xorist | 1005665b0240831a78aad206707cad93f9ac891530f05abf7895f1400ddcd44a

Analysis

max time kernel
119s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-10-2024 05:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Size

40KB
MD5

7dfd0cd482ce6237745b82e5355f5e90
SHA1

9f8d910d931e7cc312e4a3cd5e88911d952b7465
SHA256

1005665b0240831a78aad206707cad93f9ac891530f05abf7895f1400ddcd44a
SHA512

746f05e85dc0ee920a5f61059ab96c3d0e57a0ca8046c356a735c306838b06a6dd56c941cc778310a700c690a5ee80934a9139793a8a08ba20f3061641ba19cb
SSDEEP

384:3ebFNw4Pk1itKkpAjjalrkO4qYvjSrkDCgSxnRogV96WO3ZB:30FmBkpKjqY77DCBJq3

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2548-8724-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2548-9119-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2211) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\596KhShtP65qXDb.exe"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scopes.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_parameters.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pssessions.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMETC10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl001.inf_amd64_neutral_9209e816461a1a73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx007.inf_amd64_neutral_0b796ee4978458e2\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\battery.inf_amd64_neutral_cb8fa151a7b7cb80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc2.inf_amd64_neutral_7621f5d62d77f42e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMEJP10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Variables.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\net8187se64.inf_amd64_neutral_c239ab5d36a3b3e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr002.inf_amd64_neutral_b4ea26a49ad66560\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_do.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_type_operators.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\spp\tokens\ppdlic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_environment_variables.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Core_Commands.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\System.gif	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv004.inf_amd64_neutral_fc4526bbfbd5feb1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rndiscmp.inf_amd64_neutral_4ca64d28e1be8fa9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_methods.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Redirection.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_neutral_1874f16002601f78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\faxca003.inf_amd64_neutral_5b8c7c1dda79bef4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc10.inf_amd64_neutral_2c5d0c618dbfaf2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Quoting_Rules.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pssessions.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnis2u.inf_amd64_neutral_de46607a02fe2552\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx005.inf_amd64_neutral_f65eeb9bff6bd8f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced_methods.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msdv.inf_amd64_neutral_571f87a277565224\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sbp2.inf_amd64_neutral_332943647e950ada\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttte.inf_amd64_neutral_16d100fb6ba2e40f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmolic.inf_amd64_neutral_a53ac1a125d227fc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_cmdletbindingattribute.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcommu.inf_amd64_neutral_83cc415156be45c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgcs.inf_amd64_neutral_aafcd45e4e890862\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\sl-SI\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Redirection.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_History.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Parsing.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_troubleshooting.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Parsing.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttme.inf_amd64_neutral_ece4b1cc5aee6a38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2548-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2548-8724-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2548-9119-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_OFF.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR34F.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Calendar\GlobeButtonImage.jpg	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_floating.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe Root Certificate.cer	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\PUSH.WAV	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\it-IT\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\about.html	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\THMBNAIL.PNG	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waning-crescent_partly-cloudy.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382954.JPG	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02748G.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Oasis\TAB_ON.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-down.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mouseout.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Mahjong\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\blackbars80.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Office\Office14\Mso Example Setup File A.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Esl\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15073_.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_rainy.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_close_down_BIDI.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\vintage.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14756_.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-previous-static.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\Ole DB\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21299_.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Thawte Root Certificate.cer	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-first-quarter.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099200.GIF	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdater.cer	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\icon.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02736U.BMP	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\SubsetList\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\x86_microsoft-windows-h..ragelayer.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d0e7a82c9dcbf8de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_windowssearchengine-structuredquery_31bf3856ad364e35_7.0.7601.17514_none_d22dc8d4b889ee67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\buttonUp_Off.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-diskcln.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6c535f42ee5f277f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-wmpps_31bf3856ad364e35_6.1.7601.17514_none_0cb05547529cd10e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ontroller.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c5f238be3fa63468\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_presentationcore.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ec070d2fd345969e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-b..ager-pcat.resources_31bf3856ad364e35_6.1.7600.16385_pt-br_20f45663f3f88da5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..erycenter.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_1276d7675954221c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netloop.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4d52c352b5c38bf4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..layswitch.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_35fa663bc994d11c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-scanprofiles.resources_31bf3856ad364e35_6.1.7600.16385_en-us_042ff2d9a17712a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-flippage_31bf3856ad364e35_6.1.7600.16385_none_0f19716417635239\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..cy-engine.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ae6a4fd1193b2da7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-robocopy_31bf3856ad364e35_6.1.7601.17514_none_c90e996c4aa655c4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ncdprop_31bf3856ad364e35_6.1.7600.16385_none_afaaadda29b44241\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-memories_31bf3856ad364e35_6.1.7600.16385_none_51190840a935f980\Notes_content-background.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_taskscheduler.resources_31bf3856ad364e35_6.1.7600.16385_en-us_21df7e00fbf2db0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mfc40.resources_31bf3856ad364e35_6.1.7600.16385_es-es_76c967d51a97519f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e953eac440002341\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..ty-client.resources_31bf3856ad364e35_6.1.7600.16385_de-de_6d66e79a46059144\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msieftp.resources_31bf3856ad364e35_6.1.7600.16385_de-de_677827f68b7f969b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-za-component_31bf3856ad364e35_6.1.7601.17514_none_a5926b147a413e6a\ZA-wp2.jpg	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..eyboard-korean_101c_31bf3856ad364e35_6.1.7600.16385_none_ec100a8568af5c85\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-0000044e_31bf3856ad364e35_6.1.7601.17514_none_66cbee44a06557b6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..nsors-cpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2d56165507eb973c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ncryptui-dll_31bf3856ad364e35_6.1.7601.17514_none_83a31e2e4146afa6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-magnify.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_97e629cc40efa3c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\ehiProxy\50691bdee045a2df00f00ac461844c5f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_black_moon-waning-crescent.png	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-icm-dccw.resources_31bf3856ad364e35_6.1.7600.16385_en-us_20d60f5b359fd24d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lua.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_795003e0434618dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..ls-ksetup.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4382e194daff2129\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_netfx-aspnet_webadmin_images_b03f5f7f11d50a3a_6.1.7600.16385_none_3b995fcfc0e586ab\branding_Full2.gif	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..ityclient.resources_31bf3856ad364e35_6.1.7600.16385_de-de_17c37298caa7b415\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_de-de_64066b6f42a994d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..tvratings.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_25db7d0a4281b49a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_remote_requirements.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Feed Discovered.wav	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wpdmtp.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4088ca2e421bafd7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_faxcn001.inf_31bf3856ad364e35_6.1.7600.16385_none_a46fb88aa3f10979\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-charmap.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e5b6b8f404776a1b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_uiautomationclient.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0efad129e7700edd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-print.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6a78ab990b8a97c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_18a11c58aaf4d08c\Column.bmp	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmpdmc-ux.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_e4b25cd32e356f5d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..c-runtime.resources_31bf3856ad364e35_6.1.7600.16385_de-de_50b9ec05c05c84f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmminij.inf_31bf3856ad364e35_6.1.7600.16385_none_45ce09cc47709c2b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..grams-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_59e506d340352cf7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-h1s.itprobasic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_45e8f1a2175241db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_transactions.help.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..s-utildll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_40847d851b6960ba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationClientsideProviders.resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp6.jpg	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..s-service.resources_31bf3856ad364e35_6.1.7600.16385_en-us_676207815c08e334\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..-optional.resources_31bf3856ad364e35_8.0.7601.17514_it-it_a242b1f371a03af9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..ion-netsh.resources_31bf3856ad364e35_6.1.7600.16385_en-us_ca56bfb93c9acd58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-u..-core-tsp.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9d068185288626a2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-mreuse.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fdac51847f332122\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..-provider.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f7fa44a11b82efe3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..bilitycpl.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_0c2589ba32c35b8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_srpuxnativesnapin.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ac86103aca9c9d98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-docprop.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9600ddd948c3c1e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\DefaultIcon	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "AUKXKAQYKNPRTBC"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\ = "CRYPTED!"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell\open	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\596KhShtP65qXDb.exe"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\596KhShtP65qXDb.exe,0"	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AUKXKAQYKNPRTBC\shell\open\command	7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7dfd0cd482ce6237745b82e5355f5e90_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
413B

MD5
b7812b46bbc513059cb5ccf00c691fc0

SHA1
03028393605ef0d8acd6e9d352e6771832b8c583

SHA256
530b750ab27fad54d3f582b4112d2476731b541c8e34cf2ab101835442a6f62c

SHA512
5228e02db737a4618374165450d38a6c0487e223f9f8655609d769aba01ea26c311d2a6105d950529e0ec50d3eac73e237d4cd70143be9318163b9726f7c0d41

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
b92e361432cc698b7095967fa51de900

SHA1
90342e43a79f2ddeaff594213a75d52aa6ea1d72

SHA256
abe894e445d180913209924dff3a6474b11d3017ad91cae32eb53b8a8b22ec61

SHA512
98535cfb3ae51166d239a8405d909f53d9bbcb433b642f61664bffc8728084128d0f9f51293dd6a8fe991b1d5da1de50f6208d559702b2b8ae837e9655c23617

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
a488abf3edeac149a14182f44b1e474a

SHA1
8b144e339b8f60564fcbcd96db8cb07c7507899d

SHA256
4c504438769451bb0d52acae165238bfd8b1ddd5b1db2617cd374a06c53424eb

SHA512
498f23e62199f3e7ae2b57f9f64e6b4a2ca2b9af0a497aff7cd58796a478edf7edc502833465a5f0c5c41591a3c94d7ffb2a4ca9d28a5709ff8423e5d0cae0e7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
b2f6ba1a11836fd3e43db255458fa462

SHA1
43d0dee59287a1f9d334fdb22fb35507740ea442

SHA256
4c2734214ddee0fa805e97aab03c0d90bb3678b82c98768dabf4de669c5d73a0

SHA512
6d15d9c01008847ed85a92fac05b5ab7a7ee3b52909572e913d80be996ff2b433510b51b4bb20fd36b33a92327186b5de37c540a546c3a20b806156b9ce47f18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
2ce122577865f9e082dd3c3516281500

SHA1
aeee83f0cda73e2c64fc5833d64f7de95908a450

SHA256
a5a1250848b02e2d34fa40b31ce36d6111df2a18e46c2b76d20302e3f0fea4c5

SHA512
2b0fdf16c8c8b9df04fa27cc59f425fef474c136aa5a933d6364204922ef4a37cf4f69b113730aa5d90e4e2074e576ec28b8fce1bebea2bcb7513ba4172c3796

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
8827d090749dce043c56c559ec3e37f0

SHA1
0cda7995dc10d6f18669949efcdc979d4d0dd1ea

SHA256
fa6f65da252bddacc45d2342ec85b8c3656a042fe2d70ca3e499077a49bf1e36

SHA512
d2b8c198cd1de7e368927c54035c2b998d9f21ffecba522715dbfbfe8b9006f4f46e94d62542d996a90a1022244d6247b12b54bc0c96eee928a07f53455e9656

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
86a8bd66d9aa4cc226954fef3b4ebce0

SHA1
057285acd70cb86141a6c12ba176d024c1093b31

SHA256
4a251ce4ed85e116d32de1acfc33e13d27ebffd5306a327426eaf185067bf386

SHA512
55071e66d7dcb59cb6a9336f7f5799cac3db3c7efe9d46b182f4de02fbf9a274f75031082a9b852815eda9f284e628959b1a85742eed40c999e19af61df123d2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
87ff7340e2c851c5ac5fd9852bdd16c7

SHA1
141ce28b3c28cb1a2b9495393b0647bc7cf45c1d

SHA256
ad05a96e19a7b9f371c3252117640a0ef57bfdd0dac4bc81adedb9c3283e968d

SHA512
f5dab8580ea0464bc655a816446aae413b4c6bc5b83015b38f940915493b841b997f77c5937e9f1c7819612edf079e8097c7b18e423f1d12d1399081049fdd92

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
2c5a12759a2eea3ec6f6797c7b1a8c26

SHA1
db8f8dad7214512f972d65399c4affecd5ecc177

SHA256
d2b212631b2be71701c50a81477b26d46d3a59b80025b28d978e232f79c4c76a

SHA512
57eb8f49d9b834fc582edab7d37fe2c99038fbb82a3c8d80c14c0ce80105f1ac556f005ae9406566ecd448e293ac845209a3b001b1ac9a65acdc51c2ab218676

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
44598a74c0c11a8b3cf30266240a9196

SHA1
a26055e95a731ee5c00248ad09844cad489712fa

SHA256
b1ef806d30700c87c324a955f168344391e39ab65e1490d59df30d67fece0d54

SHA512
ffb570d53d09d617b267496690ff074128c9074ab7e32e66edd5becbbda8a455018cc0d95aa79c061dd7de8f0c8adf9752250e8cc2cbfe6a069d9cf508942b85

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
8fdd027cb38ba33c64ba5f75549fc19b

SHA1
67bf3dd9133e7e5b73d287cd72bcb5c2f0f0dbcd

SHA256
074eb5c4e9e1f07d4e147b732d58fca62a0aace2f09a96f548aabd7a945fb66e

SHA512
4d6e11bfa501f4701d65ccaed719d5300a7e22a09e2e646f881d34b02f4c99382fc0d2a1403088c17606f9b04b0e33503c309107027046f82ecbdd51322bbfb2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
a1d48bfdb5a2e7c124e8db7543b6f5ed

SHA1
668e24621774e710fb0eacc9654cd17ffe753114

SHA256
eca2b13b05a4f79cde627cd8cd0319394cb312cfe8365d61e7b9646e28f3ecb2

SHA512
4e02f84e24a7112d7b135bf314589ca60916b88d1f9cf8c1a0f4357c9a953734548458b49f31bd45b024dc4389e19b3751816a928d6cde38aacd1620d4a90929

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
97d29409f67c18fbe82af5d94b184baa

SHA1
1a30a23247eb47a2090d7739163b32693006b4d7

SHA256
7967e01491b0f1bb6c0ba44cc68612f4a03c905ba850ecb36a24faa0b7c52687

SHA512
f2ba1c504414c5acb5133c30ca41f4352b8dee56803b213abfb46d71fe4983442525e7ca708afe7e740d33fb93f7a730f21336fb7b4d84fa62f291417cd027ab

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
42c98a19f51881ec16c64f4d1bf9681c

SHA1
e688950a8077c3460e09b681e7b5d968a40fe855

SHA256
e41a55e793e26f0439dfc01a295ce0ccc9e83c4d126327ba95dd3e03182f0baa

SHA512
c0db636b522851269b9ceca0e63dd41e9bcbac1be87d3da0ff06b6fc9969c7c4ea2f5a1a669a27f42dc4c53cedb48c6e0ed624528c9d03e2d05c451a3f2e43f2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
2609039795f4ce85f4d906842f580bbd

SHA1
181f3f82af0334ea0f66c2e6b55a668f7c4db914

SHA256
198e76e29ca80e4606027df726c1f2e426267cf26f0c6ca22df0561e318c7451

SHA512
45fb6c467f9a08ad916f008941fb2f5cfac9bca51b736bdda3496b8c60d2d71b4adb4fc8d535f052a80c71e627fdb496994a4b8ffe1033ba1ae6f74fcc1776b3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
910fe07a7d3d0319564fca81cfb1f948

SHA1
dc9b0170769ffc975921975b0116884b9d0bb31b

SHA256
5c12f8b21da348eff28d2148306c29c4210de5ad274e71135041cb99f755c03f

SHA512
fa9b5ca4679001b6b6b2bab976b7a9f88a869e8095bbed772f97d814ab901191e163db36b994f0eae87a36a3879c3ad23d53c5a38b0ca78ff83e0b8db41cfea9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
0d64cc9f71276b265946cae099719beb

SHA1
d0a6241ac97ce9b9628f2d0bccd1b90ba782f910

SHA256
b72ed82f58ac6eac966729270445c4179a3480d0d80efbcb46f092874935e8d0

SHA512
bc1ec68720f1baddd3c40baac0e2866b7c42a5d539bba20afa35a9d45fced74e66a5c02001c9cf4494508ccdd0841c76057b8d1c33bfb8fc3587fca0db842b31

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
efe7dffe4c5073996c540b0b94a9071a

SHA1
ec6223a2516288bc6e901420e6d4273fc63d973d

SHA256
8aad7d655656e7294ce8311503cde9e5ebbfb1a85219ef82e6c8f088bed432ab

SHA512
b0b23f2439a4db668a1579b954df359a079983cddaad5b43040e7c9cb9efa9dc53812fed501b6e6a97e4b63eb61fe0541f43592e445b132736fa3a11294d57f2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
10d0efd7bbeef098dd03e588b2872ed6

SHA1
69a00808ac4323338cb0b279ac3973a40532657e

SHA256
4e40b10051e835df20e45485a3d0c1609a72c1e5ce3a79e3e42f3216a26603f9

SHA512
635ee9020c19b76c00ca61e85fea4b4d8033e37d002fe9048397f66685828a2f5f77a25d1bad272098e10e52b66af5e15e0fef03ddff8ee58997010880256798

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
15a6f6ee0d4e72428aa0e25e2ef87bf7

SHA1
fe1d3cb1aeea50738c93a4eb5c921d1332a456ee

SHA256
a783f3d9c37db5c7ac1b5b15eaba8070125f979bdd42ac465aed48d0a59a9094

SHA512
08ed978c093a4f06844f0c1155699465d5cf04460205d0beb823e5afd22ab6a421a797ec37b48e06ef7193ef31bd7bdb9458f47a445dd8ba0ffc3fc9b0d0813f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
938789c29418186fb41b368fe205a934

SHA1
96f49a9b516e33bdb1cf7a9ed6a35cdbec1fdbc7

SHA256
b68ad674ff165ea078826f3f682772a51db8da6a2d151561ace304ba65f0704a

SHA512
f95c901aca7ac63d2ce471fd1fbe95adc8b57913eddd763dd408a954c97edbf48dbb4256dfbfd4fcba0a3e412cdf1668545a6a16592512b5690d1aa7227ec3aa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
10f3d71a75601a0fe84338d670f1217f

SHA1
c5ed5c2ecbe943ad2d16dd48c468b5489823b4db

SHA256
312647e920020ae6ca399172ed1e7c06e7c73181a4bf03e6a91f6078c53478e3

SHA512
2d5b6e98b02af68f98db5fee8872fb2640b17c70daafacbcb74bb0dfd9f42705bfd4b942fa054cd159d720d323ca3eff7a8321894cbf318be4e9980c729bcc57

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
57725e99fd112c9be578b2ea8bfaab51

SHA1
0ba43dfe9c0c15021fb26b3b4babd18059d2e2e0

SHA256
8096920fd9ef1122f79a2977baee48341e5ac64a38ddc12a780c289b39e605f4

SHA512
e901339da7826b5130f9266f7ad5b561861543e5ed49c30dcc393a2f5aca9ba717f3e397c96af01f1b956e2f592cd5732d7dbfc79c25ad1afad20ee6dc0d2837

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
bbe8ad72f46d7143d0f08063666dd22c

SHA1
2bad3f44e6ec9914bf15fc853d8f9d66805ef21e

SHA256
1faaeec06f8c0bdb4d6737e849a9384b80139e05f0868413400b84683459723c

SHA512
7b96cb22a1f2f583680394c01856b9bffcaa163482474148f737994a4e92c6dbb26b27946428847ff4c38dfe268e613170059cd719e07a98200db329a4538eeb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
56b5d814ed84b55ebfc1e11e73b769a2

SHA1
84c442986e5b1ae426c3ecda0ae69906cb4a0a5d

SHA256
b3fdb95dde3382998c3f46d3bb71913c4a68b1e5f0e33a44bc8c197c48915f2b

SHA512
a5bd0ad1eb1071a913f692a329e2e47ed59bc9e14a644ef8174e9f852c84d80f434abb220558e9889aaaa53e3516620b0f2f29eeb3cbe0cde9894883264755f9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
ba657f04c6f5a7517342dd1754c7dac2

SHA1
0ee60a5bc2a00b758abd855162e0f3be5fa15908

SHA256
bb6bb092b89197716b7885f72d927f464c410ab972bde7eff7992ff19037fecc

SHA512
159b86229244302c5b72164ca1ba372572e88022c430d43048c10ef1834b1143010e2d01b5fa6aab9ea587ba03729f3cfa2cec1361962d268af63da0cc5be0dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
3235aebe105e0a28f7788d398cfa3c4e

SHA1
bca28156845b456f0c37530849c8ebf5a9f22621

SHA256
37767645bdb3a604514405b9664fb609e5bd6a8e12717de3a690bd69ccf34771

SHA512
223a0cbd8e8445a99943e7f2b34353b1942205923291bf588e6a615dc54b3d233299e13f069796bb430a5b34709c51fb3f9c52f7b4c852e24acac1af0d360089

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
c8cda0a2102d71f58861ae1c1763656d

SHA1
282d6c6aebafc8cf8bfeb6b0929bc1c0a7d101be

SHA256
3bda5f299d02e17d6afc3f299199d4755d036c37c23f2a03cd8e544ef841f339

SHA512
f19b5539184e6b3d64b2696fef122edfcb1330152b8f5923e688ae07f9e32281f43939c6d116268b748d76a41697241a0c29661b1f5a4a12ce3dc16b24e84fff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
3289c944960a7c3cc7fa0272df50859c

SHA1
68881c6300a762d12cbe8e9fca28e6afba8f4424

SHA256
92c4bfe177037e06332823d675b75aa143dea9524185af67123954fa297a9149

SHA512
579939c7dce616f3b906e94fff528a16fe7eee83744f821bbe597a8bd3c5a8c253c52bd9ef676b8b6bb5f04391fa709c8b2e53e83763b839dfbb911ce82bc4d0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
83c2ba8c172400a5a8ad9421cf5c16ec

SHA1
a1eeaf4b6ddc64203ef6d75334509fc649db2bbe

SHA256
c81fae1f5f55af4a1c722db102ba20659ba628cb2d2a4badeb819baa4301d710

SHA512
b674616d0ecf2a50d870859bf8e19a9f2df8f5aff58c00ef50a0dd222be24f36a17b00ec6d4159afe6411b0cc60315c21bd2fb9f0c35e79e072676f244c21ee0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
e6b147d6ab6271a2ebd96e603242b42d

SHA1
bacb430d5e6197a52bdfb750cd808d39e110fb95

SHA256
a657a5304ec3b2ccebe0dcdc09d958ed8627073d66c59638f5a02816c019c9ea

SHA512
8330916dc2a94544c7129aaa948dec11484c966ec7a6795fe5b7502dfb9fdb777330731c0938343bbdbe4d7f0e517ae9e29b76b98c0bee4a7351db196bbd2aa0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
d73933919e45af578525bcb8f78d4e35

SHA1
5c215e4f67b5c9f18dbbf4b9aeaad87a1e535d01

SHA256
a9130f051676575670ffcc410c928a5e2ae1f95a69cdf2c06426f07c78726111

SHA512
6551af0d0397911745a46fa082e3e88ba9f9fbdc51eaf394aee575d7ded5b13966128491284a6498980e8e5204e03f4cfe2dbaead829f18429c4daa095bae38e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
ba0b97bc2ce784078981a3c68eeb66d7

SHA1
fa6053bbf98d5b41c3bdd220e8de2dc343859bb8

SHA256
316d7b33f4153d337b0c76470a710da903086f0e43425bcc0e5329c98051b0a3

SHA512
20eaf3365403ca70af75e90955d76f38ecfb956d16871afdd48e15e0fde1464b2bc76f2e076e66747c849f126ab7c3d2f7ccace1e7c89dbc51923f8d86d08e00

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
86d8b26c1039a61e8a931d45994efdcf

SHA1
e0e4710c9369f802a1b00459f0554d8a945882bb

SHA256
faa09d8a68eb2a8ede80b535883d351d70d3252eccf71d262716886c158c9b5d

SHA512
79a30ced87dbf9dda1c1eee6098220d13cee08b2ff31471f543a623a80c3f20c1e29dbc95cdc8a28f651842a8c1dce3fed2763dea3ee144b49c117d995b4f55b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
8c0cbd1dd717e11e7d4484a45f075eb4

SHA1
e6b4749989b1a915c08ba6bf796d4e32fd8ce452

SHA256
7aba72306d3f7dc8b2b587f960e7aef405abb9f90d57f73228b6c9ef040d46f7

SHA512
6aa0dbf154d9ec2f9fdec2972d2fb455fdaf9b84b09a7bfe861b7c4fddab9ffac9eb9d4abedda950020feb0eed4c1d408a458ba72e295d6b20196ba89462dbcc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
76f084e8e32d43edb80fac5c66d87372

SHA1
e6300c9b3c6a769ab55c9b54377fe375dd1b0582

SHA256
6a0f832d68ffd57ede09304c643e858342b08301a79cc580d31aaad7a05b0c15

SHA512
d1cb7012b71ab4c91069c04d17a643f1eb7de85b1d6915053c2b489e691616dd692c1cdbc89de37ce611e440a851b2ee3d90ddc46b80d2d0ce2be259166d996e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
19bdbeb1f93a8a19f92c372965144519

SHA1
88e63c243721becd4f95da47099a1a8836191774

SHA256
34e748ac4c485d70499013b9413ae9024285689ed6fcbda29a49fdb174842628

SHA512
42b9c716e3ad3b4de608feb963e9a118e297438c0bf8b41baee02a29197717fd08a83ba3cbcf015bc90cc8517263d3c7227153c8eb1291243314d7ff76143af8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
9fa5afcfc34568a7f29f7f85c1625450

SHA1
a7ae442db95074db12ba7be39eab259d0d6699c1

SHA256
2c97e8b839cc7bf8a798e4f82332a60294e613d7f03588b11ff37e7bb55332f2

SHA512
ea231489f201000a22ba378e185a84afabafa1fa84c84cda2b6d9027f4460040c9b10b6130142d38afe14e09587d1a9070c48609272b77813910d3646c6d6d4c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
fa12a7612724988a1746b41d3cd855dc

SHA1
e9c0b13158acdee96500a24ac1011f9b8e28611c

SHA256
45ce4ae86c7d7d6ef51bde219673061ee69a5b6666571bf8c37c4db09b852d77

SHA512
0b275cfb0f267978c9321f873038b1a391e3ea0f9b04437af186a0474e5a22f5b6c1ee21fb0563e84907ee2d63ed8a49d55d848adb2229b4a59425c1b140de0d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
d55ad44c9a275ecce0dd6ca5333bb6bf

SHA1
57f6bfe1e28cef9faf9816dd3cffb242d1b4a1ba

SHA256
e6bf51bfab8d5092ae508a236e0e5d7927d092503c912eb2307ce3dd84b11809

SHA512
5449a22abf2fba3c521f266645b64836034b8d617f6180fb22295253a52754a767b79269c32029161661f9bd3a6621072d7310234ff0ff95a18598711c607a13

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
0c17d9fd85471585819cd9232add0d1f

SHA1
b112a4752119f359cea8eebd2ac505bcfd1228b3

SHA256
460d1d43141d03f204c95b093385f0154383a8fdff1dc4910a39ce59b4cc00ea

SHA512
1a7250b5a24ef69c780a26d6142646980c44332224560caf9af82eb275af68d77a3ee534d8cc80f7b2d05c8de6af35f602e959a62f525408f9de105d13eacf4d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
beadceec6565f5dfe00cbe71ee7c35a1

SHA1
a2e4b60008d23870bc211841a64862a265bf8b05

SHA256
9bd8648007f145e150519845cabcc92e8c887f20a996ad2b1c5a9148d17fe065

SHA512
1276235802256d6531ec2fe08d843d32c2ff5082347500a103d6470916c86a63bd720d7c6b9b528b353b51b8dad895591248d002204a2a8b26d8efaaafa4142d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
14dce648ae83e6727e3d08dcb059da7e

SHA1
ced1c66e17575ff66b4f2e96120bb244b41278a5

SHA256
95cb31e65cfd2bbd68c89cfc9e83f3c6e059dc4850012b2b0bec118db42c0992

SHA512
2c514d602dbc59907675cb7541a733311be90ae9f4b04d5d18dee27eb9e5bccf8d9165cd4a22bcb851df8fe48e5b1f78794a17175b2da063311603b52ba46f08

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
76c9b950c888b5fde892bf35e7789303

SHA1
160fc30a0aebd8d063270ce996616b90240988c9

SHA256
fadddd15bf5d41e467cb9d9ac16b15da704b5e2930a53dae06ef7d207a81b357

SHA512
b460650e47190d67a5bd1c93b91cacb6bb66a9121f82349ed7e817ab481ae60d345ede7be953e7c2181263b984fdb3332807417348df73aaafc2a9782e305316

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
fe7f307853096bd13823c1aa2362de5b

SHA1
79a30c54bc3f9bdc30a078136ae127f7d7e236c7

SHA256
aa228ca638993cd95840f69fdfca221447cd0239c9403e142db45a97ae8e8d7b

SHA512
c81dfc658cf6d17b5dfa8907c87cb9fa0a0affe5f79177a57df26865871d8b2de4ded8ede0db8e833dc9b69eadda595dba0d58c0b106388ba01861d089be5b97

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
e7b376c094e8c08f95c51c1c24cdc364

SHA1
e1569d97cdc19220fbf21f51f1ca784d5503f74d

SHA256
b571e14f8cf08f4e5b261c51a9d2fc7b7e74c5af6b6ae428fc9fab120da38f12

SHA512
b00e31747fd87f821f64483f8965dc07ec9f8c6f6c89c2c7bd9a65332f1ec1b06efdf68cf8cffe6453af29be814c44ed574ab26e32c8ee45b36ee21219113b77

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
1cd9ac9f3683ca91ad0f985681164c53

SHA1
47b7fcc302fa4386d8d6780c70dcab32e7362a03

SHA256
9f9c612f1fdd145c7080d021ae5d22ecf291940a8139023daa2a4521ed39bf77

SHA512
ab88e4635591d7d3d2594dc630f224cbf678f11048487efeb2a4a7fd3519921338de82501e3677a85127ad96e4dd44be1fe377751750bb4590b4c20ef5ebcc0f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
5d6520ddf6b0c4b17f7fa7a74f250af8

SHA1
733df2e3b04779e9dec32d182529fcf37e41ebb6

SHA256
b3304e4b0cfc6110739773968c92b1e9a2c01b2c5e5049f62aa92b3251cf0c44

SHA512
8ba270ff6ac8eea08f35285a73659c13a0a42c641c888b686dff83e74cdbddd61acac5b238675e98189451181708ff3172623b02a572ffd639418420153545f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
14f1772c80fbb49830010909acb64863

SHA1
45d87fb819221f00134b0a358b850681441a5e3c

SHA256
f078e7984b7cc4a3a7b7b69bd34494db9ba9ed029e01bb5507a405317724388d

SHA512
00a1f1d090f5dead6168ed963d22ece7c4152aaf549883134d9361acfb627fde93af811ef20e150ba89e23b7f098f43d628ce8e8f901ff5419bc741551800ee8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
b1a9e928af074663b8cc64900225713c

SHA1
0552133fef968d47d48521e7b6c734a03cea6d76

SHA256
8af44ed5f1a280925458b583df4b3ce2ee0aa7218b1d678593671841c4222cfd

SHA512
a3a6f6987800393a5bf390162fc96f6d75100a2a565b19cb95dd44c47d29bf6f2cf855c9a72ac168407a570e64ff73a171a371479188498618b37a96130e7583

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
e9597801b7e8bc7584d4cd3ead317861

SHA1
ebf8952a7f71ae9555b1a3846a903f411a778d95

SHA256
768d5d659b4e1a552cdcd0ccdbe16fd1b7a5083b470c9a6454317aa4c574cae0

SHA512
3b3f9b9c2c27799af5b4cadfb21928ea24851d661de638b2e754ec3bb6d8bf7eb67dd8fe7d55b6f6844ab2bf3fb652e7502bde2cafd4254654962adeea80376e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
f4b9d0f9a7b0949c6ab439f5771e287e

SHA1
15f242cdf5a157164e7ca830997d232348cbeb7f

SHA256
8750249b61db3da06cfb702010a9d6e2beb6470b0c506b878edd84eacf400105

SHA512
2d8c68c6a076f2c8455d0aebdfa3c1c3992a779b3dfa0e2fc7cfb3024c9e4c74f743ff7c37d3efdf4420fedf090dada3c3fa67d20278234ef3e5982e17efc61a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
8fbfa85e84c9ab2dba092655b471ae01

SHA1
6d811dd1555631790d0d7417e363765bad7dd9f1

SHA256
bd66c164b415587191ad86c1d2740c9991bcf74c951ffdb6cb9ae84db82eb511

SHA512
3e3d22eac649b78fac6a0af0557954059bc7a4ff2a3becdc192170fac768bcc4d1a1f3ac9d18d704f4824ee651f5cc9c4f7c81b9e2a6dcfd1a140f01dca1f47c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
c818e1454d1eeb2fbc128b55c7ffdf09

SHA1
c4a6aa239581eb4a8cf742b9a6a666edf362c155

SHA256
3ea0029510e4929107d16e24efbc97ca4ebb31ad2d9089b3f4610675b5f14874

SHA512
8d8c075bd188cd3349af2b80724f332132107e0cdf1b624ba131a35435bddb8f781c2d0f020810ee73243746858ff3e92e8c53ae4b7dc75b493a1d32ea729928

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
602c1e78777f600de461abfc75e77b22

SHA1
cb8b55502270b2a4cc45bebb4c8e31029256f1c4

SHA256
693d25271240c0d2b1bdbfb06660749d095cc73d3237c7b1b21f1a8977302902

SHA512
5dab94dd20b0b2dcbc8f3468de88b91b74c15d9ba416be752c412329270cbe8137cd1f5c9b306f3df86eeee7b371b9aadd4a304ae7b2ffbfb9cd42471aae744c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
2920372a578d654def991c9f89cd1d9f

SHA1
c90d070c95cbd358027c82d8f46e0cbc5a99c3c2

SHA256
21354f7674734e79fbbd8c9bff1db67d3d2cc404e24a6356a285fae2981c6333

SHA512
cc264928da155bef1a344772df7a1e68d52efb6b44df0d164e1ddf3880b7bb24f59e9ce749d3314ed24b99fc01f5def4392be31e72b18cda074cc73fcf72a1fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
64209e56533fcea3e4d70d69e36c616b

SHA1
014a3b0ed98a1015919177e7a8953f0019940f7d

SHA256
fc2080ef11f68c406b1783be745a4abbab69dc47f5dd4da7cd977aa2dce91e6f

SHA512
fa62606439c725e352962fbffabe45e92befd6d45c0f2f7134f2038baa8c1ec9b488ab80e75bb14072884f0e1c5ef4a6307151a8453bd3a1b6e9d05166da7a12

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
25b94d6bfd98e315ebbaf6de30add3db

SHA1
582047a8786199bead00ea33dfd7e773e9d77f1b

SHA256
6ab11678f1874702f883c5410793ed022908b011ba4f3c5ed1b3c5a9eeae12b3

SHA512
0eb3ee519770cee332a95bdccd16d52c649903836879eb9f2073f2f482d9a93f4ea66bd37dde093c11c0f362259951dd0536f12f6c120fa6e85035332ef21cb7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
2dbaa602d19822707e846cc3f1183437

SHA1
c608115a61401d5c784a21fcc3d02fc1a0ca6165

SHA256
6635ed423ce6c8fd0319d57160dca72a33c59fa0d1b62581710b535937d5c267

SHA512
caf5f76bcbf599e4aa3a1200ed68d9cd508be65664d9ed6bd3f9b09505e4b339aa7ad7004f87ea3d9eb4e8b25e21dac9a4405691cc60fc21b46d5853d9171c5c

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
43400e6d7061a887079e6bdf19434ebe

SHA1
782774eaf236804683b99643943c638928b97a80

SHA256
a45a57dd15fbf9b34e14232e597d914f1e64bfa5544e1fdd88e1b3419547a7db

SHA512
c3261f699be93f9a190835a73fa4e4b2ae8b4c37dd5003c3e747e547b150f05b0d6ad01b044be1e1ee28d1efb575b7b411b7e878f82044c3e9ad2fe7b8f4fe33

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
c03b23ce0f9f2de03bcfa7c137cefc8e

SHA1
8884587307a1b26862117734644082ede2a20f84

SHA256
9b98ae35535aa86e83ede64016b58bad3cfd10de5e7e6e913028a24a6f99edff

SHA512
299ed6bc0d59243f9d99c9008676846fedfc834b4e6a23b45e84dd3a98557157eb2bf0572d5c111fc6cf778d467e3e36f9171026cdf5eb651df1d37d60b543c1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
a6471ee7b718893c119488283e4f8330

SHA1
c3646db37971ff0335f36c4c0eb272b6fed5c95f

SHA256
a8da6ed19c3209166b355b5d7272524f49c8cf6e0049effa598579b827905d88

SHA512
75b7c4d88c5cb7be13c448d53565994fa9c1fea2a58689ff3b8d0a77e89b22fc022a2dd2ef41bfafe8346fc88dd2cbadd20910763cab6476c65b55dcbe28f9da

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
4215334f4bb288f437e9ae7cfa1f6781

SHA1
fb4115f1d47258e3996e11187a7b0fd81c9e5d9f

SHA256
2f396ba606461e449e081ceb22aacbb84501a741b2d4067299dea51c2f349670

SHA512
ae9b7786f2ff47aa7a9564c87a303d729c7d3bf1066ca3533e3a1bc45e359f09d53dd43b19048bdf769aad182c6d4ead5c9fabd4096b6c44688986d094078c1e

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
7351cdc3c3b798cef284fbd1389b94d6

SHA1
c3142c0d6bccff8b507fab9c9a4bfdff6e0f84d1

SHA256
946a8e6732dc38b82e0b28ed5e01642d726bd06347404a687206589764a24905

SHA512
c72fa61ec405924015254471e6cb24cb1211f09b9a2f78d07da9f9043c7d70cb3668970c01b29efb740ed03d30c76fe85be8372cccd29596f092c0aa6cf80abb

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
992a6658e958c0af9c25d0b2fdbcde2a

SHA1
bfcc8c00d350be62af9610f378f5a1ba5af71973

SHA256
e3ad3eb3acef451168f009a3d34bf9917fe00256bf11679a8ed54febf5735dbb

SHA512
08008c5c2e2fc188ebb9125c28c9946eceb25e5675b5cdfa48b3e48b6c862a99f7d32f215cbc3d59eb74f7aeadf91c26f3e16de30f617bb7d182b9ce76300432

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
833967a2268fdd6ed1c4458ea4d28bbc

SHA1
c14cf5250461bf4753b6841896444764558c92d3

SHA256
8873ffa165dc006e12f605c742f2c415071f1f350dda9ea32ce781cf009380c4

SHA512
cbe83289999c4ca340bbc5191a81de58c877ad6c0c9ce24d57adafa2cd32e77f741499c7eb03371508ebeb37bad7a020cf9a4072e428b522ab2bea944a2ddc72

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
9b0a79ffb646896d7d395ad448e9148a

SHA1
615d605b5f65c7e0991b6949f3f12f0ed129910b

SHA256
a19b0ccfcf344f8480ec5bd22c166d06ec1c6ee90e4500d7dda48dd1d2f077e7

SHA512
f4d037f325f20e8bf2011edadf17029a7d6224d245070084adc44c8f852b7e60dd20c9c13f9cf9354546d57d0691c63f20fc22a6e2b1cd28e0e288b7067915fc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
91bc13e0b01e958b164320c9d12610d9

SHA1
696ec8be0c5b2cf74623b2270b930b55eb8a412f

SHA256
55b73a9b785e101961b7ce021854539530556e0438ddb5871fd48ba8631c2156

SHA512
2a830abe670f7be11a7b41a6aa73823e3c460a1817876e9f07d19eed733a7551d7bf7092c06a973df1edbd771b09b4f91f6524a76b3731db1dda687f9eef3ace

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
879ed6097be93bd18c1e6d703b3811b8

SHA1
557bdbc4b06ecac95967a2cb088b851b61558a33

SHA256
30e5242ea22edb0e29cbc6b49a3e71cfbbc0573aa25a5d7205780d4f12be2599

SHA512
1f7f01953db2eb8eac26745a97866769690d2fa022121d70d841a8ce78f2238f88585175d01ca8e38b40d6db7da292444a77e753fecfecfe6029f53de01c2557

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
04e782846ce4d79236f76d46084e3292

SHA1
ff3cfd79a28dc8a27dc274582065d32bf7b7eaac

SHA256
fa2f663bd096efd1bf23a5f3921876788e6bbcbc47c1ad35d532eeeeca873b86

SHA512
bd3f0071b6943ca0a9b631bd1ef8e280b0869aec04b72db303f5bf46e5e0953dc2acadaeb01595b16cceca3c968f04cae123d1f811ae26cb5cd2c781f33c710c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
0f7117b6caae352eab01b7c808106181

SHA1
ac651444f03bc924107cb2437dd6ae1c362abf57

SHA256
435476fbea216a133ef5916c128fcf1c7367eacac126d53b40e217f372b39ada

SHA512
dbdc83b41c0882978a6e7b7ea5e573be66424d47496640dbdd88f85586a5ccaa47ba6f52fefaeea6a1eb30f523736593df8523deac6caefb87baba78ec84a71b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
340fa70b77d969e10fc6f2a7a9e2f8fe

SHA1
e5b422c6d68e13d09a98fd269a71b04501ef11cb

SHA256
b79c50124f3ee977e8f1237fb7b1f2334ca96a00a84109a6776585058944babc

SHA512
5f8b43ebbe081770039428795eb64e40a523dc92773cd3187a2ba020b39ef8f2af90fb4ce22a78030b703556bdd0c15960e2971b6002af54f7878a895e155411

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
838b9f118f260e1425f5fa3e23c87b0c

SHA1
bf924f74317e982e2b7467a5f9168c0dec69c23f

SHA256
34afaaacf2d0a0d70bd433033e841ef18c4f96640076e8d1f8930b7cad701fb1

SHA512
ffbb89056f3e7258b91a44ef53824bbe3a17133a60202cfd2790600967d09f0f6e377dc348e383439aa93042d4c0db76157726b2265df5b1f58c0820da113d64

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
5397842c0b15594e357144d929ef304b

SHA1
10714ad21223eeb8cc41fef542b7a98bbcedbd15

SHA256
e945ddda86607d9cd303ec15d9db659b57aad54cf1e01795f147e1c73bc73ba0

SHA512
2f0341a43b41642aab6154e9fce20f52e8bd3425016807429cc55538e2f02ccda36c40915b9205df91644bac8d8ca27a7f67bf405ca659e36be3dde5172e5d21

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
23c502d2d6fe0830439deecf7db7988e

SHA1
8e86c0dcd298053e38791b005ec5aa0d3ed44c54

SHA256
dc2e3683746b2c520e9f326c81d448089dd2dc5cdd2cf45c5f7e51b1607786ee

SHA512
4144c56f634661ca37ccde11d4df8fa4e5b412f210178b224ae0a63d8b6620fc7c06bd4faf28dc44fe3879fcbad9c4ea59eb393eeffec71a79454d893e1e477f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
2a60200a47386fb4bd04f0cd71372dbc

SHA1
554c8df76faa1b8ea7ec129891ee50de8f710944

SHA256
7ceb2bc25b95b45242b5a09f8372e52f9e4f9877f5916e46c9daaf690eab0a31

SHA512
870b1d242f83bf056e603e6debdd3f43fbc29e07f342343331c18d73f6d75b066283ea75af0ba9ab7d2322c1cfd0cf9e5f65952ea0835855aae36038af0d004c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
e3985ba8b9b0485c7f1dfad5ad694ebe

SHA1
215ff2c5976505083096d1a5eeb1582f74ac88bc

SHA256
96bf79a30bdce4c6bd5ac11af4ab42909e085897b80c94f1ddb95141de4e4b9a

SHA512
b3d9c21b5bd03f3c4c41c7cd8d59f51e4220a49786995e7609e5932a53c5071cf2cb26668f787b2ca8c64fe021565802c9482ad7ecfcb4778cdab5a591a1f18d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
b09504a85b58675791af3ac1e6cdc361

SHA1
a77487383920c2ca72ba994f0c7ff6179b101ffd

SHA256
6a200bbe84428226aeb24f56dbc3c5004102cc30dcc117aa66b4c5bbe936a9dd

SHA512
962817518e4a3b0c1d2aebaaa862bb30fd8ba6db16dc99ef347e5cc1f421d5b5be13dac00e5a2bc97b549699eabf6f8bd7acf74af3e2814c7990e2fc9c53f1ac

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
962d909d8fa479428e90b831fd192ef5

SHA1
f9dd5dc8860fd462ef46feca17aa02c0c923dc59

SHA256
a7641f64f5497cc1a4859ea81396a49c8056db5662e5475b0151c68619e20fea

SHA512
e688dae1f1614c5be7c105447255a7a15a79d10c2fc1d51b5c887d05fd16b618b455778e7e30a57014a507b38ab93d6329d7a78fca56e21c20989972a0526229

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
4754113a3c3ed98f2a8b249d320902e5

SHA1
72f600aea7f5b37a0d6a43a19274eb9559079a55

SHA256
75d81f1362d36857653d1790a0eeb52cbfb5d4cc4df02474f9b42f31ffa57f3b

SHA512
018d8f80ce33e8839ce8aa354a4b5fc4a5e85d2951a01d0ab32f8cff41bc6f2b599b59721fe68439bddaead30b451841203f260b31e6e29354c1821e0aedf1f2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
246cb2082823331a44fabd661fd7e9ff

SHA1
c09679172a3bc69788b3aba27c38cfe86b2196c1

SHA256
102d206eb2f629f10d2782e2914328475a26d168861afe314a3ee1e60d4de5f5

SHA512
2216cd2624752a537c20565aa2c042bb26d65d58ce1c5359e0494a80ca0d91f702e3981277d4faafcfc495e241db5c66b84f2c338ffcff3741dde292736d22c2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
aded5381d800bbc73bdcbb9c5134eb0c

SHA1
e18e30fa633c682012333936fd34ec6b322b365d

SHA256
2f2f40a1bcc390ef62f33bb731d9c23005425a66c013561193219108ae61b2aa

SHA512
ebf632e597de4ab806981eec8fa1b08c045a650335098770f92aaba8dabc76f5f438f66c10279dc45d35af7f877b5b64b022c68d44b09a398afb6ae4b9fe7724

Download Submit
memory/2548-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-8724-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2548-9119-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads