xorist | 5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 20:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Size

7KB
MD5

31b39332874eca4bca19319073c479e2
SHA1

2038839be53dc9ef2d3981d2ddbfb8ff5cfb2eaf
SHA256

5777ba5324a693756b82284f7388e8b57a8ee3f014cf09b9127c9db06269604a
SHA512

8347c8b63d03d1248e1b505ca171837a0a73237183b14ab2044336013c06cc0cc8f651baf33b5009b4411ad40000e89e423463f3f7192e5a69e5ed388b13c301
SSDEEP

96:FHZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExs3aWOjj7jRmW+1xSqMB:9zdrr1FG1WDCgmjPZs3TgXMlSqMUA

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 4 IoCs

resource	yara_rule
behavioral1/memory/2096-8924-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2096-8925-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2096-9157-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2096-9158-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (2212) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0g81EtiCH2QMn87.exe"	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpn1.inf_amd64_neutral_e44cc033b67e7d04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dot4prt.inf_amd64_neutral_e7d3f62d0d4411db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_trap.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\about_BITS_Cmdlets.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_command_precedence.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmracal.inf_amd64_neutral_857b8ff74e5a7073\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmzyp.inf_amd64_neutral_b64bd08009e7444f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_While.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Arithmetic_Operators.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_debuggers.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_logical_operators.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comment_Based_Help.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comparison_Operators.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcommu.inf_amd64_neutral_83cc415156be45c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-StorageMigration\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\elxstor.inf_amd64_neutral_4263942b9dfe9077\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnin003.inf_amd64_neutral_3a3c6293d0cda862\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\shared\res\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_While.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsun2.inf_amd64_neutral_242c76ad2e288fb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_neutral_8b26ad5d0cc037a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt004.inf_amd64_neutral_f5bf8a7ba9dfff55\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_types.ps1xml.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\faxca003.inf_amd64_neutral_5b8c7c1dda79bef4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pipelines.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdri.inf_amd64_neutral_86bb50f34c49ae71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-GameUXMig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_jobs.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nettun.inf_amd64_neutral_bd24fb174fabec97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Session_Configurations.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_History.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Quoting_Rules.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Ref.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\igdlh.inf_amd64_neutral_54a12b57f547d08e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_data_sections.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsa002.inf_amd64_neutral_d9df1d04d8cbe336\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa5.inf_amd64_neutral_ea8128ac5da37eb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr00a.inf_amd64_neutral_6033065925bcc882\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\uk-UA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr002.inf_amd64_neutral_ce2134188ab21f59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_ISE.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2096-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2096-8924-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2096-8925-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2096-9157-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2096-9158-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\logo.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\15.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_left_mouseover.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\THMBNAIL.PNG	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01236U.BMP	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\settings.html	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382966.JPG	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03011U.BMP	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01237_.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\slideShow.html	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\zh_TW\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\1px.gif	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_over.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2B.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\HEADER.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_snow.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new_partly-cloudy.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffffff_256x240.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\drag.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\settings.html	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\back.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\va.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Office\Office14\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02069J.JPG	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143750.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0202045.JPG	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\reviews_joined.gif	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_issue.gif	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\Main.gif	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14752_.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21504_.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\HEADER.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\video_filter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\DW\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_divider_right.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR16F.GIF	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\cpu.html	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_content-background.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341654.JPG	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0178460.JPG	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_pressed.gif	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\29.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\More Games\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\picturePuzzle.html	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\StandardBusiness.pdf	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_functions_advanced_parameters.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..tlocation.resources_31bf3856ad364e35_6.1.7600.16385_de-de_072fe70b1d7e90f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-muicachebuilder_31bf3856ad364e35_6.1.7601.17514_none_7832a1aacb77df29\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-u..ationcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6676e06742a646be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..-provider.resources_31bf3856ad364e35_6.1.7600.16385_it-it_82685c3165ec1ed1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.resources\2.0.0.0_it_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_da-dk_ff2b8a4884ab92de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\500-18.htm	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ftp.resources_31bf3856ad364e35_6.1.7600.16385_es-es_11c077150164ec89\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-van.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_131456d641478b64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmaiwa4.inf_31bf3856ad364e35_6.1.7600.16385_none_0a4c2d2390747c7a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..nistrator.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1112590f53def0c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmi-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_d33f52c4d452cdda\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d56a30200eef5448\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-netevent_31bf3856ad364e35_6.1.7600.16385_none_5a1caea4cbe265a4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\Boot\DVD\PCAT\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-0001042b_31bf3856ad364e35_6.1.7600.16385_none_fc100c396281ee83\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..aincompat.resources_31bf3856ad364e35_6.1.7600.16385_de-de_04e121dc34bedd1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.core.resources_b77a5c561934e089_6.1.7600.16385_de-de_ea7f9306bf75036f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.ServiceProcess.resources\2.0.0.0_fr_b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-controls_31bf3856ad364e35_8.0.7601.17514_none_42c1a490dd943b8b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_netfx-aspnet_webadmin_roles_res_b03f5f7f11d50a3a_6.1.7600.16385_none_5c34e511d6176915\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00000412_31bf3856ad364e35_6.1.7600.16385_none_43a886587d9fde59\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_functions_advanced_parameters.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ting-tools-printbrm_31bf3856ad364e35_6.1.7601.17514_none_dfe02de35bf41e0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..ylistener.resources_31bf3856ad364e35_6.1.7600.16385_es-es_67e3340746b4581a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.AddIn\ed852e32514b415cfb4ac81aef9ac0fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\inf\ASP.NET\000A\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0012\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..nager-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4e7184a05a464c74\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Redirection.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..terface-remoting-ps_31bf3856ad364e35_6.1.7600.16385_none_ec4c512325381e78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-http-api_31bf3856ad364e35_6.1.7601.17514_none_53d2426eb3eb6414\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-edition-transmogrifier_31bf3856ad364e35_6.1.7601.17514_none_17983cea99707d4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..rface-ldap-provider_31bf3856ad364e35_6.1.7600.16385_none_78226e0a149a912a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-autoconv.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_918f040171f9e5cf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..e-diagnostic-module_31bf3856ad364e35_6.1.7600.16385_none_501611cee0eb67c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-devtools_31bf3856ad364e35_8.0.7601.17514_none_b4855976cd77e0e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..nts-mdac-rds-ce-jvs_31bf3856ad364e35_6.1.7600.16385_none_618fce9aa33b1d9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp4.jpg	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..-mcupdate.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2d7fcbfcd4689d82\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..esframework-msctfui_31bf3856ad364e35_6.1.7600.16385_none_90e0e8d4377a2ff6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-wasw.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_addd519b8d9fa248\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000447_31bf3856ad364e35_6.1.7600.16385_none_50349038b09403da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_try_catch_finally.help.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-feedsbs.resources_31bf3856ad364e35_8.0.7600.16385_es-es_62d5e8dab0b2dc6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_bthspp.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_96b8910de8c5c670\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmracal.inf_31bf3856ad364e35_6.1.7600.16385_none_94654f616d035e4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_moon-first-quarter.png	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..oldertool.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_41f6f4bfb8f74cc4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..gevolumewmiprovider_31bf3856ad364e35_6.1.7600.16385_none_17aa1c2a6b40457a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..ctshow-dv.resources_31bf3856ad364e35_6.1.7600.16385_it-it_00e561f494950570\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-opengl-mf_31bf3856ad364e35_6.1.7600.16385_none_27505f112f7632da\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.data.entity.design.resources_b77a5c561934e089_6.1.7601.17514_es-es_98641e8c865842d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..er-office.resources_31bf3856ad364e35_7.0.7600.16385_es-es_04169dd92e463986\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-taskkill_31bf3856ad364e35_6.1.7600.16385_none_8172f0ac75c192a6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..mecontrol.resources_31bf3856ad364e35_6.1.7601.17514_it-it_6bea2b15c90be7d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_hu-hu_844f0ce25f4e0ff6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Applicati#\01c92af8d09572a4e4ccb46e3cd71d3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\inf\MSDTC Bridge 4.0.0.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Diagnostics.TextWriterTraceListener\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_unknown.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_bba07bfbb38eed30\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..vider-dll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_fdcad8d0c00fea24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0g81EtiCH2QMn87.exe"	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\ = "CRYPTED!"	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\DefaultIcon	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0g81EtiCH2QMn87.exe,0"	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell\open	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.4500	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.4500\ = "DKWJUSNRKPYSAQA"	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell\open\command	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DKWJUSNRKPYSAQA\shell	31b39332874eca4bca19319073c479e2_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\31b39332874eca4bca19319073c479e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\31b39332874eca4bca19319073c479e2_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
313B

MD5
cdb3798b506c83415f1ecac9ed49fadf

SHA1
ee0bb0481ecff660fa164ad01a86965a427394e9

SHA256
1a87b80d731c0823b0c4366d87f87a6a392193d257cf24aa4f3e37f31270a73d

SHA512
002541e5d21f8484563bd180b01897f9403b320040d86d7a247a691191826c0ea227e8285f4a3919de05cbcf4c967e7f55d214cc19461f412156646572c91f88

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
bf9030db63ab685dbb4a901d2107bcba

SHA1
5352e4b771fdfd8ea977e6480f581e3de1ea9ef2

SHA256
71087c44aa4fad11de15a30dbb1a3ab76a03325080367b53ce622fe9e1b3cf9b

SHA512
a445994c5900f681f66cdc479fae590492d5b6de422b5687ee193034e82cfd5efc39644279919f87b63464b99ae98611812662a2acb9f080dd89ed2240919549

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
13908f649c9ac359441aeec3ea5b5967

SHA1
daa0bc5a7cf754c50052039408b61b30cd06683b

SHA256
f7b5e1d7dacdc33ca4aa9a44ec9812e6e1584a87de22c8cc0b9f906068a6a24f

SHA512
1f4abafadd0e9d313cbe74acf2e48efdd8bd9aef502a0cfdb44d76b1857d069ee877ddb349bc3a9646eacdc0f203a5aef722227dc244dc4f62e9db72298a093f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
7a14c064fd45e91f186f2278bd627208

SHA1
f01aba9976e11c68ec44dff80f9934db8b3f4f02

SHA256
3502a61171670ff8bd2da79ee88202d50596d91c95ddb01e770a7838a2999d72

SHA512
865b7a3095bd2d37ed89613065783c99c361dcb8a807d3c80d4e7958ce625715c4c1be1979f3002e33455c77b2c2601747f85ce2bf847587794ca4837cbb2519

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
eaed1550c5dfe78bc92cec6bd2df273e

SHA1
d85ad9f2a2e39d25ae7e8817d68ab832d64bcbab

SHA256
79a8afa229235ceca01996ce0b53a28728bbe353bbbe109802e8c898f420853e

SHA512
e462fcc55f1fc4c04dba8bd014dee24df3704cc6838c853120727b39623425a83c4f4a92d4026986d6993526f0af798af6e1e49ad0c67fe3a4c90b2f5c92437f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
6fb56b3ea2f4cdcc79cfc77a872d8623

SHA1
6aba24fdaa87031ecaebdbabaccf639eb763fd16

SHA256
5fe64b0362d14f44a31ab9adb6e43e6c5ebfc52837b503d965ab58604babedf2

SHA512
fefd63d87f9c91d62a9b7ed6108ff7b3f673bea6066e2d241ecb4d815d29fc84fd1ea0b5f8133465c4531facacd2a3ed96f4141e7dcf3171729a361dcda48333

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
a6af9dddb42a462ea8939b9f4b0fa194

SHA1
6b48d139ad9b7dc1aec8242e459098e1552ffe45

SHA256
ce4d4bc8e1ff048c638ac26d3d61b1ce215d4978d16fc71a568f4c4ab30f8763

SHA512
af2b6e5d9825e563ba94b3ca8c98fa1c7d2c33e6ce1cd827ece3d8ab26b89cdecaf475906daed17e54b44f61a53a1eb5c2134a02dc258cca08429adea94dafa1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
578ade5786ca5cfc6058cfd382e39ba0

SHA1
67526d6a4374575790ee87a4636af7a2ac0fcd13

SHA256
ec441880cb9665874c09a23f2499b81dac08ee696897141ff4d6b005574057fc

SHA512
1f94b8b60c6fbbac30d129a3c92643743d66f48510df23dc7f7f560186f722a765480ba365dde0ac9a923aabe2ad6a93b9ee32f635ad3dc693d5de480bdbe921

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
95239a44754981211a39f8f05f95b5b4

SHA1
3085718e119a2d60c9f0e5e5b37e8e0b2b60e7e5

SHA256
9f04f6b3f75d1b2754af19b66d5b86e052697eed4563fe33be9083d2dc3ba3f2

SHA512
7f03dc53aa1e5792f4310906b2f4a55a7fe54d5dd0eb193e6a90a224783138a0ba0a3b6a18245df05144dbb6e664ec2a28e79b1d34b31a1fb3148e383e8bbbf4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
77abddf73ca4b126802a9708e93c492b

SHA1
a7520048a503abae4d7a16c0f55f6f1b5d03234d

SHA256
9071a3971ab00cf21c05296b50d8df540104f45d600826067ec73d18533d4553

SHA512
9312430b80a5f9c79ef8df90ddc3443533d65962c9c5e567e7cef88d1ea02e982d0fe9bdd8fcc2984567b55cd596658b79b207674be339f5e9a2b0ea11dbc016

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
71547d510179aa14350f5119307f6f38

SHA1
766ff64b89cee424cfe7671807bb4d429770da6e

SHA256
a21c4cb6904b930b56680e56deca6939ae7da83a8589d655aa44b57ca5edfe66

SHA512
1dea115c37daf46b73416f879eab15b7dd6eafb11db3d83842ea7b451f0b302ce5fae956e92e874136acbdc33a45d7ba718ba70e8d4c750f76e002dcad234cd8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
b1b4fc1f1e09ab1e9f9d62967cefee69

SHA1
0314213580e739fdf8b08f60cd0b18e29930d2eb

SHA256
17c9959a8b69b9c973c7cb432f0517601c946fc247ab845498f7aad8b7586dab

SHA512
b9111773a8add51f0a9125c7456e13c8041e5173923b1200270854c94743f0b1d702e33f2619041af675ef5d938c65e46a428dbd1ab294f0856011d3f11034b4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
4307ce3f7dd8c62968addedf615fd316

SHA1
42a487a36bbf6044e4a348224be763712d637ef6

SHA256
4f4734083d37700a035c9ea63b144b3c53cafed9d88b4995b8da5591157923be

SHA512
34118e32659e68efbcea5dd56066ebcbfa7056e47d17b795f6ce69976177e419701dc56ed6dfe549b4f0ed8fc109c7082bec16845b94ecef2f57f2e5da7a218e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
7201ecb24c207fc2cf5031a3b357bde4

SHA1
384980539193fc480b6ebf1ec58c3a815a90c284

SHA256
e1c73b6314327045853fab2a62596ff0fff436375b35efcb3d26725d6637d6d9

SHA512
1de74142bcfdb3e12c8b5ec7e049d3c4ca9da59a6762d02e9ce9e11349946cfc302d3748c147e967a804f907bc3784b36bbaa949b0089c2f1195f80e8f931d5f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
6887a77dbe50bc8eaf3465b103e8bae0

SHA1
ea86c180ca51fb1805721ae701376724032752ba

SHA256
7733ac2bc2a0a9a648d4bc17ac0020f325dd18dd60ea168e153589b0a6a980c4

SHA512
c63e812a99b295329d31d51482a29e894b5d89286c03a655bb3d0b75d9cbf1bd5b0781d125276d6b01f81f05284d9d898fcf86771999fe84e5c527aec855eb50

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
2e786cb809c7c1984fa2754a8c973268

SHA1
cb6a3b2dbe8733fcf919817b33d7737accb5653c

SHA256
a7388287efae1c8735d1e05b90f5a59735a805357ce8d91be1c8e870475e2f3e

SHA512
d9d86b589ccf44694f0fd0a18d73edae99f3816ec643058147c44629a9d79a86d0a6d49d568227414b2b72fef2994a826c72156f5c8e3c534f50c2a50a2f9e3f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
10939cc22c7ad72c280713c59b075809

SHA1
fda018f21ff43fc4bb7e6b9bdef168a9c66a0b21

SHA256
d23a32b57c0c52776d8b79350beb6ba7ecb3c1153ad3068c088d7df32f773529

SHA512
b38e1e9d300a01b10288faf109eb6ce609979e78d07ff69574217be1df872388f0eda7bb4630b1dfe4e15f9ca221d8a03982d87366631841c5cf8bdc56dcea0f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
0382c1c9855f7ae08bf45fb32ccf90c4

SHA1
3ed5b5942e9a2eb68ed63b100ad0137e94970721

SHA256
5e960ce28bdef67b291728d8353b27dabc6445d95af3673204646d606a17fa4a

SHA512
9e36ab84659d4d6ebb85d79ea9c2d35ae31836fb4d7abdb151c4555f6d27ec160c1b59a68c6c09bb9cc1aaf9a7b841be63bca36dbcefc12423b72302e906346f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
3aec257fb74899ca99c2e654aad7aa05

SHA1
de5576e38f2427d4215524e0b0885f1f8e711136

SHA256
7976b6787c5cc87bec46600827452abf3fd1eb3735c8c0f357356ca2dbd29b2e

SHA512
b68e5e42b633ef368a7ca19e725d58f576e9e22155c8476d56e1826209387bf1d2e6b6d9ffcfcab93637330606eae7444f4e2ad9e75aa80c75a9b0466f30c3db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
bf12f387bc11468c3b8a5d9f9957fce4

SHA1
cd70208fad7a625945993681a4b48111b79b32c1

SHA256
efa07234113144a2c044dbba2ff90263887bc8c15c861bd7522930f4ead330be

SHA512
5678ed2a3b67f34a9f000f530d2d80defca5138136efd8a15d398b2ab307b0c2d49a11b685fc18b80dab370c8feb97ff144b4c28113bcd9908f2a7f23b00ce3c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
6126f5cca50b340194bf0fdbd2bec1ad

SHA1
2ccc3bad2a2727b299e9f1f174f9c5c22dd13d69

SHA256
1d435eec50276655a037cc43bf383d2d46d3269d3a9d00532bb3e3e4c5751cb9

SHA512
41493ec34d522a644cc606145aa54362dda4295f08b88514541897003af2997a4f9a7acae99b4e6c2b90ee4cf2f6a50f7c5d542a3a34be950fb429c55b47664a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
c913ba25798d713163003eec70cfc83f

SHA1
2e327cc209f6af2f07ad8c4621cea95b45da4ad2

SHA256
eae6b5b3e3e92875464dad9fd5e0774f7e0b110b0f7628f1ddb4a64856c8b6d0

SHA512
54652caf535a62e0a3c0f9fc72c967c73aa7d23f500c208c7219202b63e5501d6ffe9f3bc0835d5088535f2a55d17e3e8ba7ca39290fc7e2553dedc1e06d8438

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
f7fd58645fa8d39fb3f72694726c0bf4

SHA1
e8f4a55cfeece6e8540c80883fcd1c1e6eb6a9b3

SHA256
0c2426fc242eec9b2d8fafc04bc7611002d33288a125935f0cb79f344735ea78

SHA512
67995b4ac26a61a77da58e9b633ca4113bde1010df28deb690e978301bdeffea0ef0891bb787fed425af2c0f34f45018fa5c9c1e4fba5f91f77e6a2a261f14f2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
024c8cb193dab7ee13e3d31442d7661b

SHA1
0ec5e620fcb1c7219359467f41df23c7c7e7c66d

SHA256
5c8acff066aaecb3e2a96097b0c5ec42589bfea80d515d803bbd21bcf13f1e23

SHA512
9b9d4cf85aa036c6843815f1ad32f58f0be01c2cfadba29737489951da369dfcdd6af52d333143906774755e339b26f7fcbff02243ec97de315e7ef7ebf436a8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
1f7d25daf56fc2866d17ad3f05d8ec2d

SHA1
9a3ff106f89fd548234f06881b1a2056ca697a89

SHA256
dd9433440ed4d69bde53eddf72969512b3e4ebd7426d1920ba124e7b12d26212

SHA512
e795924aa266748ede5103a05fb6a3d3d5c1843a2a82cd987b6a71590c5f95067f18346860003db366ce8144b3f06c7193fe6c2d03166b8af03727cc592ffac7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
e05818d52c0dbc8bddd017de2d9b543a

SHA1
6fe9c8030f0eb80fa97526bcb0be9bb88179eb8d

SHA256
02e316e76db7a8a0198c828bcc7320f0d03afa23aa0378837d0bc32d4e5ba97c

SHA512
9cc79e76f040242d372c4a2a2b7e60ebc0da37583b83a5dff3fc69df187baf2b0ffb599be7a9605cc3fe12c0806805cc2aaaad3ff65046db758ad8ff927425f4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
a000fab7dea7350d658fc8a179d28a3a

SHA1
4e382d1092ee08efab9848047ed720eb9071eae3

SHA256
ced17005cd5946789f060e0823fbcba4265b2d1433d24d4c00ce44b3a1dae324

SHA512
fde6aabb9695c8e47d9d89ae02e02899f0ee70de6983bda901b3b46b0e85815d6902ba3a8d797e15bcba5906549b394e88ca6a68e5aba0d95277bfa9fdc6e16d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
01e623b0509349ce181a0b45a08a2a61

SHA1
1ab97f3082a698320b39d89e435b600e10052e1c

SHA256
c737cfec14e6d4a732b9aae498fe86db2877427a741a5af34d17618c62556647

SHA512
46aa3a3c5a9ca563ad9673594be658e3efcd3c4b7260c32541d939a562776d33d73df8731ce4430a71ad872d8b31a74404739fbc7a06ea52b6e25eebf0041350

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
a546276757880b199d95bcf7ce89a78b

SHA1
e9913a6163dd691f8b5511037a83ebd88554376d

SHA256
c2caad2f24979f3c1668227eefc5ffab64fbc5daed44f1eed8fac6738d98d900

SHA512
17781d7e17fafdd8f0c99992ad6f38ecbcc02e4a19275bdd4f9084c74e386bbf7e4fe567238278c1900d8c086693fcfdd468fee6115a23fb9589cc8aa2f305f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

Filesize
3KB

MD5
d17f2b5cd0f7147baac28b6eb7b3ecc6

SHA1
b02536277f863fc5e4250a619b1c1ea5dfbaffa3

SHA256
0de80a4e5a93011fb73888a326fe4cedabddbdd47175df4f810068755a7caabc

SHA512
21ebfb6e59c0e002b4e7b15c5b67fd74b40bcf88eb68992080aafd358d050ddcca515d86f10067eba2462d0baf032e2f4a8d9e234d07a512ad310c5f7f1ee8b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

Filesize
462B

MD5
f6a577df961ff6ca6f6b0bf5c8d27455

SHA1
926587b00bcf594306d612da831c2cb2d029aaed

SHA256
dcee7055081c5027bab7624f064cefab4f49973ecefae5a4805c88aadeec8001

SHA512
48a8dc4bb945dce2ffe949930f4086557e2260967d6a9ca56636be1f816a648b711d06ab24e492a7c214415d4958666d80f3f76c683c8c7449184aa4e8e1dd06

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

Filesize
264B

MD5
1ff343ac10e61449ebe3ea37775bbeab

SHA1
f01419c8e1236cb401d88642134246232b7b4b5d

SHA256
3573ea590dc472b7aeeb39028519e6f7322e57d52ab57f6ce32cd5466a3cd8e8

SHA512
6e8129f8d8bb670dce312006f3b5eb68e50bad597bbcd601d04d4e6b7896f4c59901bbfa394d054469325a3b9884d0c05989940cf580f75705371fdbbd6f4305

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
502ff4a671828742f811d3effbf44b73

SHA1
21f50310b13877a6af9618333a75cdc5a0f3301a

SHA256
2ce1bd85a24ac3ad0fb023cd453b86e8adb43babe1de347fccf18bbdd35ed9e3

SHA512
049a774fc7bb1d7d7ec5f01f60d17d7da53d57a5cf375db6e12501427f8f2e76fe7631cd725de601c660bb73ca40b44bd127cc7c7352c81d1c6b322b79eb3012

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
47e6e16ccc8d38deae367896709cbb65

SHA1
c770b7d825762169deb9327f50d50fd7353e0e93

SHA256
9060a76364813600dce181be1a1353746a53b9db4aa9ea73e184c5ac10355b51

SHA512
d5f285e74680aeef7f6e42b2c76dd9b63668fd271b938e6d5b2f2f8249b94e2d985a025e1bd670608c1b4118edb63516447bda0fcfbb5f439ba5a419d4abc98e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
fa0300877a48442c1cb56023c0c38c12

SHA1
ff886d9daef43907180102b745e5012224f0354c

SHA256
c87b14c6b6ea19e8f8a2b8760b0e9476b08e9b4bfd8d92bda9efe698de67c2f7

SHA512
0f2e1f02d7ff8f9c9b250553d4abfbc47f4dded2247124a293c1c7db874804b12730af4814809f232768efc8b2bb8bd91eea570f711f10cd1cd1411611e35514

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
c332b9b33e152fef24c1d0e0087b01a3

SHA1
f17d6a3e462711517f2a266707dcd96d8d495710

SHA256
de5e427e7ed618f93041ff887fdcf96d42f5a77ef8f2131756391f0874136808

SHA512
a17980ad65e707d450b8a561e07e896193363f8ca21e3f5378577d53e8ed9060bb1a9d468c8eba66bd8b0b6f8a0342d5613dc9dfc55bd8c4f192b1179fd6a0da

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
7026bd202205921fb569d0d03754af80

SHA1
cb31ccd8fdbaf15e21522963e0fab0504180b8e0

SHA256
ea5a88d5e07e42fef3176eb4de7712d34701243440e4b92f98309457f608e5e7

SHA512
f7a4d5b2aee9b647099207552e8bac4b9ce3bbdcfaeac727646fa43282c05c7890c7384b199f2509699dc058cb97fd71bc71823daa5a4154814232e53a68c15e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

Filesize
26KB

MD5
e8652c092b056a318d186b78bedf978c

SHA1
13bce35194f32beb58602bd5a461042583b94066

SHA256
6007c5ccee645f721fb5ab69b869cc752af3a7a63ee43eac2561d746769dad84

SHA512
f695a9e492a8ba8049615e132c6f07a89495497914eac8f557e9155d1ff17188af18250448615142c54d05f786e2dadc6904676f81a0ca29d13a5bc65b2108c5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
a783446797dc6311a534dc2f384b6d00

SHA1
8ada16fb4bab974c3923a4d7f2e9faa41264956c

SHA256
9f96bde879190483ffa9c683bd2e9f3fed3833775b2da58c11a27efaab137d36

SHA512
7ef421ff6e8085b945893e5f45a90a7fa9cecbf6d887ddf6471131fefc76247a53ca52490beadf514770e3e9423a16befc7eabecffb2da29ee30ca11281c3199

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
b42e5a529f87c2d0f4d1ccb311732a2e

SHA1
e53e678be368d79e1225b970ca43a09bcd01392e

SHA256
b08a9bb56568d4d58cf8df3e84bae41c6e9a3138502f89751924d1430e30ac0a

SHA512
29dfdcdf34264dd8fe059ca6e4bcb64be64e66e7022bd640f6486fcc2feebfbca0462372acc3efc58636651a84a79372542b51996fea2b9d50b390842279ba38

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
6af5c6dcc99ed424534065cc0975e907

SHA1
70ccc59906b5b44bb9afcba0b4bb63823ae7c152

SHA256
8bf74ced9c7b682a496cb9de815c86655c011c81dc192f0824a42ba95a181010

SHA512
9e04d8878345338a33f9bf390a61e4546cbae8faf5caad4dabbc5d2107da42a7aeba843629057f77015098488c0f536c6cbfd8f5588515a72108146d24ccee91

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
ede84e3563132d0930b92fc6126306e3

SHA1
7f2e3705e60c7f85be0ea3da02cd3da200abd025

SHA256
787c6f7acc7dbba8efa448e0edefc5e013a1bf13fecc8be80f2090f7dd4a8c59

SHA512
de08342382a6e368095eabb17093278bee1727fab1af9d217beacc10fce76979cb249ffd9ddc8d9497d527813abaa6b8802bc80ec2511d0d3974ea497374876b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
5235dc189136023dc808234b6e4c7ccf

SHA1
f62b9ec86736efa7690ff6a652df65577177466e

SHA256
095a8b0280aaff0e5679253b51602444c30dc1e11930ee467a4746d5873159c6

SHA512
51094dc09d0260856ba90170efd458139ddb6795bb004eca093695501e00e955e63a55b1addba9615949b93d7737df0c3f958edcb4fde5589b8418ee866af518

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
fcc3128d79c83d36079220d6efd30d57

SHA1
99c976b83f884bc86c0351a8b99921c32a03fff2

SHA256
4cc8c8f675eefedebcc057f0f83cd291069c3f5e59a972e30e9dceeb5afc0d22

SHA512
c198ebce7e989aead22610bb4ba41a56a7092fea72692c0d9f4dfac9ce0b7695f66fe2f51335ee96525debfb0db2f7f6f24b3a10381e8f2aaf9ea617d108e5ea

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
847c4122fda7910668ae7f7b921ba9db

SHA1
ff194906a985f2c6891d4398d6e23465a229ea11

SHA256
6c29dc0e8fdc041bf12ffb304f0bd4144059624768cd626b5b14b0f551eb77bc

SHA512
2f55d0898f4e2ef72273d61fb81c908198e1b21749c459c748d8d67ffa5294e9c6ba42d738cc4e53f9fc92aa2652cd1352ef0dc235de8351269f51ef3fd2a817

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
58f7855be48af1b627a036495ccbefd9

SHA1
2e961c8b03eaaded2dc813b005a48afad16d1e0a

SHA256
965d4bc38729e24bf683bbf541b1b9f15b619c6dce2f48cd70407b33b918fad9

SHA512
8bab1cc9f6f77c9b5a3a7df832695b5266b31ed2165361a03129f3f5a38859292f9307846f69f8c945cf99d9a2c1e762f5330ba53c0e7a0682348ceaf67c8201

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
701c56d951bdc0b1fbae2a5bb79febe3

SHA1
22b519352c4e666db0f27567a301be553000c50a

SHA256
8b1f977fc14c1bc5756fe1c04cce3cdc24971287058526876af0044c5d9c468b

SHA512
a723e3dd818b9769746f8a74aea0bacafd9f142c4f527748d2890153da2fd015df27f95574df7dc8139a09ca216c4e326e101d5621692e573bdb5964bc04941f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
d6af6c44ce90b7c85c4fee9d8f63c51b

SHA1
4a36942de1714aa2425d971a4d001a18a2330aea

SHA256
61b5966c2121466744512f65ace6bc2584d66a83ee595fe5a8d7fb7d00e3e5a4

SHA512
6501d15a8436d7e3127fd596cd03dba3c3bb68d21fa935cfba0178eaed171aad85495def1501d5bbbd2c3f38c123f0d41468ce4cc293c5a205f01e8563fa883b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
5d50133a3d62b8013c3405c76e3d95a4

SHA1
334474b2b83c21878ebecdd5eec06f281d6ee8de

SHA256
b48e9a4e71e2d0809c12781d485739c639153e588c844d95a0fa8ec758a9cd14

SHA512
03e4ee3a7f72ca7cc489a9f9421ebecf0105037bf358206980b8891c3dbbd92544e3c9cf2da2459d4659b9623e52bc8f2888df86a03a55cd812664f69ae4ce54

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
1103958b85ed0b0e193fa249096b7f95

SHA1
cf91373d1e84f8225a90cc73440ad574a858b5a2

SHA256
db5674d9f1d036abf6f4cb950271e32dd6a7b4f63e704d6fd1d00bc7e964f902

SHA512
93d8d0875943fc667445c07d1af3884a544855b06dc4c3985adf80d08d7b2abc37b490174ce0d8ed8267e6c980e215e73a4e2d05615d919a0411519406e52e2e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
c8110b57c09e333a2a0bc6733ff8d013

SHA1
1a58d4273ed6ae65d5803525cf18fe50c6665be7

SHA256
759399a7b76c32d990416b2dccb89588773d2f5211c39bb13f95df524379b03f

SHA512
4d6b84d8c24e7274f6518e5c1af370c4bc279b8cfafe4a9a8baeec54080ef2fc797a9d618c93cbc8c0954cdfaef8f191c739279940f3946c7871647fe4ff48f6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
183e5ff9d800bc1287e507e2b5b932b5

SHA1
a377f058ebca7aabd4e833b3a1a27d1ed2a56c62

SHA256
71dcac72d2e9c926fc98cccffbea4745d5ac78084c726eba1754e143449e3978

SHA512
c29f9446f42127234587b5e603698a887662bd135592d78716c116dce0273e860b77b030673fe7e1bb3af9bd50e8ee3f5fe37acfdded0d8bff829a7070ca871e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
c4cfc6a9184bd6b14a48c0f73729e98f

SHA1
91609e29cd980b74f899ef2b513d2c7e928c32aa

SHA256
7246beaec1c4701146343cd57412f0d726e8a117bbff63dcf8d3b81cd6ddcf7f

SHA512
0c873435759b2356847fd8c3d687ec13aa68aab877076c61ac1b7e98241127f9215e230cedad6b6df7da86b6eb21ec022572c452fe4e613a86642b0fafc78221

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
e60b4713e844c7c9a9ee1dd8d2abd238

SHA1
b0fa31bcc3a88dd3fd2de96d715164dce0f5a4dc

SHA256
a8fd4d2ca6c74125eb0dddcac9e0ba0f1eb1bf70567fcf8b9dbaa3c09f1022f9

SHA512
18427920a57c62e4426f579c0390e2fba980ed011069769cc814243847acd94f83100a6f843779415532253057925c1c7b1a07de6e20fb74aecb419b550c1274

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
da70b6db232ba4c0d043a4880e266605

SHA1
04257ad06a99dc677a0ff30544c2e2b8f878c22e

SHA256
ccd144a808added7a1943a5c98dd69439859db6228dc09ec40bc8e700b2dd068

SHA512
2d540fe450b5f57827fcc2de21902d9578331b2fc28640166f45589005af2bac02aa26a61c0989b4674ba1e270fcf4e5b4de5d14c9447b57455b176c37705e04

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
44c4b151883be328e609acfbc8230c7a

SHA1
a67e585b025ed34c0a450ff7f3b1283e80f237da

SHA256
83f74605c5cfd6ccaff5eeac7bf664b6f8e6a62fade4a3757ad35b916c2845a7

SHA512
4367d13826e9bddfb00164c1ac1bce492425866b846cbdd9309b1866098f6d029bd5a2a18cb45ae2aa7ff33ebf571980311ca7752bd5a20ca5e7629264f6d58a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
430d40857412e2216a130c9cf6b1f94b

SHA1
69425ed579da0a79264b16c7efac5bf9e8267d26

SHA256
13bf56daba1bf7447e3e54d3cc05df3f8c81dc393ac97ed4eab7b35ce8bad23a

SHA512
1f2fcad5fe7a15472ff28abe3d825ac2cac5e31cc21fff14512d0d780fe8f407b5b94f38f6f355e57506e08e9de1b8bea1f7ce75348ee2eeda5514c8a2805ce9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
67bbed4306a0c912d8b73536ba596031

SHA1
4df4a8326cece269797675f2eae00ccd4237c804

SHA256
994bf38e045aea956113760f8769519566aa700c065841e2b087f366ac250710

SHA512
c3cb1f0551e95dbe3e6376b77940b2eb12367ae2a53477862e792b6c35ba0d6f0dd10cce4613cf0b321cd2fdbfa93708efaa01736d61d16d4b2261589e8b22ea

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
14f4994d7061b42195e04d3067b7af58

SHA1
407a97c382392619f279443a799f0499ea463b00

SHA256
5f5fd24c755aa9ea437ca04a5bf19a90b800d713bd4b0876a1d6fc7d73dc09c7

SHA512
cc8552ef8dd9c085d14801c1eda022369b0ff900ad2d86c9b2480238ce95b78ec2a5430191395a2dffe5492a3ca3d6a825e33efd210c1a0c1e4cadbaafe6eb4a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
588d5d90e2311afa2e6566d7cdb5dfb9

SHA1
6a0bb4000982585abadde9e8f9c01fb1ebb88fb8

SHA256
a84501d361a3ecfa73e9c9daebedf1f52dede0d1fd6249eeec254e82b5be4ed5

SHA512
c3e2588ef948116b59dc2def7778863b12c04562eb34ca538b98ef373746a9885a5d07cd3c42a90955e20b8535e244dc87a100e9bb2e553329f393c826a49c68

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
429fce72aa8d002c864f7203735a2759

SHA1
09d8bfae17af4515f62ae74c2cd68c84958ac02b

SHA256
4a19ba47eaca3a77a1c47ef276682d97312af9f43d732f8a803feca8b5f891be

SHA512
cd21cad0e7714b5fe97386c8fc1b0795f13d734b77156e8c62618efd9b34bb52512660aab82ce2762adfcfb36330c514a9dc2c6e16eba403129156a4fdfb3868

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
e48401273ef54baed1f1e7d6d0ed4302

SHA1
ec304bd66560571618de33d43c2c80bca71bcf34

SHA256
2c98db9ab8c99eaf638934d63eb6b6ae4101c4bc73f2dacd07604451252d8dd4

SHA512
e7de74d0381c6004ad67568ffa9c631493e2ee462ab0390625b3c88eecf45d773b002332228c661904572dde13460240f4eefb7e9e61651a8b330a2cb092e42d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
cb2ffd3189662c09f6252b5e607ef242

SHA1
67550d1b3bbd133e90409751e2a827b671f53aca

SHA256
da0aff68f386eebdb6601defdb260de602dc032d6aae28a487df658f1582d5b6

SHA512
d0240e15ba2049032edbab15783f67ec3c37cb5461b0eb38d15b019d481f6e4e7a2866e0a473b949663174a65f6bab24b63660138c81cf7cf230f7d40abd7e77

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
5dc6706c733c8f1ef99bac2056543f7a

SHA1
af3c5497599b0a7c0efd81c51114d117fd40af3e

SHA256
6f4d10c26441aa762e488a39ddc7dbc1e62838d415ea473d05cc83df715401b0

SHA512
fc1081b1fcbb0d71e03456fb8e5d4d44f0e04d2591df468648c5ff7a84ca9bc2bc31b3e04fb4b70e88bf8fe1186e337bd161abf357dbf0d4cfc8a11792307571

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
f985cfccf873bbe036b0698495ed7ef0

SHA1
6de250e260a3e6317c91348f86a08f3d8f531fe0

SHA256
665b864a18688e4fddba14fb593d0cc2d2fda8c1cadc2b1e63b0a1f958df820d

SHA512
a035f9cf6f4bd9098ade237123d7d8a25ce7e02dab04e826efc0a4d6965f510f76faf1ba32bc9ccba6368bb714e35365442249a6f63c3923bf4161c659a5e27f

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
066c9ba4d65d83e23061f49c6d5e7d76

SHA1
46d8c0b865f95a109d027313ae276682254b035f

SHA256
c4a07a450dfb1ec07a38a59846ca6aa42ed07b9f76037247a478934826cfbb8a

SHA512
1f140388b4e3600ab906680984dbd9c9736c6699592a14e770cd1d17170875e31366cb009ef996a139bb9a6e4fc780449a63b3dd1c380022428c1ffd0418542a

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
006fc73fe2c29d902f2275355f0a508f

SHA1
4b71a543bea30dc94bfa197557325480eb318aec

SHA256
5d05320ee78d947b1f3f3c7d534aa03776ac391bccd17d5835323b5b92e47108

SHA512
46163ac9f79ea75cc4d365f90cabeb69933a1b3d4f0d72769d0a40a2db596317171c02e8329cd7d4bcfbee04cba9a1e4eb87fd192899a05d9bc1f9c9f3f8678b

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
a5b789f19c6884346f1c505ad36a6d44

SHA1
a73014f3cb0dc4b6f4202cd6b7e4d55f98b73791

SHA256
14d98c444656099428248555d1dc041f31db382d66a8c4f7faad99a4302b04a8

SHA512
2495c55aa17c490bcaaac0da8732c318e2c8d0dd3ebd7bbdc410e4ca110d11fe7eb6d1d50db993656f82e3371d0f7968bae49a05d8dfd32c78118e297d8d701d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
e5283021f9cbc45b64b75491ed9b561f

SHA1
9b351f806f385a4755757053a8412af1aece3768

SHA256
ddd4ea63e625e59fac5015e8f645c532701564879316a1789390f64200bd0859

SHA512
9bdae0d2843b39f491a5e3f84e666d0fe0a13b73e3f0d6dbcc76d3b71209595edf036c709ba28b08f390984d07af04d9f24ea08cf50da839f34dec55bcbba140

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
2640e90457652bf7221252cc08ea2c7a

SHA1
4975ae9665e65b2c2a71ef8434eb2680bc602285

SHA256
0a1b53d8f04ccbb7f06b2fa441221312da2ed5c0d78450d4ad8df3c269913776

SHA512
f962a079b97aad4ea22a7d6a9bbfedc09e0e9b56bca9c5761cfc1ffe0bfac54b59940109a5dd287ceee6a8ac7892015964604105ea77710422a1c0c923d34e98

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
81d6cc18693db984003e2704d5323050

SHA1
e0c0dd0de8cba10f5218c47d86496de29f8c3fb0

SHA256
450be8d2c6750120e778ef2d8982da3babc797a49f41dba4b4f054c378e13d4d

SHA512
5c97e693393807303df235c79ed67c9338e371640554de35dec6f17cb4426949e01016a0821ba611cd31ec9e3d5c7572f084f1c27d9b0a628466578402e1605e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
04b5b5d091583c4c5d542bb943b98ba4

SHA1
d7eb9cd716d722ae9646ef64030abf76d9d8f107

SHA256
a98e0d1208a21c621d82a583bfdca89bd16341ccbf7acd055d7d5b9381cf82b5

SHA512
fa1fda8d42409506bc4bcdb8b2219ef476b5944b5286ecfd41c43a29891e962051799f5328e4272443078c1f242913ffe744acc67c0776ff5a1ffb08d000a2ec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
ca3918862831390670018c6038af556a

SHA1
2f41c44030f9b551c064ab5d9f4674a17420a873

SHA256
036532f3a96082d78d443bdb6394fe91d70744740e4e2002d3102f5baedf76f2

SHA512
5c6ce2571060e0c73ae4306473bd4b246c746d7738601fbf743e5b38a668aeb1c418b2ef161dd29d9eef524b0a948dae7470f0152122998f8ebc3b2bd38a74dc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
68586e30ab4f2a14b27ebde82c27923d

SHA1
5ceb92403a35fcd1016e031b5fe590678d16121e

SHA256
1318b3a84bb6ece0943379d7f0e47df59af3a010b68f0c1291cd1638fd5b35b2

SHA512
3af5d0e8503f91b39450562eef18e2027ec01bb6a86c6461f39b1e7de3584e658422fa4bfa9cd9dbf860cd4675d7e75fa97d37f343639756c26f4cc870bde4e1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
c8d0f8960811b84a70df86b18d1165ca

SHA1
d80744a0571c86f26b1329506614b7231f806d55

SHA256
05e760e9938d1306261d816f7e8842f82e531a588a5221c85609674de55f8610

SHA512
9f2b308bc6a24928513a83fcbf61077b4d98d9faa551c951a179c7c95ac0582e4d70de3898b23c91003e2a4cc698d1c6a7c6d4acbaaf1d8f8152601f2d2aed50

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
c602b008cf0cea02d172617193b144a5

SHA1
429957764692241cfc27710b412e68f230ee16e0

SHA256
7e4cbbdd4019d8fd88d807285012cd36b88cc0a25d420d5cc4e5175a4df420a7

SHA512
751865eb6f580f4ebf2ce3abe1fe0ed2f01dd9826c6420f8ac9b6b0530482e83be1583b9e7878c5efa86aca008300342c261f184cd3ab0849a031c10a754c729

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
72046d9ce2b319185af8e439624582f6

SHA1
46fbb2926f66469ae85f39082fb46dc868dbedfb

SHA256
fb5859c33f7084e9209e94206f2a1354c4c466e56b9c8bdca668229b2fc713dd

SHA512
17724e6706666ff62dbe233e05b299e52e96ee83685934702204a80c582df11fd18857adb2621f6933104c791450348d358b77150ce739cdd3010f0a4017585d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
d98f69cc3718085028986f6b3f3fc88e

SHA1
818c53512506c4724dfe44d51f8dc88788c218fc

SHA256
5d529f176114d4094be3546ef758eb92b5d98275354818849d8d21bc28136bbc

SHA512
51432f8c92984496ed4418bacd5aa158719df4da7bd3a29d6700b6336791d6e4261b15b3bb9170879dfaf327eb205b631f76593de0ce75ee33285b5489f00a88

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
9c8d59f0ac687a3f71c762b21d3a72f0

SHA1
1feeb44f8ed1c6f551513d654286aa54274e2dde

SHA256
6cce29d3029f4a24f8854181ec6c663a267592888845c147d5d56093b9115c2f

SHA512
ec6020c57c9f9a5d6112fe40b782a582144291836e8dbfe531c7890fcb508fbb53660c69caef454c9b90967d7368d035c6d54fb27654f04ca222948d9a94fc7e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
96ca5dc5ede2eaa76abcf34da5f4ff72

SHA1
affabf5593c0af2690ea111528b42a0bf271cd54

SHA256
07edb46dc45797a5463aa497b6967c199e096cde91419fc17918d959d46272ac

SHA512
e1266fcb8382ae1bb7942f6a0368331de383a5fd83b24c8ee612532affa1c2198c3b98189c26da7cf6014564a8e1950728b29f807746fb7bbe84927747f636ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
c27f989ea98f0c027152aa2e95c2480f

SHA1
5a0fb8d86cd496e8becf5fd3904cee6be9c580ba

SHA256
6f24eae745f1e8941a1d68331d863816074f54b339c066d1a805d33c74ca47a1

SHA512
9d8ff83b0df09b371c7aef47eb13cf032c0680956c0bac553211d471ea73001b8d1b9a084d5ebd5b8a9b7044e03f1ae971ea1c95435de4cae352449d2fb3e4f7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
4cde7229aa5577478e558b44d057c66c

SHA1
5cef15c2c4a1287ea7bf98ba8fb2312916c27ed8

SHA256
3ee4d7c5deb0a487606d4580efcccd7cf4ec261582f174dadf923278cb52904e

SHA512
fea568d70b7f32e4ffcb77db6ef6593ec92e5c4c676a76932fa2213d10f24e356d4d9c6620026dc4123ac8ab23120eceeb54afb64a31ad728fefcc5760ab4d77

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
acf7b0a8202f3530298104e2a909dfae

SHA1
346a660c4a08cd1b511e46687877f482591e0e86

SHA256
4a2be5435b166fa4323e443586c4b314af1f68ac241107d2f01b08e429e8b053

SHA512
47451cb7dffa9014ee0887fa100e94334bba4838801712875261d1f44f40a2172aca4b014059df340a26234ad031f7b320086154026cb0f3b6a2d436711e2f70

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
59a5c7e8b7c3093d430982f5d2d5130b

SHA1
e5f572c8d6dfca760e1a171f6d4796ab127ea29c

SHA256
4f65d3b24add4d30dc965a1c31bfbced75fd96b12603929dee189bef4174db23

SHA512
c6db53c9c94576079929e5851c2c0cea525203d2637c5e152776c20ce523c4318630c29ff8686d176e58164215074fc450f273173ba6059cd51e00d92dfab7f3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
49dd79e87f03cb58d863949894d6be7c

SHA1
58e0c8b1f9516258ed564a7525b86b6c1125594e

SHA256
fd9a86a4cb039843d29dd4343fe543b4d4f9a60397c6690723e796cdb3c88080

SHA512
22fa49b40ab093222844e6469264656681cd69d82f2a44cbfb8059eba4e2849f9643d157c4210d8bad92ec45dbcfd479adc8d766b9b374b607d6e769c5c807c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
f2d04e907eccce4ab0acc00faacd41a9

SHA1
e46c7a26904da78389380327e8cd02c50eaf518b

SHA256
6b447e25db4d0268976b60aee585706b6414c29f3390a59e0fae4e0cc860a88e

SHA512
0fcb7f89ea83b32ac06a82cf1e333eec238b94e448fbbaee5019ec5201d38a4cb720b74773786761654d8d2ddf73cb1448c4cebcc2057256cabe1284943efea8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
1ec519989b57c12c2dfddb2bd5634440

SHA1
e4ba60ffa43f577f11c46be7b77c897c038aca10

SHA256
47466f9b39d0d9edb5685361daa35e91f883d0710e7b8f8ada7ead808b132357

SHA512
d7d300c1e538d8b1f2123edd015382082d69cd6225846f8ba4e6067a70a25dc22aa1a827e7ac7b98aa922b96ad50084e39990cd800bac81ea917be574f8ed4ef

Download Submit
C:\vcredist2010_x86.log.html

Filesize
80KB

MD5
ca0b5f459731b6185a63514f4359add0

SHA1
4d8859c4218e286b9e4ac7968b2d1564c20389ea

SHA256
1c09892e0bc253dbc26eeff177c2dfe365878eb4b00c23ed96f321796cb5ce3d

SHA512
9cf5fc289aef69346681220c72b6d0bcf30bfd5415a5e985e5c9a7604bc89aaa90ace0d1f1ba78149567b6c684f54be8fac33e5f41a8a1a7ca553c81a0058bf9

Download Submit
memory/2096-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2096-8924-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2096-8925-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2096-9157-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2096-9158-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads