

SHA256
789019d57ca01c70cb889f812c422b2895f6c42aa6cfadbd0083bed57e3a3850

SHA512
201eeb9f18f4a24784680c996f2281027ff9356f219ac5b510603a7ba7b86e2ef5d6b86723e1ac70ca94e6af1992c4b3cc9cfc87c9d79b3fe9071b79366e8c91

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
3898f8e9d2fc1ba6e365839c143e364b

SHA1
9d144278d37bed314ed0fd043d77b5a6f2c47da1

SHA256
5dcb0bc5df8663903edab1766e5d3645a8bbc066bd51c44e61bff6cfa96dc4e1

SHA512
f1c823e74db51df501d4ea28d5eca785cc7bc0b160567f53e44971ea82255a5f12583080d9e1b748646be9bb77407ca66aca3818df9f165b21d51f8dae268113

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
85a766a9ed0213e1c34b5aca62a8dc3e

SHA1
4de3c7584cabaa5efc5cdc244d27956c6f35d436

SHA256
e81e57fc78ee573fd600099907abdd22bd837f33a550fa1fec7d391d8fc6564b

SHA512
2487e01bf8946880f916fd54a725c9667507267467563e50a97cc7f781a1261901cee3f8021cff6076c10ffbcea441dcd99831a3fabc9bee352276be3fb6cba0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
3a3c40edddad39288d07293d1cc97482

SHA1
9b4cf183585af541f6a435e784c33bfde0bf213d

SHA256
73e56e8822bbe4a7fc860250b7b1d20be7aebc6564f15b1da66a99bafc154fb9

SHA512
5990d6ed35783b999a28fd5b55f8ed38ff749b3e8a86a209dd261387bae56102e2b72236c1f5cf4db70002af57dbf751a1f8eabf11422c23b5a53592e4c1e5f4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
a1c49cdd3604bc48c01e584a1311eca8

SHA1
641d1abb5f5a8d40c7dd566f46bbb85b8b5818d0

SHA256
226d3e6c995eb3d4945ed82d0e2ae73b2e49ee7d5ad30598872478978c5d1186

SHA512
06bf7ef2fb29a69cc2129c2fdb41cdc22e691241aed5997a276e53c42eee97cc3008a39f5f9f05a718988248217bd79445edfaebf1be0a471f6cbf5e8db0aae2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
35374e48d12feda5137c23d6e2cdf6ba

SHA1
6386175ca9d109c2baf7ac552ff99703279ff681

SHA256
61643e89e17804e3b815e6fc8b50296b2dda92493e9f234fc61f33d185370100

SHA512
a52e3ab03a734226e8683b4c8bd05969a43696e10bb28763bcafdf996acc86ff4193d344c421eb26a8fadf5e2311f402feae19341a61a1f93e005427bbccff1a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
f89c702c10fb48a4ad8c344c9d50d6bc

SHA1
7ce902d6d0ff6db95b6d0a0183db352fc79723e5

SHA256
d30d015285c4ea039f731333a8d953863a222b7050d3f47be9b6891f8b085af3

SHA512
a858db33c8c0f435558a5e59c00597d6d62b0a9b21ab380537ab0e94e5816c401d5b7db3b8af576008140cbe2a68c77595cec4994d686b53933ffc659515137b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
71f7d80338b7c80c51c64877bc18206d

SHA1
262b040c6cda9431ce88c0576e7fe3f35699dde8

SHA256
ddcf34164cd627b05d211778f67d1a168591abed74be470829493c0ed54e8809

SHA512
acfab12ac906d16f2f56a961c8e32bd5368c7c15d9a32216a72662e37fcc52d0399a7afed331551d33b2390172309e2a9faef6e3643f4aaea78c0c0b533728af

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
4a8dfed1c9aa0ccff00c856864e89c09

SHA1
44a8c7399d1b4411684c584c56e5436008d3cbc1

SHA256
bd0427c6f79557da5b662aa8e70ff9de364a85ec815b48df0558187fca982398

SHA512
7b9a92bd60f7ef5ca8a3b6fabd5cb02bdd26a47f7a5553e11b5196c0d1018d01e1bc7253795ab7e0763a980d10e51ed2cc0004707c8fe4dde0b3f52f2bfb55b5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
c091ad863d1b1d634e86aaaf89160938

SHA1
a2168af89e7b95c40bc6f4484d0f4f69bf97ccf1

SHA256
eace0e71d9d82e969c9d62d0e26951ba610f5cdaa593d178237736090b9fa78f

SHA512
cb73730d769834942f01567541758a8b9b61674926ecaff0f14c8d1ac00e5f8b7d5c7d8295c47406f458d66491058683a5efc5520f5e1da08b73276630d7d0bb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
94ef967c7fdd8c41704091202e2a92be

SHA1
13c3ca001af4646f3fca05fab953221b83ad9ee0

SHA256
35fcab9de31a865c2d605762265c627790f561adca2354e1793e103ede1eff21

SHA512
c0c39ec8720df2ac0daeb21377ed5e893559928be9f9ac6c475a06176c0803fa05ee1e15d8959e9bf65647945b96e01d489fa688baf0da010268f4c062dfb8fb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
95aade167892a0e6faa8aebb8a95a04c

SHA1
e658df16e351d3de492c367e5e0710de1344b0c0

SHA256
42e466568b556cd3fe53a907488567defe07e11ce4cb1b1fe1138b6169a41f0c

SHA512
379eacb5c7bec47aa1171f709b636e503736a0b7ea5d6925b602ef9f4479f1663b0c02a99869c90770e4ea2bf91d38f3cc25edce32126500824d997e4d31488b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
6c64dc86556045832124e31c4239975c

SHA1
f70b5848bb05b4fe95e2547f7ef8d7672654dec5

SHA256
31de883178a24431de70e92953b366ead51b9dbe00b53b012e20a7a85bc045f6

SHA512
d22df85754e316cf0f3125adc66eec53d5d21610aba3558e79017918a37a97110d491e20c5c6e05482c40dbf9628b7d26ab9ebb7fe72a4d3171aff2879c88ed3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
8ba20447f3304dda1a1f618f48bbb394

SHA1
d8196bfc67d3399e37401442adc5897f3b9f6200

SHA256
2ad25c74eb680f5eea91c673c43fa0dbac70c6a7e0dfbd4346015a588ccbce98

SHA512
76e313b0c82008d0f4ad6cfcc72c51355afcf98e42564683fa6a17f7b1ca2236b76db052237ba7a0251cbd17b49d8563295e5739d72d14e7cd5b30255ff9b19c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
8018e0973a3a1720cab542746499a6df

SHA1
02adbcae947c7e23601b6d779ce9f6f9a9cd5f56

SHA256
b84e62be5664078bd9ff9f18819503bae28b2fb400fe339c6debde83745c605f

SHA512
98dc8c0872c7d190666ae9a7f9430907bb065e80f94641b889109e9af5ec06b2858b222ef4cf5f96a2e6f163744cd038a5d2501de651b93d7a2056236b43a3ae

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
98c06a4b9e0c4d6ccbdcc46693717a11

SHA1
8b3144b9f7320c6f759827b5c1ea9cc356d34cd7

SHA256
e8a6a382c4a813c1e047a02f491c6f0b1eecb9917a0420811ddd1c19f058d67b

SHA512
6ef735edc70a1981b7a309afab6ebd0817dee7fa059b252566d4d8230a7ca82a1aa738631c68f801a50b9ee44a8128dad6fd5ab7c13be812ff5afa97b4fc6a88

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
9686d5a9617089f4075ba1018cc7836e

SHA1
1a3f52c30bd11f1dcd6e118f39c13847001b84f9

SHA256
0323f40dbf11e908514125c7f7331dc9191969c529080a03df7aa27e0bd04b79

SHA512
833aa7eaf6e333f936b52e882f1c195b8f7ec113821899eb5e3bab868b23a4364c57b998e4807f8de775af89c072fef57a03906a6ead3f37090f308900307bfa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
f7ff65297c31698dc270640999a25ec0

SHA1
53f78b108215562f2eb1fb223791b9943e5403f0

SHA256
411ebbc013c3a96c9709ce79e61b3e9ba947eec7fdb689d62745db800502a653

SHA512
abdd8cb69f918062aefd287ecf659c17d93e9012055640482c19734c49f553f299ce757a811cd5d7f1922a4c0133db02b9e35d91e3515be8b2c40250e6133b0a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
27edf208c4d5077e059873e0ec980647

SHA1
c4d33464ddca0f5090a983fee1daa3f4bab37cde

SHA256
4df4250ef4a814124da2718f6c883b41e6dfdbdcf62b608d00c78ecd0b1fbc50

SHA512
2fdb22ff72bf2c2386e74eca268b3ed74dec55fb5613094a01d1905603055f73971b6c5214440246b0b665dd82b38a9338221406cfd889021bc4533d08eafad8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
e9341caa3b2af137899a1d47295a213e

SHA1
e30b00ca1f0b4fa3cdcc72f53276c368915fcc16

SHA256
3026d134968275d9ae24cf4c6500346fca203a0e1d7c52760ec667f18ad96d53

SHA512
151877a0cb7c301004b3564357402f987760ad4e638208e20b36254d46853a3a11e1ba64cb173743bd8abbd969b6729c4a720708cb03fba048d31d477f526ab7

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
70169cc4cb5ad57bff732cfe494fcb5f

SHA1
22bbb39cf8a6861480a65234bdd3209343051757

SHA256
c466fc62f62e22fa7a063cc0665e723ffdcfc3edc15992dd6dd2cf0fd719a9d8

SHA512
d3e391e53b3346e1d5bc2db430187e86ba9c339da3dccbad97433ab4595d6e252ef4a8b10ea2e5dae1140360ef8268fe5a857f466d1ae83520aa0711856c247d

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
4bb108f53180fd11a4accdcca2dfdc7c

SHA1
75b367e95ee401084b826c88421e3eb6bed504cb

SHA256
9fc306fc971ca21761297c89765d2c48fc6256d413e06170dabeceb7720bebbc

SHA512
e764a003a5d58c52f049543a2146a4c3f4fed89d453657596b0698cfcc8a7efe398bd3d11b98f5cf7c2dd53672f370872d31ac17d730c0c4c965c1834426dfee

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
3533cd1da668d43fbe698fda53b2f55a

SHA1
9a20857360cf6b87d87bb0f30fc86ac81e3c5a11

SHA256
7fc3d5127605e98c7e49fdd69eb029a86b9652832e360feacd83573810e9d0b5

SHA512
bbc4026f28399ab137671964903dd8997cda27d25e697f239969478e33cb2631d071cfde64477ea113aa0a6bc5e0b4c9f373e8a8de03409150c8dd92a79a4188

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
2fbc18de5373dadaef2ea1ca66e63f96

SHA1
42e36f53cfe63772df516ab4e6f4af389c9fd4f2

SHA256
88874369db8bd7bd61bd72c26723a1bd7c5f651998444a5c5ae9440cf6b5709f

SHA512
7a51c3413cdddf995953c4e88a2324aa8faaec951abef369c25a4cea026ac03b9b9e4f26cceb2701a7fe947e4b0eb089db69245efbdae939cac26def801e5108

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
9b41d472998d95b06509eae48ebebd32

SHA1
afed787a10b01a73734f0c5bcdffd6216664eabe

SHA256
342f4c969879580c50984350b0a0671b370222468c59c242e29ab41754c2226b

SHA512
7bf45a799a134917aaed4ba7d4bde68799675f999fda6074c92d09b4f7bab896c2e73358285b6137c5b48e0b1c9f7f563f959b2e42029cf2e24780ab8aa715f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
d3ed633320c85639519e35c91ee91822

SHA1
a30e93c80ffc8a5d384d1c6d9dd3867436edc5ac

SHA256
4b88ef470705ce98b985ab814701cede400ba0dc522404349f6d21561a511d34

SHA512
d5acb8aeba9ab036e4a36a5574a53fd79e853112bf200198bfd75fb463554aed3c8e2706eabcd22129ba222e51766b99237cd5f02d3d86a8de6797290b6018f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
774e50e16ecf815ab984909aa3dfb2e0

SHA1
8447b00da74cf7bd69f1433e0679b00db385c5ea

SHA256
cb48e6d9cc8494b03dadfe1f7cd9bb3f9b76e443996f687c48cb7e3741660544

SHA512
a746f33b35c7f4b577564213c41a2ae00d62875f7b3191d0eb0fafef23e6f482b155b6572e47b47d3915bd424ab8636c1ac420bd558ef748785c3495c6a07f17

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
5364a40a55e14a0d8678ddc592465018

SHA1
494e183361186e1c845ad9c9f777c3689ccf0b16

SHA256
9ff691f4f002a6bc432ba16c20ecb3116933717916e218c63af5367742269564

SHA512
0f5547757cbf03be68b95d1e4acafddd0aafbeff2a13fc6762476b188af003a449def1cc1f8ee42d4d0ba0a1a93bde359bd430e849f05071364e0f351b57dfdd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
beab2d61ae75b1cedacd4e92aae03b81

SHA1
88bff9eb9e2089def620ecca7a07715fd1f6e14d

SHA256
ce629462b4340e587c1406ab87c6f1075d23363a24beefe982a59ca129b40a1e

SHA512
4e0c2c0c85633448b97c4bac7841326b806928e25de78c6ef88cb4057bbfcf310ad6d03e413ab41f52eaa50eec61207f489157ba0a53a9ab4cb057bf6541ca72

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
a7139052bcb6ff5146c505a2f79ae122

SHA1
409cd90bf06e1cc93bad8ac2cc447dd2d386c793

SHA256
cea6d6647f98d1ca80a05079dc4c2f56e71e7ad69bb97567919bef2417175344

SHA512
401e0f786f90f052dcb57e81255738ac1150b44cf6be296c74c429341969049c80cb08f539bc43f974273df62b01afb5f95fd27bf72494b51d04fe5dd7e08e4e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
30acbc2110f176041b5b4fdf23f5c48a

SHA1
de7bb1bef74831a44ccc5dcfd3737585824115ee

SHA256
b7f3a36f28dfe01fe34583263ed0ee1281157b0bb767a126a7a7ea44fd7ff979

SHA512
87fa23e04ff51a2f80503eafbfdef4fe065e6c2b40372a1c236a208197b99bbe2f63735dd2e074cbb08a83caa0a3d4a6a0b0378705293964d320de3612c2b927

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
0a28393430ac0ed11aba32ad627c3a95

SHA1
661ed3fd052cd66cd8fd96b93edf52e5a09c14bf

SHA256
2b72336c9718b6cc5c2dd28c215f2a05b0e9bd7624030529d2080dbd8b8a17a2

SHA512
fefaa353a13c861a7cb04cc7df9a16cd45533b7d7d7156f213c6fdace8216955bbfa8a3ab4285a23ab55df725c5770b26a1bc52e8d910b81cd9d700973eff351

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
79df4a0e06eaf6fd198b6b090132398e

SHA1
0b0f3680a0a084e4242d293b9a05814bbd813d01

SHA256
8d5c504bae61dfab5897e477703f946e46a3a50c2a1a867a1589311b220890dd

SHA512
c04830022153f41b8821a154682ee685dbfcb1ea6a9e8ef6b4403f80957f75587746a90094a11655dd5bc120d70921f5e83eb26374ee1ebf0ccda9ca9a5d3ba4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
d8c2b484c67f9d25fff23ece29e52142

SHA1
50759e0a42dcf14f5ec40b6fe57930b3de20bcaf

SHA256
1a2c12410d6d965031460405ef07b268e9c767ee0c7ecccc72c6b8d30e772689

SHA512
b334ee36d244ea3c1f348b771af44fd4851253e9d3ed62f6b1b340a1642297147bfe21b3e4395a461d585e65cfb707c574871574aa9990fa2a4edc02386ebac1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
6089bb5a37fcb3f98ef29d0484879f47

SHA1
a8b726130d2adef802a12626c409324b08b56858

SHA256
c8e974e57a5554b49856f78c9b70917ef92cb7c104065df900a8cbfa264f6de8

SHA512
d8fc619fd8a3e46ef17e9a29891d15041639793916d629b0ffb7224f5c5c63fed27c17577f4c3f40ec9355ac27406435979fc4f035a0e42d5dd31e9c5e16243b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
dcbe6e8158723a2df38f44db8af7fe1c

SHA1
56301144599824292ff258812b5463d5f995b31e

SHA256
0b729e7900c384f5f985e35c3f2f1c5e1cd79fb8f193efd1e631af5400631c26

SHA512
846888a1d80ed3c81dd3491c11c26dee3f969c19c4ce7909b78338034e78504f191805e534bb1dca34fa991d5b245e95ca27d4b8e5eee5271ef67ba83c443fbf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
8b272047720f0aebe4fe4aa426df235d

SHA1
941c47ec7c67f8bb77e34eb6627f79f289ad8d26

SHA256
36379c628e1abf1a42ae46d5b60fdb1de03794f17bb47019a96cf7c608e8e061

SHA512
435bd3bf3692f99db292a3acd8bd9310e06e9708d183180f55999eb0fddf3c18184e3c05f92f5194bb4d8dae48ef0ba212849f7847d9a943ac77be6373572a40

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
9acd4af2696fcf3a0e9aa9f78a3bd44b

SHA1
24826fb8a85d3a13f319c25eca377868265b2a03

SHA256
2c9c2bfedd2844a1f3395a3654cd40f4532bc16ef97470a176ec0c14f17462a3

SHA512
2f50c7dffdfe235e89ce378c0e920065d4d2770079a32fb8f4c5e9bcc95c1f0a411946a8e9ee65ce7b2cb5493001a2fe04adb8faa80d474cec0aa27e8ab98747

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
4450d8b02a171bfd617f645f3045fd46

SHA1
5ef53453f6da01cfa864cfdb2f42a5f348d0c82c

SHA256
2294ba3ac74c27502f897bd21aeb0bdd885999e54f69c8fb5c59bf6b1ac19466

SHA512
354ab539b094fe54bbf8c3a641723fa6aca7d5d331750dffc5f07db45599dea2a9a01865b227bc9e4d010a86c4cb2e64c5c964377b6e7145db2128598c06a887

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
d10f496e5a39f3a70997c832905f3a32

SHA1
c9c8c71dac35d0cf1f443db4428284f30ceb8aae

SHA256
b7d7b2f2bfcaea2b3886e6e9c60b06973057a039de6a0120e7a2a22a1a565225

SHA512
bdbd3d02e385305600e217e99892be60660440f403e03bfe03b03a0b8771c7fd37f1e9b2ac827450cb3ff0423e8ea28eb7de18da4e2eff7725b60fe06a36aea0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
6b67c219ad7a9ab38d0ea1f6c054016b

SHA1
bb3c3fd2320a81d85e30647600ed19480644c6ce

SHA256
4d6bb888b349d4ad39bb28f9f0e3de09407eafd7caf9de1d56e2a188b7308aea

SHA512
b88481f75be874540ac558cec230d7619d4640616ff42e08bed44d17fef130a2fddaa4fba63852254f20ae47412a1b7d045473c5f8880a425f6baafcee60c131

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
0c3b6a5b3f443b0f6effd7ba9c3d76de

SHA1
2b40c863b30dc5f97bbcb832b52acbc1f2df4fd6

SHA256
1c70d9d65bc15742ced67af3d4653bffebf1c63836875242754d32dfbe7915c8

SHA512
d6ee163838d1dd60a04a83fc9c23317eaaacae814ec4abc1e83c26ed008806b25ea14f8055c0d8344ab381950c064c34da53a376fab50396f70302b911dbcd09

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
3c368e12ca65f1606c2f293fdc93d6d7

SHA1
86d04decef225b0cc44f11991d5109310dec3141

SHA256
28d88c35f01b41aa0566abf4d8556d01f88b2d8ec62b25643cf616f528518eac

SHA512
a3ffab0c9703779030daef1a3a6c93a4e006d6dd88dfa85ebc3a9068af07d3c8ccf8f056d9d43d184bda079404d6f599355dc737d4897e14e1b9eca6d152f437

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
ef95200dd508ed9898a302d9c227b022

SHA1
8934717f4debd52f1dd7989c11980e2ef0c260cf

SHA256
100b7cd3d331202df09999ef9b81ca19dfd3e92b66b674d7c56d1c663d5549bb

SHA512
ef300c13287db65f607b60e2034b7bb224c8255b5a5a82fca637890ab24cc96ac5b575c22c3e8089178f2b8bcdf33f27d263d785d354ee5f9d2b6fca66b6041c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
e5bc7da41233dea9fc06c4c5ee463a52

SHA1
e1681c63d618fa52222acc6e6380ec40724c8b64

SHA256
fb2059d78bc93c23608a568e3bb03a8c54a30408edf19fc6bb3268c0178d277b

SHA512
6ff730d39ac78c9a3b1c4e240abc98c686f33dbc32d8f8b9f2743a7cbb74a69900545e401753eb4053fc90ce0cfaf3ac98ca2b533cb6a9a6586533ae4b88ae9f

Download Submit
memory/2696-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2696-8908-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2696-8909-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2696-9197-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2696-9198-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2696-9199-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads