xorist | 84466b849c2ee067c513dadc5a23951636b3abd8b41f0e9d7bbcf974a4fe1446

Analysis

max time kernel
8s
max time network
8s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
07-10-2024 08:44

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
Size

445KB
MD5

1c880eb8aaa88d35804cdc00ec1ad6be
SHA1

68a06e660e9d7451dc15cf1eda8f4ab45e2930f9
SHA256

84466b849c2ee067c513dadc5a23951636b3abd8b41f0e9d7bbcf974a4fe1446
SHA512

b7a39eb3f434e86000875051a310fbaa2a41ec37d1cb3221ca5e7fc2d61ed85f6235e3952d71b1edb707699202b195cb14d8fa2257d2ff5dea635cd8e66cecda
SSDEEP

12288:M+9SmNgYpiqMQuUadfdtTtcmeL71EQPxEvMCMUW:MIqYpPM5UadrTtctJSMCMUW

Score

10^/10

xorist bootkit discovery persistence ransomware spyware stealer upx

Malware Config

Extracted

Credentials

Protocol: ftp
Host:
thehunter.clan.su
Port:
21
Username:
6thehunter
Password:
andrey2519

Signatures

Detected Xorist Ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2792-27-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2792-216-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2792-7571-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2135) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

îáõîä.exe

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	îáõîä.exe

Drops startup file 1 IoCs

Processes:

coder.exe

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe

Executes dropped EXE 5 IoCs

Processes:

coder.exembr-locker.exeîáõîä.exesys3.exesCheat.exe

pid	Process
2792	coder.exe
2580	mbr-locker.exe
1532	îáõîä.exe
2160	sys3.exe
1576	sCheat.exe

Loads dropped DLL 9 IoCs

Processes:

1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exembr-locker.exe

pid	Process
2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
2580	mbr-locker.exe
2580	mbr-locker.exe
2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.execoder.exe

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FKDECIFFBGEOHMO = "C:\\Windows\\system32\\mbr-locker.exe"	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe"	coder.exe

Writes to the Master Boot Record (MBR) 1 TTPs 2 IoCs

Bootkits write to the MBR to gain persistence at a level below the operating system.

bootkit persistence

Bootkit

T1542.003

Processes:

sys3.exembr-locker.exe

description	ioc	Process
File opened for modification	\??\PHYSICALDRIVE0	sys3.exe
File opened for modification	\??\PHYSICALDRIVE0	mbr-locker.exe

Drops file in System32 directory 7 IoCs

Processes:

1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exeîáõîä.exe

description	ioc	Process
File created	C:\Windows\SysWOW64\coder.exe	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\coder.exe	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\mbr-locker.exe	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\mbr-locker.exe	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\îáõîä.exe	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\îáõîä.exe	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ufr_reports	îáõîä.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/files/0x000b000000012280-12.dat	upx
behavioral1/memory/2792-27-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2792-216-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2792-7571-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

Processes:

coder.exe

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101863.BMP	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png	coder.exe
File created	C:\Program Files\Java\jre7\lib\management\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PIXEL\THMBNAIL.PNG	coder.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png	coder.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\it-IT\calendar.html	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15168_.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115863.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\LAUNCH.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Interface.zip	coder.exe
File opened for modification	C:\Program Files\UndoStep.mp3	coder.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.ja_5.5.0.165303\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143743.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_sun.png	coder.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\16.png	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_down.png	coder.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\THMBNAIL.PNG	coder.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\text_renderer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_left.png	coder.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG	coder.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png	coder.exe
File created	C:\Program Files (x86)\Windows NT\Accessories\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\19.png	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png	coder.exe
File created	C:\Program Files\VideoLAN\VLC\hrtfs\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Peacock.htm	coder.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Americana\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Program Files\Windows Defender\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\43.png	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\picturePuzzle.html	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\36.png	coder.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	coder.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\cpu.html	coder.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\pdf.gif	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_lrg.png	coder.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\picturePuzzle.html	coder.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\COMPASS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR8B.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR1F.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_left.gif	coder.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\PDFSigQFormalRep.pdf	coder.exe
File created	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\DELETE.GIF	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html	coder.exe
File opened for modification	C:\Program Files\Java\jre7\Welcome.html	coder.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png	coder.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR8F.GIF	coder.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png	coder.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png	coder.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent.png	coder.exe
File created	C:\Program Files (x86)\Windows Sidebar\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv	coder.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe

Drops file in Windows directory 64 IoCs

Processes:

coder.exe

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\microsoft.transactions.bridge.dtc.resources\3.0.0.0_es_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Runtime.Remoting\2.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\sysglobl\857fbc76bdd79711e5228e5b075ade49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.8dc504e4#\53cf54ff35686c4044952a8cf8b8021e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.GroupPolicy.AdmTmplEditor.Resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.RuleWizard.Resources\6.1.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.RegularExpressions\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_fr_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Security.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\PresentationFramework.resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\SecurityAuditPoliciesSnapIn.resources\6.1.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\system.management.resources\2.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\bc09ad2d49d8535371845cd7532f9271\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Build.Tas#\3cf3740de20740208d614d330aa4416c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.Te3736ca4#\f0a8400b761cf5680fd7fdd7db26181c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.Vsa\8.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\office\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration.resources\3.0.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Build.Eng#\e4031bd0b7706fd0a686e9bb6353aa2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationUI\6f4c8aeb8f066adf5cafedbec0cac415\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.PowerShel#\8df695fb80187f65208d87229e81e8a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Windows.D#\de64901e4cd2074f5c70733ab5d7787a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.AddIn\ed852e32514b415cfb4ac81aef9ac0fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.BusinessData.Intl\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\policy.3.5.System.Data.SqlServerCe.Entity\3.5.0.0__89845dcd8080cc91\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\sysglobl.resources\2.0.0.0_de_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\WindowsFormsIntegration\3.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Web.Services\15edb548fa79197e66dc803215bd391b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_64\mcstoredb\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Editor\1.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.Formatters.Soap.resources\2.0.0.0_ja_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\84ebf4aede3a599b943b3320ca704911\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\WindowsFormsIntegra#\0cb1830849e0ce11c8985339523d5b63\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Office.Bu#\047c9c4a6b9dcd9d1985b95e0f4f1daa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\dfsvc\261c09179eae03d67c9b6f3e70b603bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\f52bfe40c54917622ed3abb98db8f90a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_32\Microsoft.Office.InfoPath.Client.Internal.Host.Interop\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0\10.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_es_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Outlook\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Drawing\2.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Management.Automation\1.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationTypes.resources\3.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data.Services\c335a6ef5339fa917518475c286c8ca4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\MCESidebarCtrl\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.Tools.Common.v9.0\9.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\SrpUxSnapIn\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.OracleClient.resources\2.0.0.0_it_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\461d3b6b3f43e6fbe6c897d5936e17e4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFramewo#\c462be068987b2b4fac3a700f265fc77\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\c9bdcf9e45459b60e542e8f270de0c52\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\ehiBmlDataCarousel\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.GraphicalHost.Resources\1.0.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\SMDiagnostics\4b5adb098f8ce2890826195454a777b2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe
File created	C:\Windows\assembly\GAC_MSIL\system.io.log.resources\3.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	coder.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exembr-locker.exesys3.exesCheat.exeîáõîä.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mbr-locker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sys3.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sCheat.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	îáõîä.exe

Modifies registry class 10 IoCs

Processes:

coder.exe

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	coder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\ = "CRYPTED!"	coder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\DefaultIcon	coder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell	coder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open	coder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "VVYJXUMQZAEMRMB"	coder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB	coder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe,0"	coder.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open\command	coder.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VVYJXUMQZAEMRMB\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kw0mB3PsO47k94v.exe"	coder.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

Processes:

îáõîä.exesCheat.exe

pid	Process
1532	îáõîä.exe
1532	îáõîä.exe
1532	îáõîä.exe
1532	îáõîä.exe
1576	sCheat.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

sys3.exe

description	pid	Process
Token: SeShutdownPrivilege	2160	sys3.exe

Suspicious use of SetWindowsHookEx 3 IoCs

Processes:

sCheat.exe

pid	Process
1576	sCheat.exe
1576	sCheat.exe
1576	sCheat.exe

Suspicious use of WriteProcessMemory 20 IoCs

Processes:

1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exembr-locker.exe

description	pid	Process	procid_target
PID 2400 wrote to memory of 2792	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2792	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2792	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2792	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	30
PID 2400 wrote to memory of 2580	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2580	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2580	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	31
PID 2400 wrote to memory of 2580	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	31
PID 2400 wrote to memory of 1532	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	32
PID 2400 wrote to memory of 1532	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	32
PID 2400 wrote to memory of 1532	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	32
PID 2400 wrote to memory of 1532	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	32
PID 2580 wrote to memory of 2160	2580	mbr-locker.exe	33
PID 2580 wrote to memory of 2160	2580	mbr-locker.exe	33
PID 2580 wrote to memory of 2160	2580	mbr-locker.exe	33
PID 2580 wrote to memory of 2160	2580	mbr-locker.exe	33
PID 2400 wrote to memory of 1576	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	34
PID 2400 wrote to memory of 1576	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	34
PID 2400 wrote to memory of 1576	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	34
PID 2400 wrote to memory of 1576	2400	1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe	34

C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1c880eb8aaa88d35804cdc00ec1ad6be_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\coder.exe
  "C:\Windows\system32\coder.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - Modifies registry class
  PID:2792
- C:\Windows\SysWOW64\mbr-locker.exe
  "C:\Windows\system32\mbr-locker.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Writes to the Master Boot Record (MBR)
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Users\Admin\AppData\Local\Temp\sys3.exe
    C:\Users\Admin\AppData\Local\Temp\\sys3.exe
    3⤵
    - Executes dropped EXE
    - Writes to the Master Boot Record (MBR)
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2160
- C:\Windows\SysWOW64\îáõîä.exe
  "C:\Windows\system32\îáõîä.exe"
  2⤵
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Users\Admin\AppData\Local\Temp\sCheat.exe
  "C:\Users\Admin\AppData\Local\Temp\sCheat.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:1576

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2188

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Pre-OS Boot

T1542

Bootkit

T1542.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Pre-OS Boot

T1542

Bootkit

T1542.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
301B

MD5
c0b2257570b3d11be28c93253aaae5f0

SHA1
b1f20d760a1cdeee566d7857deb88ca451c33722

SHA256
ffb6468be6a66d973ef143bf7cf8d059139bb15ca521c5296a3337457bfcc960

SHA512
69e3afd798ad3708e2dfcc9f5dd99e2593ed5f9ba45a7037845370236aa5d7893d407e4ec515498d4d11d933aa1a67031f605857932d829c2644f4b355bfa7c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
475af4774b716d3df0c6cd013a794f33

SHA1
9970fc0ecbf70aa738e3375a828d59cbfd5acff3

SHA256
0f5ff26cdf1f3402c0878549149096156ceffa7a15186c3f4a130a1b327562fd

SHA512
acf9fae0abc072a025cda988ae82970fea23d41adba09573237aec30bd9888da0d3157926618c545edb84904638491b285c1ebdd48b6ed75205278b9810397d8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
4afd37380eeacfbd5bd1925af1761994

SHA1
99e53512d67a092691f7dddf6da5c6f03c177113

SHA256
07ab3fcff54552de3f924550fdf0b9870ecbc55b25b9ffef3d3ad903f09b4e9c

SHA512
677576d6b2b5a896a5781a5d9154a7e354d987f8287123f2063e965731ae4afef26ed691ec21191a321e1df8d2a89694224dadf9129aaf1ee83178cbcd72f88a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
cbdadf836e7675b9126c3667b1173bf3

SHA1
e68d9f5ab18913e80a902303c211bdae88bcbddb

SHA256
fb09b04b47fb3c9204a39fe846fccc6160d5d26a9c1e87be74e2e9cfed030032

SHA512
9accf4a28b13f88ced12666453197372a6ef5c7129c456da32ccfa777a2dfa8b70b5536b9108cab612448f4987b4a777b3ade15470040e00ac6c3a3ccb0ee9ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
bb215a420138ea7fa0c0f5316653b101

SHA1
3e6c69caf21965b6af776e2dbff9a5fbda1f66d4

SHA256
9a896bd98fac7a0061e5a6d2be728711e4358dd8126452233140d4989daf9c5d

SHA512
2349164bdf71d1041f4bd1808c592a3c1ac85e26db88e58da2d854c0c2f5070a3455a0f8477ff1e9d5a2b789125e157f3044c7e7af9d0533e3d71ade6ca9e231

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF.EnCiPhErEd

Filesize
496B

MD5
8ea36ea04fac8af05bd3cbc192d84616

SHA1
5d77922ed3dbea8857674f517fb0536a0cf16898

SHA256
5ea8c69da03283a79a20ddf34405e166bad83db8822272b94070a23ba5cb5a1d

SHA512
6b1bd07a3133741bb6d25b4e67a56bb9a3b8bd7e4177903f88011bd252831781f31e8619ee36969e4157f560ac7eae876af87d8bd07d740ccf73f8bb4b469af8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
be016f138485190086c78f14435ca157

SHA1
503885271e09ba1b0cbb1cbf513f955877f21fc0

SHA256
2323c289ea101d929d88ba31834651fee5378936b611b6f9f1077718ab7f2970

SHA512
1aa54fe2cf887f6f8640a54e17c050e3e27be6f851e3222f07be1f60633ce74d583ef3d640ea3c0a71a726b7d73f8565484a85bbe55cead7117128d0ecc2f91f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
690fbcc8ad0a090799c4cacf094b7296

SHA1
ff59a23aa15b4d29d071416430e6814d49c6bc31

SHA256
dbc6fc1b264fa8211a14d0ac02c514fe2de70cc4fa1650e48c07c1e5f5587c8f

SHA512
91af63f5579516f7936dc8a475d91488dac9ba10956f37a2ff428c681aa78b56978f7987b33be5719adbd19595540d3e63fadd2732c80304206e7d35250f7459

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
28651b6b36ea6459f6af37b5f240a7e7

SHA1
d52610a41f409cb4cae1a25a7ba6efc1eb53de22

SHA256
b016a0a40de28a15e3cdabe03205200b7de980b581dfcfb505585b8044f59dc0

SHA512
04b67ef0884805d380108e78623505ae5ffb237b032b22ef2eadbdcbacb6ee20220e03bd48368939d1e48835e62036cdfa385a7422a3b6c701fa882274f39cd0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
251d0795e02f4908a697f52c7558649a

SHA1
ac912cef5f707f2e1d270397c6275cf3136d474c

SHA256
ffe4950ed86117f6258268e010f338b417d0e01b0438dfb8bc63d261b5fdb689

SHA512
aa01ba576f33de3b2a2fed86cf2b5ccc28ca115bb5db97d03a92d3eb65e6a0fbf6981b25b451bde6cf2f77b397efa83a5b9cbb4cf9ebbfad66cba6ed65eed167

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
6dc9b8ff19d7f9bfc2b85dae150dffde

SHA1
7c90ad49bf9fb84f86011ea6ff6cc5881175f43b

SHA256
fa504d9c7abf7434e32845561c42e1e8765695dda8f7569ee6b5164c6d249288

SHA512
7c60bd2f89b4bac1cfc26ed917f97897330b7a579b6744f1072fe11c093946673aa0e9551e834ae4bee2a354056e3748aa36f993150f8e06bb4e556021f3d216

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
8057464350540c86167d1836a3412ba8

SHA1
749f11c9c7b93b0079c8ee99c9671bd9a6adbe63

SHA256
bd256d7d23f61f7fe66ee7794904169f91401368c39039df53efafcd20ed084c

SHA512
c7a45150fbe81babb3e95600f31d8b8019729c23b2ce5b0de585d407de44b28703d429caacbcf44b4f8ce58415730e96965a6ae870290f65da7dbb516ebdf0f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
3a95e917c5387ba1f35d07096366d33c

SHA1
423619a2aedc6373689d3477cbabcc6b69eaac9d

SHA256
11f1ac2f335b77d0e5c35dca393947aa3b420eeea0d8a0c511fdfe2dee8f22d1

SHA512
6b255853b23ff22cfbc561fbf32ac9a3246ded29953abaee2d7797e4ba401ca396dab6df022746738f76d62185bdd2604bf369de737ed26e6e4ecbd6be8b00df

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
c27d1494ca15586d52cb1841764c679a

SHA1
3eded7082e34a0bb86acb9e9825a2398f15f9b8d

SHA256
e553f68da7f31dfb66331dabf0070fe8ba82e9fd8d5a46297a0642606c3959c3

SHA512
7a418af2ffca99c09ba805c40aec8c1311b18cbbad91590fb8577991e66ce8257c01e3823c492db75d1b82df5f7fd809d9e6514a092cc5ece9d0c7b5802d8083

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
7ff431e64d62f7f67897735c119c3b54

SHA1
7329ae3d6ef68f65866417bc4788144a5f7489c4

SHA256
d00731aa8322ae623362504a50cb8ac109f27332f90c50aa19f7a594c563bc44

SHA512
cc65e78c1ed0ef1bbcb65b548ddf322e03ed2303fb6a541b8a7639b331d714bcc2900898d547bc4a0ef22965c621f102c858ec0a2f1faebbd86bbff1485b12ab

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
95bae6e36bf56b230f9a00adbdf7e50c

SHA1
1d8f52973bebbeba259a216723beb0473000faad

SHA256
e2b9e3fa909d6f0bbf31ee0674eb536705b1f0219beaec4c6044f6dab87b43d5

SHA512
1afd331f937f20321c1b848a2513476bf01f29dfdf9a8786f753118d439385209a408f703479dfbddd10e77dd45d33a4fbbb46d6722e75ee75281ad208f1070c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
697413b98ba480cf0a451d70eebdd2ce

SHA1
7daaa3e5a66778d29d95e186073c16cf016f08b2

SHA256
960ede92876afa3ab99cf12d8a7c8408bbc82269f7fb3c5e1674e857e7c9fa86

SHA512
bd1a4ea965a02eea0f5567f3d8d8e2d62afdeae107179d0a42d87ce5e23844f2c38c40f42136889f04ab697e81f6b5590eca14c79972e787cc89ec2c6f224c6b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
1d4acd08b387629d35af14017e2211d6

SHA1
29b7bae838c7fc797f4327b776f133846ad75268

SHA256
5f51622cc9bbe4a39bfef63aaa17c373efcbc3d968ebaf923598c3a2cbd2d5c4

SHA512
f6e12421b7b508a9939fee91448f60a3f2a55469b90eab3e9470a37333ace6bc91aed5a5e0d97d1fdd7478d2d747c11582e67eaa9ff7e38093e895daab007e4a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
d2a8b2dbe4eb63342c2df2546a9dc51d

SHA1
9fcf05828effe7b5f443ccea9f308a6b4a85b0b2

SHA256
0dbf94003078f484afc446774c7444c3bc3841f988153da4af7e721ad8c3c1d0

SHA512
3cda7c01cb57c0b5cd43a2dbf62457e6ece4be10fe98076c012e3b814934a725b40484fe41bde3dbe47ed3d131a5fd85f43e428219810b5ef6a26d40d0a78046

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
83bf8bd297b62b9b7bd883cf064a4eaf

SHA1
007c2e624d4d8417971144656b383d0f28e42116

SHA256
6777155f2459bab5d0dd1a248fbed0d92ede1d2496ce8d8549e93e63683bdbb4

SHA512
e7bc26366d8342f954ecf917405bd1ea82fbebed9d6e89bbc4e80d549499055a3387ef30cb6dd4e6447204b24e11f275277bb83bebceb312854b46f89d611814

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
8b59efcdaa7a15c258ca0f623dd53bd1

SHA1
b10f121fb7c116fde6bc760ff22e7b32b7702530

SHA256
51c9f541ea09ef5bdb6d51fbedaec825792a02c5e661476dc9794009203ad345

SHA512
d86356191fe096246d3ed242c217c4b9baab2d76d84da677dcadab46cc1a4b77773d937df6d29b42fe7c8cbbf280f2573b056551be5b5335b2d9752bffcdb707

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
12670ee65ab502bc67092e64c874a329

SHA1
2d7419d99e512db235aaffaf5c10c279516b5494

SHA256
6a8ff5c576e6f48d590abd5b8233e8ea789ddfbd6b229c43b386b42f89906fc5

SHA512
7011d1a2203e8fb03fa3827f59e005f2b5ef9ae69bce2b575d9bfc763fb77fb42c3ecfc400b46e6a789d482a5937e11117d8132d87b02f6498580b098b1f8ed4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
98493aeef9bae666ceb83a377c5a80ac

SHA1
9194123460c1e43421198bb8f99f02e597bb53fb

SHA256
0e412c339c54bc57fc399088427dcc6276016a880fe1b95f6d4ad9a2d0eefff2

SHA512
ed5ba420e9517d849378d40cce789accb6587ad68404f7c14fd9ddcda9de10d7673f18cf5d13bc586746ea745b100cc2bd741f097fd09f50b6f6da36894169bc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
7117acbe01c96582aaac4b54a7808ddf

SHA1
c380af84077c961b7e34f701d7628c8510f6cdbf

SHA256
733418d03ebdc360b0e16f6abaa5aae46f508e3311604a816e1a79e46d20abdb

SHA512
b323a1a87ea66e275265cb49305f04912e2628c91826765423f0c2be552dc29e4186786c80f2ffa198898a6cc3d407619ebb90ace87440cd7cc4c002a8ae33b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
f38dfaeade4cc44ed0c95b5937555c47

SHA1
52d6e20188d7c8aa42fbfb25462eab518f56d34c

SHA256
a1ea14168ed891557764f748e6574475fb839f2f6dac08618c0c5a497ef1ac7a

SHA512
6e36fc4eb6b07171f1bea3d27e19284a0996b6792b5a18c121231aedf659c1852c63280e05652df5041458cd0965680f26cc4456f6d7c42690da1834c8aedf60

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
c706d2a15c9a2c30707124b5e62ef17c

SHA1
0b8bb51447a42c5530c2ccb6793e551576a11419

SHA256
16bc2af87359ea4b203c27d3a612ae625b931f6de367cc361732518ae7e60ded

SHA512
2d8659359e46fa1de764e67e7a8f536ac5dac60c2361ed3ee6f346afb88c869133cb4439738f7e1fff042f588bf9b271a63b0fe8e968d14e110afff6b48ff6fd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
e56c59dc6bafbb023fd75247185e616e

SHA1
9cf2adc3dc16041d9be2e059220d119b9ac48099

SHA256
913b5ca24f1a64a4624138262c57e26638e62dd20cbaadfc315a61b49e1bef5d

SHA512
1cedb2c7a7d62705d354fcbec731b9e13f48f6ed82ff40dfb18733d779fe910bcdeb435d1da5f6776d05c15cad75b0bd303f581de3020492195205806939115d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
8725a47e2b4a638ecda640ef12c1c716

SHA1
0c2ae79baf09bcdd6e8ea33b5b46bff517623562

SHA256
e57bb69635a0984db010e04121a605566ae715e31387865d04c594c5e3e6a39c

SHA512
8c8a665e5be765e5fa969fa3369f6929514206b06863a64c6922be4600840d56e90626edd80b0afff654bb3f9b57f28a9449d3278dfe801cddb97bc85030aca5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
a2fa414864329cb6af0cb1670e331b17

SHA1
ea235740243c0472f1cad5e05d36039071ded47d

SHA256
f2a2705d69160412b4d61c373a7072e887f7a1a07e5095d94be3586411f85c45

SHA512
c7116f5d03e594016a1953cdf0b7ce777c543c7cf775363be8414c2405fcd37600f597b8fa69fcdb70ba01d40d46917fff07df3ff5f154bf166602f6fd6d1636

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
42cc2bc165ec2a17715085e45b2f2236

SHA1
04b786f366fa92ace208c53c8365b1cd342efc25

SHA256
ed6dfd83b22234bfebbedadd554add9c2b77608e1907a97a6ced3c39c9e2412c

SHA512
de7d642850d117503699dc2efc342b48809c1bcde46e00e0802b261f45f3908766533c0e8463ca8588fd1e7b9b98649a43bcb247ef22b95152669af228006ecc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
54aaacb189f68d4e876d8ba913a1d06b

SHA1
dd1580e73c4f51a9021bd99ddeb2441567bb24b1

SHA256
117642d4b484b152cdabb423dfeadeeb47189636956a6324d440225bacdffd62

SHA512
c65d089701dc8ba3e18a99c28d601b34bc59738eb79d9b22ec5d38a33779eb6a6b93a80e6263999597ac67ce7e1e4ff7e760eaf6072d4bc6d72b73896d0ec66e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
dee5eef7793263e73a2455e46b3198d5

SHA1
46d35e2748c952fd43e85c519f4c326359437501

SHA256
78a65b449e423e3a4f2f8e0a5d17c87bd8767ac0f9174ef0e4ae3da650fb6434

SHA512
86bc41a63a446c3a18d528555f2d5a7ab1452a9adb8053bb032fccb738ebda0a9667cf7fe7bb744ee28665fac2a60f1fd33d582c8ccf608e4e1c903522cceff2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
7c48c0c1487c87b144a782c438fc75d5

SHA1
418f7978643202faa42321b5cfc3d6edf5b4e04f

SHA256
9d88418958aa0822fb5b12a337457f3e798eeaf7a1bc464c38ebd91e9e9bc599

SHA512
4f8e904e8d49c89453f356308f8b2f3db61d29b82c00370686f1f3a04f568eee0eccb24f2e118aceaaa29b878c26d297cd26efdb098a786d5c3d0bf932720376

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
c7c4cdcf240d1a4ad2de3f57834f304f

SHA1
7371145b8388f9b50d4cc8f71e1069c31bc515d5

SHA256
aefc9759b1db4b3b1750653841010f52c3f025529205e48b6aae10cbdd0e273b

SHA512
3b6740c6639e5170785ff4f28fb23b42e767b4d734027e13be8ff5bad8d9fc15098eb238285583e649c35fc3da39e47940d17b5a3e7e4aa8ee65bd1dbc679669

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
fece550d33ea20f8a1b82d3418a17b0f

SHA1
36c894ca6cbc96a6607425f59217e548a767e34a

SHA256
4d0b7507fa93c6991481fef4ea0ece6e3b2fe52f388e270a5312b06d98e6425c

SHA512
2df36b28a315bf2678e87e207398cb5878f6f210a0bfdeac38e000a454f671ab398022d35ee3f125c36e008e33ef7a0a8de58d8ba08533dc3c8cbc61885c331a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
e1415b4df623574bfedfa26e1c48bbed

SHA1
1a78a4fe85b0eaca9ef5271ed5026f016ea82879

SHA256
e8b9c3f3c549b0ae8fefa73d1c74c26c763b530bc4974913a240010b281016fe

SHA512
746559882efcb0e911beea2ae8b9e5acceb78e7aac0c7e021a9b590d925e034394bf1bf21ce0204739ee1af9453576a501487993bec64fe08fa414a357e21e83

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
d9677b9834b2bb7dd6a7c304a4cbe0db

SHA1
92af0c4b21543fbe71e07cdbd1bafdeb7fc065ac

SHA256
65097f220bb2bfac66818e27c37be4026778fd401ef876124fc3c3621c21a3aa

SHA512
e21c1b36dbe061e2ce1b0bcaf58e4d77606739d6a2398c3fe6b7de6dd4bdd0b4091b2458fec5d24def85dc09e10d4b41a284bbf677f633988c8162e301e05fba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
031252751fac8e482a6f167e7cc9e1fb

SHA1
9d3b9c127ef2d6344cc5d1c2be9a0923fae25686

SHA256
d02c584b7eef105617fdc27d52a9fc66566f525116fe284dfb42d3e14ad139b5

SHA512
edb059b0750aa70f4626d7c17377790ecb0a4ed894ff4496d87ddf384a3a3f8228f7aed189b87f0b1d3c5c1303804edaa165aac709d449178fcdd7ab9199a225

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
e40656d53d58df5b9fdb4f01f3b35ea1

SHA1
7392d8b47bbaa03869da935ace42806a01002e6b

SHA256
84b241ee9ba2e115eb51ec12118d61eafbb22dd11f347ec3d8a9b10ecbf070c0

SHA512
32df3ada7982dc96a88b19ba42517cb8e65c814f80c9334677f3f506f7d233be164c148ff179ce5fd9e424016626f133147c53ec1a50a5182317887420a00de1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
5cf0d972cc019311b5a3447d4295548c

SHA1
0d83cd93ef37efa00a5ae95879af8cdc86ebddc4

SHA256
d988c1e3bb552c55dfd8d323c6353ba428075344bf244e2d03ae78d3d5081a47

SHA512
0276dad1e71c875cbb75d08aae6cc899a8de582c31c16fede82afef61d9cd3bc47d09ce2432080fd9ef0ad8c5e23fbe2789ddefd5537b6d5a932771134f773e3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
7ea2b99ebe3464194144168a40f15393

SHA1
95a3649f8014a197fa9f490cad68b78856078a87

SHA256
a5ee4e77c050d600e4f728eb5ed04d1da83f80f56c2bbe77d9d2446260c4f69b

SHA512
3a74f92ea2fb0a3f4b439cfb4ef7028c05a7d30015407e72da16519802c5a29ebad77c7d6031e7e795c912c318062c44b711f77d30f4b9a47bf057c5d0299cb0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
493d4d32c2d7882e402df41e5814d993

SHA1
d779cb63202a4c4eaed4618f128bae6d01739dbb

SHA256
e50e9b2f0179949ea33c4e4c6d8a926528e141550bf9330b941fc4cee71e06a1

SHA512
b338c7cd356009244ce4873e391652412e33cf36d4c2e116841caa04e03809f012c7c1f2ffdaba4d3f4d9fc1746274640481cc4b2753e670bce2890efae4c966

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
3da00db641424d7bf3bf8cc69bb4edf4

SHA1
478ffd602cc7d97f60df49266027440ea1b817c9

SHA256
d380aaaf452a5e5138fdd6219ab2a60487ba57a763a065b62f6f70be38c22369

SHA512
65439f98ccb1a96e2dcf60d651e4ea1a16e781ea31c54a51057b80ae7b36acfc4585d7bf22975b8a489901985fb4c2d1d50d205a0ca58e777eab857f831038e7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
2903bf168f9a12f220165e987ed75cf3

SHA1
5762ce12c5061d75089b8155891daf7673aeab09

SHA256
c5284b0e979facc8f9730d930c907cf367867b5980c677a015a76a6b7f18c3e2

SHA512
bd561ef98214870a4b399dadb26959b56120e679f6c6342ae9933047b841f7ef65264a7a531984bf93ff04a2b1737d94fdb69954e87b11bf841f3c5134c77937

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
40eb6fd3a1f7c81698dd603ddc1313ff

SHA1
c027733b94c56f3fc9d3dd63ca5c73aa6444f0d7

SHA256
c9498fb502126edce1932e7ae31d1e3d35049f62ada0ce0695656c7a370dee2e

SHA512
8a896fa5b789cbe77752c063e80ca7726653be648e61b4f80f01ba210c6e6ce12de658acd7525e2c1cd3bd9673553241b2c9f435526f1b044d0afd435322a815

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
08403adec87cb7a9ca345a4397a6e0f3

SHA1
faf84fe318bea999da21c0aaafb08ba9e46632aa

SHA256
900f5a8897d08e6bac88c44189f3869b666e0e3391b356f6b821c0302159e863

SHA512
cba9802d33e1acd07479db545d97626c5c0371cdfe5d3a3f73d85a7f05a3118ddaa15674a33a471dadfd39d2d2f53cef0c89e0e5e54b81500a9ffde82a78f6d9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
27c3558b8c60dea44e92754aa0a09527

SHA1
135a5cd38df4e6674485fa8d14ad9a3350e8fd13

SHA256
bba85aa20c56bffcf5b6476b8864597d8476fd3142273cf433051d6a5faa7762

SHA512
7aed65939a65ad42c7964f99cd99ed1b895d88a12ed2230da67336ea45314a5dc77c7a3f870dd1ad27892a154f7c150fb7c27f8a5881826acc12570a1b5e5a18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
381c08a9d5a9e965bcb812c41b25a0a7

SHA1
efb243889457809aef7608a9efb171d131e3d4dc

SHA256
6d4c79fedbd41e93d9b5017928626eaa88d0b1a9bcb8d06f69c64823b80dff05

SHA512
76c1dd374ae606ac098bec923db4ad03ef48e31827007339109c411dfc86f4f1fc3bcadc325b4bf8c3c2011af5978facf86f35bc9fe5f8531bad8302226bcbb7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
8f87d6dd396208a1c3838fbf840a1512

SHA1
5a0f60f811c1cceeaf5508542709e3d1e2eef023

SHA256
f31d5c6aa3d23e724506ea2b83e9d6001e314673c99dd222253205117f075f01

SHA512
18c3a963321aa145dc453a8ae8d2b7a8229161e69844473d6cb93e1ff8d0c4fd2afc823df30834412da82b8dc5e31637bb75ccb739425ea02cec5bc5e744eadb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
8a504b0f50151973017302687463f817

SHA1
a6f07a7c1d4dfec243604d35cd8598ea65b19fb1

SHA256
b8efc9621dd3abb02672121d341aa258badd0deeef5b19aeb7d7ddcf806c1889

SHA512
992eb475ae5de28db2109af22461536cb5da6287d5469993be1bd619850fd299c4182348c9f3d78553a3d422e182b2f391e30c4b96ba81fa488afabb6d48d429

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
258da82dbdb58e7533631f79acc49009

SHA1
e817164da4f1b790d43e998ba86821614c83e4a4

SHA256
5956a66754ca6381de8daa48381429a4ce4478db226e725008d9e366ab8baa0c

SHA512
b33e12f32efe6333f16fe67e4976b145ec6c847279dfb0c5faa82d52d85df20e7d244a362f8fc7bbd757fafedc319ef35319c95de5098c595eb37924f511f21c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
9a4dc3352536f0270bf6d314dd242ad9

SHA1
ae1a17752f2f389796ac91ebd0da9101ee1475ca

SHA256
a8d2c60716ec92118e5305051a841117b3bbc2ffeef06cc668a6fb2c4dc047d8

SHA512
a211931f6b8f5ab0598062f6ba802bcec5fcf83ad1c75bd24e4dd51c509877b306d3135fac641a22c9e0473a8941635cc0e3c713dc7131a4e52750f6cca6ae51

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
f9a3782a4a14277d80751b1ffafe875c

SHA1
d68243460ff63f95cb3651c0872a1926b03aa0d4

SHA256
a17034f4625e4adafad954466a5d89011aa9de64f170e618bfc262060960c111

SHA512
ab3f1c71e5119046a835e37b4782f7a3fa321178c5c9acff16a02c71ff279f5f37df6818c31ef17fb6ddc8d2d7f2b7759894b8bd81c39df214bd69b16f7ec22d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
cb0803a538e5c792955469b1beba0f39

SHA1
1520bab1c842bd90535d76c6dc42fbb63e8883bf

SHA256
3d5976d71aa3a0388bc1b5825ab7072dfe779a3fdd922db43c9fe18535c7581d

SHA512
a3b45f5757f3723074bee72c8a0bebf951bec4c4042412ff764f2fa20d2e6889724bfd20ebd147027aa1522b161948192a3a09ed762b627d5f4c4ea74df9b8cb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
0e0c8d023321b01d4ce6c92d63f2b880

SHA1
23f8773d05384c2371383a68d7b2ad24c4aa07f0

SHA256
8d2d8bbfd9b436a4da99cd402187249a93c0bf507a1df367953dc4a4ef5cd6bf

SHA512
0e59492d63864a473ae5bbc2076f453ace190a4168a868be9eaaed18a1e642985dfec7520f614707ec2d099c9da07ed9b54d7b722d527a4de6865e393c73251f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
47686989cd08e75eaead8291dfcb0659

SHA1
61842af5306e7da8f6be770ccd10a9a8b63398f6

SHA256
86725623321dc7fa3ddd5779b371f233392dba49f2806f94b5461934c15327ce

SHA512
da6ab24ba5c47c1d96750ee90956248fe212982a1e89146bfc29b947d778f39d54ddc9c561058d0f7fdaf3543f6ad09245af6cbbda66dd1ce024dff79a0cc7f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
eff90e51df303e1e6136cb54de1f7ddd

SHA1
38d876b496223c6d6c01a2d415dc6c2f7161169a

SHA256
6e01b51eb000820a1e214d05ac374e6a9ab9b628f14562ad0f2ab07dce6cc5b2

SHA512
70da84fe9a08ec9640d28ccd6c14dfe5f592644183b2fffce1759aac3761ca6c0a3f8c05c02051f1307e1d7f56ff2f17bda7487a3de508ab7ecea6f036f4bd3a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
65dc089c9f7ee08e2cf5e8739f9a7460

SHA1
581f269b12396014efdc33529379be23624088fb

SHA256
c3c3346cefcfa52d8c8304b34a059a9fc391494627d97295c76ff560bf645445

SHA512
bbdc60551a20b484f5e90b97b3161b1941e99e55f732a3a4adcc028d23a4bcec5918198b0a0ec353483e32f1f320b77506773ef5e9eeb8cdd4cd2ae50ec62630

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
b6ee89ca7b7aa46d47df90a493b06cff

SHA1
70d020aeeb945182d84022f99c8111c8f75942f4

SHA256
bcd24e8c93be72109f3c590c9ba0d6a6a4c4de7e436ead7b24fa55fb2ef9ba8c

SHA512
0e257038f47da65087ae29551ad9464c05d3f88a1731b73fe790b9775c9b901d14646e4f251f3f9a07cbb765414b96d4f36af5119914283768eab77241ae8eeb

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
c24bed06f9d37678547e369d21d81703

SHA1
8ae160bf9c89239278f886958e798e1cc2d75285

SHA256
d0e94ad0df9568271e812031926b4feacee4f40e5055c35eea1c779050806388

SHA512
00e1318811f53b91157af339ab847d87ab412186c47e9c556944199305d417c82baf26e6ee367851dc88c3eaf65ee36be86ec0fe8b35244a21a1185eb9a0f3d1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
d2e238a73ac543be5a94c32a677a3c5b

SHA1
41c7c0533fbb2b80d20c71b1757b0e3ed52b8410

SHA256
991acd5499ba2906b48b573d86d3bf7c0844ff510a66526716e58ae39d3168bb

SHA512
926c3a65607896407d2f08435dff1ee63d0c4ad4727f34136958ac72e5ccbf80953b73f370bd5ad05293ea07b906a9e51fe5500fbd00106e88888179d23bec62

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
170a009f286f64b04983a2cb0d6c0a6a

SHA1
9d93680ffdffa9ed3fa3a2c27526a26c088264d8

SHA256
6c894f58c4da7248016f46f5573f2477ededf3383b5abd91632aa7bc3e8e9e2f

SHA512
1ff647d65606a8ed746532d340aee4d0888cce4abf64c4c87ef7dbe6c98b27ca842b35eba880bccbcccc6e36e2358fc2f60ad1e241b4ab8472c2d8c9b9af4bf2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
9c62c0343da69daa97dfbac108fb505d

SHA1
9830904f183ef2d8477806c1989e3100c7c44e6a

SHA256
5aadd27f7d6fe4334cb929732a45a4b162c062e39aa485152e00c668fdcbe4bd

SHA512
6e7255a12de373645ed31df9ddd3f855dece2db9ba91694f7a47d63ec6135a446b0eb6b99875b659b258aa1f1b228dad14fd1b4426bf4be78c2dbfecca044ccc

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
a43208416d8efbb316dc51718cf78ae6

SHA1
5c63f432ef8d6420e0944b426f11710a90b19644

SHA256
139d93b4e621e7fb6c27c22bf49b5e8d99d859157c082e8bb0c7ec8d68d54e3d

SHA512
83d0bf95e05888c9fac2b456af542ec34e51b1d96095a49e14f0a645bcd39464434afc0007544ee1880a1b718772be9a96abd464524b8bae4af1875d33e289f4

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
6f08c5d373100227c9cf74702f13ed5d

SHA1
0948fc745b7ead85b80ec2da3c3ee671d59e7179

SHA256
3d2c10ec591666295411fedbcad978fe2e9b40caa786d141e54d656bba6e41bd

SHA512
937ea0b91ea16cad8c0f6b25aedc26f9599afdb4a4d761a65d971d1543b1c4680001df686676946ea5354adf6fc90586d700f5c8e787abca5be76b1b50ef1bf1

Download Submit
C:\Users\Admin\AppData\Local\Temp\sCheat.exe

Filesize
406KB

MD5
af14998ea9c9a7ab8250a8b9243b5505

SHA1
a868c979df09e426498618cac6301cf9d23e12c8

SHA256
469af5ff07386de5c8a0d7e6766820f76ec550ed730d108f7f654053f4d7b3ba

SHA512
50ca46efa70cdbe3dec881989dd79a099ec2076b93d7cf6a9a4a728ca26cc276efab534e4a9fb2e0e8bd8a22fda7fbc4cb5603beeb0e592b6d5c4d241d83eb39

Download Submit
C:\Users\Admin\AppData\Local\Temp\systm.txt

Filesize
34B

MD5
0f6aeead10fa4e4345421a9344920b54

SHA1
8c3fb95046aa8a49de5e0125a1734f6a61e1de9c

SHA256
f7fd935a5b2e344a8528c666005d010bb7fd75785075f4dbb89973f151409ee4

SHA512
dbd688e79df1af689e583e9835cb03e22769313ec38f69ef59934258f296a40e8495b62fec47ee2b60e7cb531b917ac23ca16f14519413c637588a7522f0eca0

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
38dc44af8d6c2091a69ff67ec54cc3a9

SHA1
bc3a54a7fa9751a3e20c1e9df8173636edc9c249

SHA256
e19617183fc2b44109a3a22e21ed995666f0fd682658bf93b6ab8d89a86ac7ea

SHA512
5285b08c6e6bd1a723e9168e92ec74cb5f42d2f79319e064cad3c4117d8b27eadb1f161e975b92d030d75d10776c6fa5211734333daf0295f78225021a0554a6

Download Submit
C:\Windows\SysWOW64\coder.exe

Filesize
7KB

MD5
d871ac0f3fdcc234f1ba4f39bc76e6fb

SHA1
010fcadadce613eb45923dbbdee46440e8f74bb6

SHA256
08e15773a4caf5225e95ee3f9ebf2ca67b3d500053fb316dea875d5cf361271f

SHA512
0f56b1689661bd0978cfaa16876bd4b2ab3f0b1f6d1ec25bb09d1ea7e9b0a4e888972dbc32d272aa02ddc646061c901c6fed8de586c9406e56c4b9b925dec114

Download Submit
C:\Windows\SysWOW64\mbr-locker.exe

Filesize
10KB

MD5
5201eb8656d7f823e7d5253aeda7b5f7

SHA1
01ae8f476827afe420ae806c1a7654770342ff1c

SHA256
6e657c98282a118321c09cf76edef34deeb2d067cea41f4c130e32044830b865

SHA512
1b3ad3a18801c02522b069eee9253ddbdfac7414531eaa4ec9211dc7f3ef051e4fe984c451309f1d265bff96efbdc10d5004f7d5b329b20c52a4861a0daed923

Download Submit
\Windows\SysWOW64\îáõîä.exe

Filesize
22KB

MD5
e04fb60dc115ddc2368000bf4b7b934e

SHA1
60b33f31232a454120e1184bbc502577b9fe3ee5

SHA256
c1fc945b7aeca62e7af8b72663aeb676274360e0b05a8b1a12342e11e25ac109

SHA512
e59c2dc3e379ac2da1cba83895c9ae93f0a64146ebb593185081161aa0e88a9ebd617b57e0aca7d2f5e8bcd051460252ed8261b9f2cb7611e40bd98e448b5fcc

Download Submit
memory/1532-726-0x0000000000400000-0x0000000000454000-memory.dmp

Filesize
336KB

Download
memory/1576-221-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/1576-7567-0x0000000000400000-0x0000000000473000-memory.dmp

Filesize
460KB

Download
memory/2160-131-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/2400-28-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/2400-26-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2400-25-0x00000000003F0000-0x00000000003FC000-memory.dmp

Filesize
48KB

Download
memory/2400-184-0x0000000002AB0000-0x0000000002B23000-memory.dmp

Filesize
460KB

Download
memory/2400-41-0x00000000029B0000-0x0000000002A04000-memory.dmp

Filesize
336KB

Download
memory/2400-29-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/2580-111-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/2580-35-0x000000002AA00000-0x000000002AA05000-memory.dmp

Filesize
20KB

Download
memory/2792-27-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-216-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-7571-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads