xorist | 3238992b0375e73f79fad977801a1d6e8a267a216e623aff0532e2edbab84bf7

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
29-10-2024 22:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Size

39KB
MD5

7ce1f02da1a962576a25d42ae8420448
SHA1

e4707e3fc45a5a697305457af1168497daf0078e
SHA256

3238992b0375e73f79fad977801a1d6e8a267a216e623aff0532e2edbab84bf7
SHA512

a6b50fc80a91dfb7db34a9df037c7d29e0ce06ce21ebe2495ff83c04bcdfccc4fda2fba4ea0d5b4e0e24b8ed1ff80cd99090462f43e1a99301f95c9685045ed3
SSDEEP

384:tebFNw4Pk1itKkpAjjalr+PqYvjSXkDCgSDMB:t0FmBkpKjKY7/DCI

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2380-3-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2380-3780-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2380-8954-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2163) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lBxOMYQ1FP9x2q4.exe"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_script_internationalization.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netnvma.inf_amd64_neutral_99bb33c9a5bedaea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc303.inf_amd64_ja-jp_b0dcc6693f67451a\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_locations.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc8.inf_amd64_neutral_c93e7023ef90e637\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scripts.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_scripts.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcmf.inf_amd64_neutral_67b5984f8e8ff717\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00i.inf_amd64_neutral_09ff5ee0a0cf0233\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\default.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_providers.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions_advanced_parameters.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\umbus.inf_amd64_neutral_2d4257afa2e35253\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Assignment_Operators.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hpoa1nd.inf_amd64_neutral_cf39c48277e038de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcomp.inf_amd64_neutral_e5ca2f01ca47bddb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_scripts.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\iscsi.inf_amd64_neutral_2ef24e9270d8b2a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WCN\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Comment_Based_Help.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Break.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssessions.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssession_details.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_scsi.inf_amd64_neutral_cfbbf0b0b66ba280\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdm3com.inf_amd64_neutral_11abcf129a29fb9f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net1yx64.inf_amd64_neutral_ed16756f950857e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnle003.inf_amd64_neutral_c61883abf66ddb39\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wvmbusvideo.inf_amd64_neutral_8f9a8242d3699a44\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_job_details.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_preference_variables.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Language_Keywords.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_types.ps1xml.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis3t.inf_amd64_neutral_857ff0fa9c73850a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_arrays.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_requires.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmarn.inf_amd64_neutral_fa693d8797766f49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00a.inf_amd64_neutral_565c5d04cc520c48\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2380-3-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2380-3780-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2380-8954-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\weather.html	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_SelectionSubpicture.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Welcome Tool\IconImagesMask.bmp	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.htm	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR36F.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\calendar.html	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EXPEDITN\PREVIEW.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VGX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\triangle.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\content-background.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc-48.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15134_.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_m.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_highlights_Thumbnail.bmp	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287644.JPG	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\glass_lrg.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\THMBNAIL.PNG	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR45B.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Spades\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02097_.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115867.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_right.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\Filters\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)greenStateIcon.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099191.JPG	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\background.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_few-showers.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SUMIPNTG\THMBNAIL.PNG	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\epl-v10.html	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\VSTA\8.0\x86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21300_.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21310_.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\XmlFile.zip	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_orange.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\epl-v10.html	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winClassicTSFrame.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-first-quarter.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01749_.GIF	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_battery.inf.resources_31bf3856ad364e35_6.1.7601.17514_es-es_c2e31f0950baf488\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..5linqcomp.resources_31bf3856ad364e35_6.1.7601.17514_es-es_16272132ac0852bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_History.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-netprofui.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f6b71d0cdbdd8f45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-searchfolder_31bf3856ad364e35_6.1.7601.17514_none_9c77a3e2278e9ca5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmpdmc-ux.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3d2018739400ea5b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_cxfalcon_ibv64.inf_31bf3856ad364e35_6.1.7600.16385_none_a242cda757046042\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-calc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_3e6c28a6e8104bdc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ehome-ehsso_31bf3856ad364e35_6.1.7600.16385_none_ac3a9a3e6b4da0cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.powershell.commands.utility_31bf3856ad364e35_6.1.7601.17514_none_ed5ab14cdeb06548\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_providers.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-w..lient-aux.resources_31bf3856ad364e35_7.5.7601.17514_en-us_292a8b37a9ef3b8c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.SmartTag\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_2b95a17838063e9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ender-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_16907602f71f0532\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..w-capture.resources_31bf3856ad364e35_6.1.7600.16385_it-it_04309f298ce9a440\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-desk.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_89388c75972c65bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-netevent.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0f099c9be715da86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-font-truetype-ebrima_31bf3856ad364e35_6.1.7600.16385_none_2a70c05575ba0bb8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..nistrator.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b52860a79b5a8deb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msmq-runtime_31bf3856ad364e35_6.1.7601.17514_none_a2e93e679472903c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-printing-xpsprint_31bf3856ad364e35_6.1.7601.17514_none_adaa8d156f8d685b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\WindowsBase.resources\3.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-instmes.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bafe33f101561ab6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_Language_Keywords.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..r-tlntsvr.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ae3d0be2b1c4024c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_modules.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_battery.inf.resources_31bf3856ad364e35_6.1.7601.17514_it-it_4fc28b4f1abef068\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-at.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1316007a2c9e2bee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-bcrypt-dll_31bf3856ad364e35_6.1.7600.16385_none_4a8185140916af36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-w..sition-coreservices_31bf3856ad364e35_6.1.7600.16385_none_98ddd70b016524a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.MediaCenter.UI\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmrock.inf_31bf3856ad364e35_6.1.7600.16385_none_706fd484cc8ca81b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..gine-main.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_54cc613f00ea24f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ostic-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_af80c35cfd291fc6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnnr004.inf_31bf3856ad364e35_6.1.7600.16385_none_ba2d2131f8a32d84\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiaxx002.inf_31bf3856ad364e35_6.1.7600.16385_none_73f5a8176a99ce5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..zards-mui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e2734423061a0003\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..tings-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e79c09909f5a995c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-pnputil_31bf3856ad364e35_6.1.7600.16385_none_5958b438d6388d15\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiabr007.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1b02f1a5f7438028\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..ingconfig.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0d6bae8c3a3e1068\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\AU-wp2.jpg	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-sharing.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c067b1f64e19b4f1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-stacking_31bf3856ad364e35_6.1.7600.16385_none_d0d2b98d4629a41f\720_480shadow.png	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_scripts.help.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-smbserver-v1.resources_31bf3856ad364e35_6.1.7600.16385_es-es_23f6dc047b6676d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..cognition.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_8037f2aa7a85980d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c65f31d113437677\calendar.html	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_eventviewersettings.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c5d890d1b27df43c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-eventviewer_31bf3856ad364e35_6.1.7600.16385_none_c9e0123eb5cb9955\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_narrator.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4c2bacb22ff9584f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_sv-se_2e455c2305308809\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..rkprofile.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ad1c591dbc1da7cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.DynamicData.Design\v4.0_4.0.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_70efbcab5fe0df61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_6.1.7600.16385_it-it_795ac2ac69664653\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_es-es_77c3e2c030c9a730\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_ph3xibc3.inf_31bf3856ad364e35_6.1.7600.16385_none_9d6ade06afa27a18\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-dskquota.resources_31bf3856ad364e35_6.1.7600.16385_en-us_00db0a57c0ef3eda\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-help-datalayer_31bf3856ad364e35_6.1.7600.16385_none_c490fde17faa7eaa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_amdsata.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9bed373865869ce2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_kscaptur.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_daad094671cf1bd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\ = "CRYPTED!"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\DefaultIcon	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell\open\command	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell\open	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hacked\ = "PUIKXGMFZDHXQIU"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lBxOMYQ1FP9x2q4.exe,0"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PUIKXGMFZDHXQIU\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lBxOMYQ1FP9x2q4.exe"	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Hacked	7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7ce1f02da1a962576a25d42ae8420448_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
163B

MD5
14fc5620af59c64a6e1c57c01f96edcf

SHA1
6770fc907bec6411f59ffa5c0f3655a4955347c0

SHA256
225111917a8cdd942a5ce1306334750b9127dfe3f8b6546d860d694c83176433

SHA512
e45b29fcdf90eb33ed13b17fe89d159a17fca9a1ef1e71dff375fc47fd30430a2ea1f5153596c20eccc545386880175ad34cea7536560ab31fb09efe83288607

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
73a15ca3e6c6472693b0056262f3c4b1

SHA1
dafef2463da3aa2e4f4163123f2c68dcbba0b1f1

SHA256
68a4a58b42febfc8076d91b3831025fbb922e8cc2e871e8e286c04ea14f29ed8

SHA512
b0281e0f2c6e06e80b5361b2e34eb461ae3acaeb77de8bf11c66f467074440d65da650ba7ae4c0ffabbb50fd99c894af2a0244403858d9cd94832194942f5dfe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
6054474ba9e6b682ccc7ee1a29b746fc

SHA1
0c455bc4d95314251a4090df0f969a67c5fda139

SHA256
963284ca5fffe3fc2a2d6cba97cbd460befe08566013ad833e7f3c70e4e09c83

SHA512
8fad794d0a7b641e1b411a8cbf143c3e02e98e4391567cc528c7d6b2139b7668ed6af722ffe13a6f45ff95258045c81d31ff6d0380cae697d17fd9180c262929

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF.Hacked

Filesize
24KB

MD5
6dc874e2eecf5d326261748e6739c3db

SHA1
c39326f4a3e401b3008feb28f376911947dbb9c2

SHA256
6eacfbf10fd6e5b97b5752b996c6c9ae69d3bf0af1406ae9aa9e30c6ae967623

SHA512
56183420577bc7de5413eda00bd07c9086d1594cfe88b068ba5017ca84a2c56ee5e2bbf592bca48eb10ba0d7f72c73456d6a71d639249a2b546821fdf41db2f6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
9792d6ddbe98026b3d3ca991093a0294

SHA1
1e101c421ed4c00dd283ab82607739082f15152e

SHA256
93dfa6a6ea473143940637e0ed116ba39bc2c44ee431a52fef7ba1ebcc8fcd0f

SHA512
182c41d6e53583d2807e9de584158f05bd32e0ca5b4ecd0a9fa4b13b4ee00e2be5c6363b0aad0597200ee03421c46cd0668dc7a96c8a373fe45f7861191be59f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
45f9bb3003e0558ffeeedddeb983e855

SHA1
6ccab047692d89845c5bc3188c61b45abe1d24ce

SHA256
bf52ef6ed08312143f0b5b017c63ad20ed5cfd0e8da931b0366c1c1ac17e80d7

SHA512
d2dce5f88baeaf8671bb7e659e6e3012c9ac160c3d275475b2855fa9ced27514f66c725d6bc97e00b0027fc1baa24c54f8c567a36365bef92f5b050af7284a1b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
a1578ea2ecc70392f69f1b7beb220e97

SHA1
9ca5a086f83585a9c20300e4d19f8fcc5748b47c

SHA256
c12db27f356f96973ed8520a15c8182e719107861411baac6cc3d377f6e9824c

SHA512
3c0c30df771d40333febc08cf1d25c9733e5636f71018e1de25a68559099158bce4cd38b13a6881708581677457112cea206f876f4b1d1fe3b917f8b5ee59be2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
d34164a6813a9fa478ec81bf890a9407

SHA1
0c0cd4907e728f2b82eebdcd2b548275afc40ca4

SHA256
119c0a49e3876e852610575df0b0932b12f6d5d5bc6565e1b9c9d81bc2b0d80b

SHA512
fff27d9181b545a2a0b996567dfbaf71c6d19cc98a4497eb66dccc6edf83d2c8a802122dfed024bd84092fc9ee606137ac0513577fcd7a508f86bc4b643935fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
4c7c2c0cf5226c858a73da11bae8bcba

SHA1
a6fb0fe0fdf5b69901baa1a8279a90a591f8ea0b

SHA256
ec52f8f86f64bdb6287bf6ce50a408323e9d6afe1f188cd871ab699e96ac6fa6

SHA512
222b0b00b773a30e90918d0799ab057a6271b11fdc8127d7663de6d2e798bc6ffab6b0c6f3319aa2e453ad51b68fd4e73582f25a79c8d32eef85092057ee8a6e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
7b84fb993ed127cf7c695e92abbe8b40

SHA1
4595767ab49f114eccff52bfab277bd9a2e10273

SHA256
f5b17b6d391cb818d913761eb7cd7385daa31beef5471a4b39477cbe8b52f932

SHA512
883f306a5e87c6eee7f781aecc315f153b47b62432eec15d9e37ada2656fa3c2ddae51e3ded99c51671e99e44ec5baa76a03890ce1b1c5b8f560fdc79c496fea

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
cb2bd2ca027f7d5455f696a9deabe263

SHA1
d5199066cbcfed3f79bda8a5fb33b31051a18664

SHA256
f8b12836f8b7e2770dfdabe0a496ed924ed48675bc4f2cc4753b5ddcc5aaa7ad

SHA512
f2047613257ee293cd9b0847a63c4b1f7c47a0d59899ccb1541622eda84570474fa46b1e38e59989e7fefd71c4263330f4196655675ecad94a5879263149114d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
29074ea5ef48340c5ca680c740ada7f2

SHA1
5ca4fe5028467fa2bbbf9524176fcf66524a1e26

SHA256
68901ca28cb87798e4612d320c59e65b0f9ad7163d1a573736c2d62ef7553d10

SHA512
43ee171af0ccbdf410d491460d2ad865e95720982feb49586666f30dca475117d5755e155994a0373cb50bfd8b72922dfac8dd751c8236d270a7c516f4f18f97

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
97afe36c0fa8110d44782a2a686b1777

SHA1
7f7a9c7ff834510722f2cd885dfcb054e21758b1

SHA256
379a18633b7f40a2dcc3074f0a624edfb1d61967f4960a60269b88bfe6619a55

SHA512
2c61ff46485c7186ee7ff3dce9d927150102cd2b59dac6f0190c7aa8d63048de13eaf4b60f0b6d006dfa3b494f5f78541d56332ec33b8fc4b0399b10662997fa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
4c342386337bf118cd32def19118904b

SHA1
ee62035b376aeba79ba0153b11fcb8ac718ea52b

SHA256
30aef3acb12d20fc1a0f17de97f014f8f4e42456b5074d43dc96984ea02baa88

SHA512
bbbdc9a79eb35232ad980c769f1122b5a91401b98f13e1720d010c480212c5aa252c3a9f2388264284d3f89a18840b7ed781b3d75d56330c3d36f251105b0995

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
7348b99b193b7bd80ce833a6b3f7d758

SHA1
fcbbb8b8e9cb49843b58432ad2a03a1a3e9fcd03

SHA256
64195bbbc566b0d254f7ae2c6839ce645cf9cea4ef0c193e461a53e7077fe288

SHA512
80bd9be602b15b231593cdc01eecbabea99a2477bdcd82b8c411097e4337a8c05450a2a8d4da5d62eb64a0c5c86337a59604b8edd9c9fa93f83d020e78daad52

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
aea647f914b11de9e21cc392e41a30d3

SHA1
ef0fd07e863f14bed0430a8c09c626d58c33a83a

SHA256
5110c877b547d7f10a03c3e625cf6e27bafe2934723fd3052e257271d04f3350

SHA512
cbdb9b865783753b98ca6100bb056219e5826639e9b22cc4a1cfaabe22a7bf259f086c0ee45a910297dbec3341d3d72f148bfca155ba0551dc56ade0c2f93fc1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
b98c06b819eeac787045933f1c5d81b8

SHA1
08b439d3c402a2d878382ff0a1be09a1422f308a

SHA256
b31dadbd91364492944a362c58bee1d438d1828901cc63d8b0d161889a02e56f

SHA512
dda598b8f485c6b32b44f84d4184e84eb755d821712f3b35f5a0abfc5b057d52f18cc8d3f62c8d3aa75345fc3bcea1c10e1f3848f4d623a8099b430baaf05b68

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
fa22cbfccc2b2569ab6804d29ef13e39

SHA1
a94f8b53217961a8be31825d237641151d127009

SHA256
dc0ffc47da684b0ca60b2822b356d02a3100959a77e99fa4eb9412b0f236f23a

SHA512
7dfe00c7cec7e61ebbeed65f42cb090f56636aef414f0ae7e504dd601865188353987057074d17c7d964fb39e9356ef9a06fda1cf632bec158ce283282ac99e5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
547e8a61f069d0f97bf929dbc5c0c3d6

SHA1
96ed6b0bdca7965e6ca5b2af900b1d5bf010ef30

SHA256
e692c71482b1b2fc531fad389edf120b1c99fc800c54c1f1e3ffa045d323daf2

SHA512
c15d68ee0201aef58d07509544fa576c7bea21082f4bc61bd57be87d7d77e53ee432c412d37fcf5484a8518e35108811c96e67f3106541a80f80414e60e6e57d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
2e7b1be30b4aa9629448b18fa72f0f67

SHA1
5ec5473e001bf8460b6364b19f61c9cf10fffedc

SHA256
ee23cb561596cdb34e9e1c70c62d5a92cf0d09954e9ab25302412d48707889aa

SHA512
a12b0eaae556a53444f725e1200972cbbd4e27f71747caba6d29f0297c2615ec72962f66abcc03551b6f0faf3fb2cc949ad6863208f62072e0a854109f83abf3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
836420c15ba60fc1652ae63e019de4a4

SHA1
7f26a7b624ca93df18e2240b054086abf37823d2

SHA256
8ca8d9b142c59a3168d894d180ea2299df494ed1125b96546362dbc4777560d7

SHA512
4bebc7cae574ed7a30398a3774f54b901d511a94e334f9a26f0079b96f363652b479b24cc08afbe77147f4e5c543510df2ac0f6a6bb6bac41af70714a2668e27

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
ac9542d8d85e4460e59e9d846d4bf7ec

SHA1
cd5fcc81e1d7f0faeb87a2b08fd530b484bd18af

SHA256
b9cea6018d25332e4df1f3107ece57e4022774d986c07a14c64793a909bee30d

SHA512
4e97df9a9a6476400eb183dffc6e0cdae5c054cd41012fe5ad1c0fb9111fcb09889b17953f8da3c347f9663980d11c95172aaa0eaa0731cf8889d1cd30b8b4d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
435ce901c1fd4cd20597cfd0d95d0c5a

SHA1
c98a87d95b9a9a91a79958bb7d375b9cdf691439

SHA256
2cae1f75f56e0f341b8993dee096d610b2b097f68020f4cb64a744f5c37a7ea9

SHA512
b6dfec609a0b4910ab017edccd1d56daddaa582003d61cc57a142708f72fbcb1ca110aa3aaea573370a633ef0df6121109b369525c1309c7485d385e94c8c3cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
f88dbce0bd1573704fd5f9cae3e40da2

SHA1
69adf8bca3b1f9d7d87e56e58ec2cfbdfc611e58

SHA256
4dbdd17e75a7d61261820100587cb338b8acf7fde6a030068052483e1d4e6b22

SHA512
1a4c16fc27b444d9f3feeba61b30b4252e055bd560b480e78f07c59bcf3bed5c2ab421f2f105f2a4fb8218205a3759ca6bc06ba1ad3d3a6d606f5fa0ea127ee4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
4bac5182fb4552244bdc0bce5c872125

SHA1
37efccdc44fd900beb56cdcc75983cf993411bb6

SHA256
f220bd12234b57cf46e6a4d55f16bf14b55b4a586b6c4d1f208a76e18eeede96

SHA512
e4c34180d1f2dfb3dbea847afa34ff298b8e57f927a2cf20e136fd848f4e4045ad7ae3754475c62a36eaff5ea4f84111bd5841204f36df2bfcdf4ac162ed3d00

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
0684d26935c0863fdc7f6f86b0018315

SHA1
6fa96da6b157579e5146aca7a047cddb85f754cf

SHA256
6d09736f33aa8c1ddacb13d5a79909a27f8b21d68d91938f1b470a6d623c0ad8

SHA512
0d666106ccc52345a613ebb28d51addb9a2837d6804bcb054949dcb86b0c46db0c3caf6412cef18465ffa5a113792232c54c2cb476f78a2d18b72aa7ae924118

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
12396d3a675501fd7d937f3c3ae143eb

SHA1
736acefaa563d2e099bfcc4601b3227e4d5e28ce

SHA256
c97be371ab949ad44c0d360b9d44842974ce69cd7bee73aec587e6dec9985f0c

SHA512
428a0c2f4dd0b54664f029e3070ba01a5ce3ea2835ee348e2ba65dcaca64988f76d06f97eb21e0d1281dd5a5a0299f0ca1dd1609c729624010483dacce426fc2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
1db5d840df66ae4affeda8b7de7015cd

SHA1
d4ffa75a95c2f95502981b20bfc2be2737de265e

SHA256
9ea41ad7db5301417da986c57ab1d93cdd295fc3d2292dc7265968e8762e453e

SHA512
f245838bad5fe6455227fa39a228cd4551a76926fee94bb497e597f18a0690d13078fe6fe6ef9d0a009cd8ab9da82b92393da90ce6d639bf08e4565a6df46069

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
a38ab850be3f0fd7793fb38301bc9663

SHA1
5687dbcaa127a009f680a73d396df0a432982ca0

SHA256
154ba9d336e2949fbb473e6dd7a76d66f2247197236114f143dee9154c92e387

SHA512
7f50af3f8a565d29b1fe6f43dad79a626fc01fcb1c404c61d3ae40d3ee7a7390b050e185bfafb4ecc4d44174248b4b1c60380da9c735989c7d591134bbc0e130

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
7240350dce5c735a90aa30880d853f9a

SHA1
b8fb0b5e9e3bf76586a96d51c927e3e50b70f7b7

SHA256
7805978b26329bf6bd876072aaefaedbccf8c1b64f00986a250780c8751b478e

SHA512
7613dfe86b32e1578c76d7c2b951ac7f08f3c875441d5bac5cddd6b3f0754434d7ea24b7f6bbedafebedde7c0dd5dc645159fd75471ec36e5b118e442ad1354f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
9189b3efdc25fd4ec7ca73e138be387c

SHA1
9fc85881f212d51ae2e798d1849c0226d94524c6

SHA256
a1cdd6846abb211ad37fc406dd7c49356dc3d49aa6831e2fb5db58c59618f785

SHA512
731650a31c6c7765859dc3595a53e8b18c59128276e309d80db16134baab9bba1f5eec1664e7e6b48f9853780340b4f96c0c7c60a53dfcaa15da0489416e41aa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
add52d5ec34f56d82bb6be88d46f10cf

SHA1
15865918892f537ca331057bf2f0b17e7d3818af

SHA256
0e3a77f753e25852980a580a971f6c6f8d21243be6cfcb3ad1ba0db83f3d88e9

SHA512
62cf2ff6fa56a728cafb5653e60dffed23a0c1da4c387d006f75dd5f5db0bec5525e84137947530db53ac12f0161e5a3fbbc540707b303649aabc726a8a9e6bb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
689c91267954ead43d69336e88ffaf16

SHA1
63b3497d256c213375b1d7cd3976b373eb6d9ef0

SHA256
794a964d470a0691e3d1ed6de0ab4437180a0a10c8525c384bf86cc230a81432

SHA512
a067ed2b62b8ad9f39c48cbddfe5d8dc14dd86e30833f30521b9645a6369c7047e0ea48673c4be4d36945306d4179491a219eafdcce1611f7d2a28e145bf51fd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
0c75daf770901d0a57a1ae8d410b4f5c

SHA1
e69600784297c14d88e4fc842dcf0a777f2ead70

SHA256
ba8f2ef0b7b172b584edd1f4b00c3f7d00248601f234be6b0b662ea3258e4fc5

SHA512
f13685f7372e9bb2348a6325f6772fc0fecaf364f4a420b0adf192de2fc72ad09fa0af5c2f28575cde45f0f88958de8bbce8ec73412acdbc36e571022f3fed0a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
778439cd8a7d224fd9fdd627219a2feb

SHA1
ec359bcb14c89d6a3777702c2350466349597617

SHA256
9a2d845ff50a9f5c8e73dedf61a9ec1d05b5ae26a48eaedbd8b6f728c6f5d18d

SHA512
d809c193cba0d84fa63bd01db4bcd7cf580c9c19a2549ceac853b180f2b513a33e47fbc91382ff7eb7b09a5a1f37b7e6988b36272dd8178285708cc50be72371

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
d36bc5333107a0cddbf9e6506409d6ac

SHA1
d4529099a59be4786aa5ee6bb869255826a8b1fe

SHA256
14a0c21a890a09f591742deddebbe199ae68d68c95012e49d6caff7df40e7e76

SHA512
e626d421e6b1e0162316c087e61bfbadd2de88e706eba84742538178490c778977e9c06c7723245e77f8a4a60d4996d60c464b9d189992ed258835c2df212102

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
cee525cd5eb794fe1dd6dad50d027577

SHA1
4f7ae3d996c0b21eeeb69e2476ea388e07214f62

SHA256
e3fbd09c683f2575b1fe65cf0ee344010fef485e641f2f776c8b7025d8dae334

SHA512
65dfc2bc5d014c283fdd61c206610857c42194f5975d4a27693caf8d715c30bb6bb0af7f6a53c897369d629c516b850f66d200ddf80df2aa6344f36c8d1db35a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
b86109d91e2a1afbecb79de2a31fa9cb

SHA1
5dfaa554ca91824e22ae6794268389f40606086e

SHA256
bef4257c97f0a3321a6007a79ff7f2bd35fda38e494cd80e2469a6ae5ef3892c

SHA512
8109c9500cf2276da1f8ff176653092020e48b4b45b972d94b31c7543c60327558d429838cdc4cf5f5d375e47920851183df82fce5991ab95a3c8a73201f779c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
eb07338c4d24291cef5ce68723c3436c

SHA1
3b39af59b20ff9b3a37ca4451fce6b4586c7719a

SHA256
c5ae5253774600c6902527f13c961f26d35e82d98111a6d587d93655128a5b99

SHA512
923b8675c481e1d6d0dfbe99dae50ee657674e4f3fefe21233c7b986b9f7af7cc5233987dbcf11f162142b8a71eaa9e04fefc0b1ce92600108822dfb13442469

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
b41bd121f6ef2c51def37765b9a562dd

SHA1
e95836a58042bf6b8ce36440ddd19beb74fbd21b

SHA256
f54ce676edcb9841c87968e2999e902a4aa08355725b78cf421e39c62b41dfa0

SHA512
9730e249b7481202b48849c77688d5a369a26086f47641192ee9f100c4892409ad2a0562373beadcc64b837ee067a77e428fa4ecc7592165db73050eb112bed4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
82bbd5b0735c461673aae6ec64de8bed

SHA1
296368398f6a236da69b1f7d88e389d7d97c00d0

SHA256
b29dda07299d1601dd9641d1e2210c63e482109c013d7fe177c8f3b17457fe31

SHA512
dfa59e44e243f09cef86f57166704797c8b7eb3e61e78deddd15276c676538a78d9573b713c0b2f1edaffe9c673ebfd715523d42e0db02138228c665867f6ebc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
84fdf3d66ed7ae63a15802a324f22754

SHA1
6614a531e385d67dacc9771e91ecac28b719a4f0

SHA256
a657a0efc060819242819c8f806e0f81b553e1ab35102c202505e4bdf4886be9

SHA512
6212340750f3a00ea584e59fcfd174ecda5b2396dd94dc6087684760376db9aba986ca65b4cf2564cd8d60858650dca4a6bc678a23d3ef2e377dea4a9d188426

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
eb00a6985d6df7ce9cba25c3bac28235

SHA1
c1368eca8ab8ef7b0b645b43fb49a40403073850

SHA256
515e718c9d72c675e890d1aa27f0d652d4f7649caa95538def6d74d09684a87a

SHA512
3ced46dc0d42a95ac7495c5cb6e6ef6df9801e91236ad909571ab4d29bf45eb179a122e9b1519975b498f45bad53d959ad31b96a44599b69ad41998fddfcb041

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
917e78e70033140df3c7ed9e868ae6a4

SHA1
150cb4d2f6c88daca607e8c1d1180f96ef823691

SHA256
cf7f108cc025d97aa3928e9cdf24c37934732b07b411444bdac6fbb562382dc4

SHA512
49345fabf20a9cdf1c8e886fb6ab18e3cbe18d4e1a1dc04e0dfae92b2527d56367df6b193d5fad47205097cddc8da1baa8079e920f8d9dc69720c441b6bbd5c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
b01ad8ec999b840c968457d52eb9d575

SHA1
5783bdd70445c6bbb4d115fd18a8c852d3bde448

SHA256
b0a0c9795289bc8823a76afd319adc6b5ed668fe528c233c0636045329f2692c

SHA512
df89dff0e8b393408e062aacf61c1391307c8602afd7104ad134362a3b682f7d0b0a0dcd0ee49d727c898a5cad7122ab1da666d3a721e648d9a4d42d3c904032

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
25ce52448d9e36ca5f0ab8b0769d35a4

SHA1
478066350f5bb956128c425c1047c7270b7b45a1

SHA256
2ddd45a54f6ca2fc2e3913681ee351efa9faac6960e4ddd0d28a5a2db5c16d55

SHA512
c1c45f21363c0b29a8c8d7da97ee5865479571d758183ec0978d611a533f75a800a693f8b43cc527e9dcea2bbc2a1d1d2c322352183dc4817a974a5bb306e6ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
611805c6121daadd57882224a90ca3a7

SHA1
1d58bfc6cd2fea81b2f34721da325e8bdd120744

SHA256
f4580c2d189e20171ee2556437edd20f962432598b8a940a4ac673c6a63f90ae

SHA512
c8e504d457aa1975c44d139f561c65fc72caf5dbd6c9cc89c3551ceb3b1dcef5ef52b16ca9dc319764b0c702c4dce92aca0a563c5af3cd10fe6f846b44899e62

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
0eb47a6ca7e11ed4eda5904c01556990

SHA1
53f2ae7f0d64832fbbbc264b54c879a98c8bca4d

SHA256
d31535e00c2b4b706f7d27b0de8d2d24829f9ca4f2698a3cdf1f15524b674225

SHA512
33c74cd8684bc3044d6d656df33e56e58535caea487d65eb1a30150967e8aa3318cd0245a6763cb831dcde7bedcfedd900694ea7a416c521469487e93fc4cb5b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
42f21659e1b1dd0ec50df7cac6039bae

SHA1
16a41d707ebf6a58fa549df70c43d21cc5caae84

SHA256
c0c063a0e6c09910d91c77f7f1072c9c6433097a012927e8d8420c83f5c93d1f

SHA512
3fc299d51643f4a14434bcd00e51c06b70c083673fa67fb36e4ef17f278a1d40b68bfafd11d6c6256ed525a79e6124b1ce13955676bf19c9ffd9e45bc1b328dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
4e48a6a13a5fe64a66f77abc5eb9c311

SHA1
266631f629eae7b13cae3b1f27a2e409cdfeb660

SHA256
a7e961c33a7cfe2194e7211b78b9cd4a8f9e57a7d9c192abe98cfc787635d8bd

SHA512
9c02fc8809d572c968068d29b5c36cbf0fba44b71c47e60dc7ccb0c9f64f1adc00385da644ecf01c3a7df9b3f6d79e0218d52236aca5aedc72fa86f5578b561f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
bd9b693bb26ad2f310b1ad17b13e1709

SHA1
dc1b16790ff20d0b5c25dd3f70f9c3b8fab93c2a

SHA256
6ff8d022c0e7da50583fb894deafcc28180465e28df5e996cd968f32c2d25e7a

SHA512
2683b60b52592e30c6acc8f030ee50525beb7fb2b094e85ffd6f361685da8b07fb19bce64385ff5dd79cd621bffa1dccf905af53747c3148aa15a04084c457a1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
87bbbe2b7d534ae3f9df0bba9ce817e7

SHA1
e7ed484fe1e2c550b7c552798197d527792b1edd

SHA256
a30df9183717de1cce300a7ac1222731cca715fc950ce01327f85f57f89aeabf

SHA512
e4fcdab586e5f2317c679cd157cb24d2160384b88a8d94f951314a1dbded14c63ba013fdf79992e48df92f7916be106e96b4f42b40d3134805e23d7f3c3cb8dc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
6b2595704a6f01a7e974f45df4039425

SHA1
8b7a1996484f709946465d331e7ba4267f845bab

SHA256
2440d0d5afb9d8cb78af0046a3a2c3ece6f8489c7e68dc16a26e454ae4dc64a6

SHA512
8719cfe39cdd36ff673da98bba0d85d2165529c24320beb95cd9043394a0ab3ef0b99cd1f193ccd294903bfe48a840d5894d638b39362fbf3eb5c9a385117421

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
9675eaeb2eacdeefc7003d2647e3f398

SHA1
328df139af96a8ebe1a0fbfdee22a7bed5b990ee

SHA256
c8794292714369a018c7b8cdb5d9a300e245aad954f44d5d211b23c7dd323425

SHA512
94b00e16f4bc1702307e5a7791c4071b1c75e3b5d0efa28753ff1ef4c0a9849a999ba3a5038c25ea9487162933d9f385687b1e22ec1b91989a3667245433bf7e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
32688936b065ac4f2a3ccef659e6943b

SHA1
2d1f8be641335b6fb6aee4d6bdae13bad9ca42e6

SHA256
5ceebd4fd968090f07992f5d9213ccb3323ccd60b5a4d27b776f4a98ab543cb2

SHA512
fc9d7b659a048382b34e2010a52fe218c010c229b56d1132922ad3a35918893f4809068ac2c85fc56b2388695a3f16a5fadf34d813e93ad756068280603a5b94

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
fb385ac91e1f0846901c279821aa72fd

SHA1
25450f2726b79e7a75e6500ebcb107350e92497c

SHA256
1e9c64c5c8e07ddbe541a819aec7808b81cee0725e0a01137baaa1eb1698259d

SHA512
0f62a67c23730a9ec3fca9f3bedeb425565bb90e3641003a88f1eab472116dabade6ad32060c98f676cffc5840882eb1b651f0531cf07bd409365e0ea05bef1f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
b801c9b56d4e92aee92b9a094ee52d17

SHA1
aa9197e648c2270c1c5f6fd137524b68f76652d1

SHA256
c11f47b5de3628e13f7665b9dc8e29f0fe29e2b28954f0a331e4239b25f95396

SHA512
e731dc0d1b392a676fa5d371b277fd64264aaaf58e7de31c7dde47d616af8b430726ceb6cc2063a4c23304af832dd71b2f0f6d8ce35c1bde04757322b0bb1122

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
4b9f779247fd33418004fad500c16cc0

SHA1
307641e2255ada885c7a60857144eb3eafa6443f

SHA256
97f0daf79fee9b11ce2128bf140c6695e78ae74bea21a2dcf0baf48b34e77277

SHA512
ab8ea072381b1d8daa81bea2abd4590bf88ef1aa9d52913473e23a746bd4e2102ca28fe51f8901cff3ac193c1dc6e28086b6e2db1815aef98c4d23a76976574d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
71c73d53f5fc9369eff969b7444c7dcc

SHA1
e9684207108ef7e7e0a6414ee92ecbefae47367c

SHA256
1cd3303f3a415dea64a8b03c40dd9dd2c5354b99ab11b4e17b967dabbe2dfc97

SHA512
47d5a9302cd6ba3f895f88249763bd955b5ac0ac17a4f63600e69f7ed1424eddb821bc77259e3cd6b939dec0283e1a1fffdf02aab196d0b793fdbf3d52c38b6d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
95c088c85bbc5266ba21f2adc720f188

SHA1
00eb0ae080880f08e10697f880b7749c3e5deb08

SHA256
f13c1af328f9bda53949f6a2ec82913bd8062693c945d6e1b6719f0ae72f8c58

SHA512
a12e69240bfbc951dabdbee892ea2f80e161a7afc86fcefdc794c705f05466ea4994482de64eb9f3b3d7fe1abc6e05cb0f72eddc8737f5f0f0c7ea32fa1f38fe

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
de0eeed8e51e82010fb9ac6534e8f118

SHA1
95be2f2677bf10fc13fd8cfc00762be268fca45c

SHA256
6f8dfc544116bacfed1509737bd34854712a124227bdb0532e0ea5d07f790076

SHA512
241b786f2166552cde0f324964954365649287e3bcc0099a4fe76f2ceae3e613d45e9ad4b497ff1e5c705c258d19999e7f436975f5223299c3de95099b9df3de

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
9a252fecb8ed9f117c5788f6638f585a

SHA1
bac1bd01bb778709e6637514d3dd287c1581171c

SHA256
0359b05daa40dc35508129e9f3f65b4f5c198312ebde681820fe695a2d0d3d60

SHA512
26445b2ba2cfe68242bc95b716d163dfc607c5e5a7f3289b5e9ed71edab45221eebcf84a7c88d069f0d9c14cab5303ce1f8228af7e75524e58652716ac50f624

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
19333d6fe6833d2617508b38f3ab3dba

SHA1
f2f6e65989f2a4d37b4f64918e7edf2ee29df30d

SHA256
c9addebd8e0cd835fbadc2be89e10bb6f1236c97b7b4916ce1f55fe0b8adf951

SHA512
e15d2fa9ffb935760afa4cd1db4a1893ccdaa50fee743d1fff701f705dfa9c20d770267631f6c43c1e4b358c16d283a879291378eeae953e31cdb29b225f3913

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
99ee81fcfe7ee7d17139d1df452fdecc

SHA1
b96f11a69845dd45c3a6c425e4b94cf547c65a22

SHA256
798fca66a3c6bcf8cdb25feb89a86cd015d2c632cb394357fbb8e3d8d5a4d7d9

SHA512
619e1f44766c41500845eca0fd0129a60d586bccb3fbbbc3e0c15ae7cee051955e8379c0b0d2b9cd39f76309e83a876409e64350423fbceb3efd3dfe70b0179a

Download Submit
C:\Users\Admin\Documents\StopLock.xlsx

Filesize
12KB

MD5
0ca24a8ea079c02f844a5048a2b96416

SHA1
c4d0edf4d501ad235c57f5c1e8f90d30d9cf0f72

SHA256
c9c367842de50e3ad08137b2ff9698f4d769361486d7baa2b2b705364053eb34

SHA512
6e3afcc1c76c8c9449f2bcc653c57417444bf443bbe818b947a9e8eab0703ea0c4b4c8a8145434e4c57c918a1e0a3abe6815e890d5dd585358b9edc91d121e4b

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
730a6944f0652652caa9e5fac835ec9d

SHA1
09dbb321c46720b3e5ca35b47d7af9cb52e840ce

SHA256
db9060676c875fb8877466f69252b85fb25e0b5710fa33f6476bf219828d7a25

SHA512
2b7af9ffb47f4bd9dfd910b3b50ba61c85e3a7c8b5f34222eeecf965ed223ca37769c8f90119ccb021ca64e7120e0f59e8cc6b0e5c37eee9aaf63f7b98bfdab7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
0ec34bfa63d9989f88f9aaf9f7a8ee88

SHA1
a74619de15c46da04b93a269f6abca97cf3073b3

SHA256
2616c4a59d14ddcd1a7595cd7d5563a37daddaf3f84b5137543a6d8cade9d4a3

SHA512
89323f6c96639c5285ac701c554fbec23cc970df327cccf857135bc0d92cc64fd5db6a32656185af9add397548cb45e7b0bed19574c8886a04963d3c0609227a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
e5e170b83cc89cdae3c56b41b5f2fa73

SHA1
9586e7585dc797bab3bc4477ab5246788b92753b

SHA256
66c393306547fa8cad9beb6ef4c1e9d25f1873edec86d3d77c9551f8da20a52a

SHA512
555c28c1027b63d4442b58db21c09e86b85f22e6ba18fda3af36a7fdc31b513961668ef13dc9bde287792f9d783847b099482fbf14795df2212cb87a98f8a330

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
256a36210462d52cfdd57ae0a3cbcce0

SHA1
ce098aadc9f591de99e3e4bb9f5588203bc270e4

SHA256
d076dd134062b802659a30c30f06b92a2aa504d37ee2dfe7024ca9bbfec41629

SHA512
19313bacb7b2807257994bce1516ad57a7d4b87565c689dfe292b9ae49631d775303c46b8fb60338c52d1038cccd0a0836eec1b2e7ac616ea0102474988f7cc5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
55edd503ee24ff684196ed33ecdbf634

SHA1
2fc881267822542e3f9136b30136c7b94c93e03b

SHA256
fed3f61b459406c8e22f90ec692458d45b78130a37ca0696d8e28da7964970ae

SHA512
1ce22dcf56c9e6880da8a6698b4d764dacd56ba8b1cd80349cf686cfbda71830a242b1bdfca9219348866047725a7405c142f36ccb48a75337e81553edfb8790

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
20d9645c986983f3aaad906a114283f2

SHA1
62e639b26f91fed2a754c3caa07e766095ec9716

SHA256
a1f8041ffaeede2dbee8c19fbddf33e2fa977fa098e91affd13fb8de2766c890

SHA512
2c911f462a7eb0f8374f8b9e9dcdc95ca3310d1dcf0e6e24ac200c1fce1cbc2faa8a752c5c76557e8ba77f77a3d16549053d9d5b3190a82e2d716c9ffe8419bc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
c84000ceaebfe0a01a32bd7f606c5a6e

SHA1
fb9687a9f2b18667ec66a9d52f9596b1a5e4df47

SHA256
fc0ca0a47a8f188285eaac214ea8c0ff864573f83bf0814a1e4a12be8e2f0581

SHA512
636b077d9770af4efb1ceaa64ee03a4a29b3dc0564340fcd4b21d1aa4fafc14695ca9cbea7a99742518926554950f246f7f9ae79991ad71972c73fb83e3c5f15

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
28d927b84d809f628bd7f174ad2715d8

SHA1
613f3feaeda9ee97a3f7fdf9cd47b07cff4425d5

SHA256
ce6a2afb86f6e3c5eb07408d986f2725e7aa0716ab9a44fcfc739e347c8985ce

SHA512
bbb5fe579467e74784521615fd342138a0a76112624844c1a60e6bd5f2913687b48d42a5fa42f5830fc9832ac89a3acde84a49b443b0ab2574096d2bdc6de964

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
224962b9fc335f199b9c077e3974a5f7

SHA1
adff3acadacffed5a35d123f8c80d7102027b71a

SHA256
8c74c010ef69fa65a6d34faa2c4e3a474c805acb2dff5210c41637bff8e201aa

SHA512
37914ab97cb32b242a9a01cafcd79c5efe61f910a28d7679e8a3d39c2b6dbee7c0cd70bcfb7710c55de53b6fbbd7c1c836e4858628b7658830f05df1ccf37851

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
aa402176c9d07219a9bb9f845d4261a6

SHA1
cb50d8295a5eed4347893467efef640673496849

SHA256
c7a1b3b95b32916f8c1c79e5353ad2d899b47135d6ca60da42e6ec4a5b204564

SHA512
f1414da9ec6ca97c2e2d7a11be01173faa93634bfb4c43914380906fe5e132b1cdbc3142e64e11fbc14bff2c5c2402638238acb413db93f4c69541a7e534111e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
ea52213fc35457734ee2d078ba8f2656

SHA1
027bda9609bde3595d3ef743fb90cf6efa28c1c7

SHA256
3d11d5b0ffb6e00f7f73d8d2f3437781f3522078396bd29424054a8231d16b1c

SHA512
439e3727398b39381f3074e38ae58642eefbc7d9be64c978a093dbd7d1d11e1c04aeaf6a4ab58496e6e125bfce3c63dc54810c65db079a02d9d509c2f30c16a2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
cbd8d5ddfea7a9701e9828e178a01169

SHA1
a5e7ea12470adf56f4a0f0e6e59bf019edcf4967

SHA256
8cd59b666cdde77390e07f66c52af24edb1f18df56de88885d6c5927bd53f51d

SHA512
d0295fd8a9622fc141a3d0feeabcba8a09ec6e37ee510f0af92e412e0fc651058922a6ed72f2899450c14209c37fdaca812ce19d6f5b7e5393dc091ae73d99d0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
6f89506e63ed32b423746ff63bf9381c

SHA1
e537fc728df276de8663b793b8bc286cfaf6b4f3

SHA256
a827051462d1b8bc9557e6b648f27c2b42f6ad0950752d1e6d515c023c0b356f

SHA512
dda5b077eac6772f62a02486e6b3f59786a0568632308890f6bf83bf5cbec9e47017badb3e0fc1daade12cd606d1b6b3512fbbfe4972af5d8d22b486b16ea9b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
4fc652c51fcdb428f53ab21f3a70c462

SHA1
ea073f9dc82d0bfd2dc07faa5ee7b9e895e8dfb9

SHA256
eb932f1c8abfe16a07705c168850b8e6eede5993989a6364c8e7505e6ec7a563

SHA512
419f90b8f5a672e2dacd8061d39927fbc380922eae7e8217c46deff040f2156e65c802028f4d45e115edf6ceba414e27b3d3c116a8e469a86434374a646319cf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
b0065665ff1f2114a60c2efa36f93d49

SHA1
2b9fd485da679bcd81bc287fae03db6f6515e0d6

SHA256
6cedb2aed1379751dbfda898f049ddac683a4a888bab1017507e3bca65f5aa5f

SHA512
ebcb2131e2749ca7bfa4aa4513b1b30024915ee8a40457163684b5504a950afb5e355fc52f6acdae5804bac191226b31f759f80352fd773985a751a781fb729a

Download Submit
memory/2380-3-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2380-3780-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2380-8954-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads