xorist | 77d283825a49906c009a0c5c44e06269ce354eaadbb5ebb494c4cfcf6991b8ec

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
26-11-2024 07:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Size

7KB
MD5

a0bd49531cc1790304dfd9c31e600526
SHA1

639ef6771f5f3fe0bb9006bc5d0a6a91e79950a5
SHA256

77d283825a49906c009a0c5c44e06269ce354eaadbb5ebb494c4cfcf6991b8ec
SHA512

da2da3237f7387329b28cdfddaf0addbecab6d33104ddb2fa426934719dbe027ddc29c1594086d1f650156469d72a1f0f7daa8bb13d7f61ac7489763deed1d17
SSDEEP

192:Rzdrr1FG1WDCgmjPZp7minw5DH/2eK2bDUA:Rprr1gkDCgSKCAeHSDB

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 5 IoCs

resource	yara_rule
behavioral1/memory/2792-7604-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2792-7602-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2792-9165-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2792-9166-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2792-9167-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2198) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cn19Iu7q0HAWKeS.exe"	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\wsdscdrv.inf_amd64_neutral_47406488f9e8d5b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\62AXOPQ5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00f.inf_amd64_neutral_a5f6001b957bd7e0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr005.inf_amd64_neutral_e14a0514f37611d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Automatic_Variables.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_scripts.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_FAQ.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pt-BR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnod002.inf_amd64_neutral_a10c656b6c7c053c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Arithmetic_Operators.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnkm005.inf_amd64_neutral_c03c9e328608873e\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky005.inf_amd64_neutral_8836be987024e6a9\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx002.inf_amd64_neutral_12563574abbc36eb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_troubleshooting.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl005.inf_amd64_neutral_8b56291bfd2a4061\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netl260a.inf_amd64_neutral_085226e1dfe76c55\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Windows_PowerShell_ISE.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky307.inf_amd64_ja-jp_e40bd14f18e8ff7d\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_advanced_parameters.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\TroubleshootingPack\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0013\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsOutlookExpress.bmp	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\AdvancedInstallers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_providers.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-ADFS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Windows_PowerShell_2.0.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\kscaptur.inf_amd64_neutral_6cb3fb6811a3f83d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmtkr.inf_amd64_neutral_8e3809aa77440c37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Break.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hpoa1so.inf_amd64_neutral_4f1a3f1015001339\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0816\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\FZG8CKJ5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnok302.inf_amd64_ja-jp_708c81a8b0ad8846\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\erofflps.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_If.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Continue.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\cxraptor_philipstuv1236d_ibv64.inf_amd64_neutral_b6a3e57df5bad299\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnsv002.inf_amd64_neutral_6ca80563d6148ee5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_neutral_c48d421ad2c1e3e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Throw.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averfx2swtv_x64.inf_amd64_neutral_24a71cdaabc7f783\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-NDIS\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_locations.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Path_Syntax.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\multiprt.inf_amd64_neutral_988a34fc912eab54\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Session_Configurations.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\qd3x64.inf_amd64_neutral_e8903726d63a3f07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Switch.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep003.inf_amd64_neutral_92ed2d842e0dd4ea\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttd6.inf_amd64_neutral_ce587aa61510da51\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2792-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2792-7604-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2792-7602-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2792-9165-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2792-9166-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2792-9167-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\highlight.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref_PAL.wmv	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01253_.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Checkers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\weather.html	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099192.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\BUTTON.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_over.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01265U.BMP	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericon.jpg	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_thunderstorm.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR37F.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CLICK.WAV	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square_settings.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\settings.html	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ca@valencia\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00176_.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\PUSH.WAV	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierBackgroundRTL.jpg	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_up_BIDI.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_MCELogo_mouseout.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_zh_4.4.0.v20140623020002\eclipse_update_120.jpg	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Etc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\PREVIEW.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14710_.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_OFF.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\WHOOSH.WAV	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\flyoutBack.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)greenStateIcon.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\gd\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Back-48.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EVRGREEN\THMBNAIL.PNG	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\CAN.WAV	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightOrange\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02039_.GIF	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedback.gif	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\triangle.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\RSSFeeds.html	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.ApplicationId.Framework.Resources\6.1.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..lesystemsupport-mof_31bf3856ad364e35_6.1.7600.16385_none_ef35920285c7f09b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..tional-codepage-866_31bf3856ad364e35_6.1.7600.16385_none_2adda600b4e25a37\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msconfig-exe.resources_31bf3856ad364e35_6.1.7600.16385_es-es_d3e0cbab6c604e12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mssign32-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_14dcc6c966568f9e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-dssec.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5913064a54494ed7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-scanprofiles.resources_31bf3856ad364e35_6.1.7600.16385_en-us_042ff2d9a17712a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.Services.Design\3.5.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..nce-tools.resources_31bf3856ad364e35_6.1.7601.17514_es-es_77ee57238098ff0a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-diskpart.resources_31bf3856ad364e35_6.1.7600.16385_de-de_839bb6f0689a2fc1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_eee4e052cd1adbab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-security-identitystore_31bf3856ad364e35_6.1.7600.16385_none_a80db2b3efe7af3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..-migregdb.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ef58ba82404e9bb9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Data.resources\2.0.0.0_ja_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_functions_cmdletbindingattribute.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-g..n-admtmpl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_657d9a203abeb154\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_WS-Management_Cmdlets.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-wow64_31bf3856ad364e35_6.1.7600.16385_none_ce6f64032560fa6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-dims-autoenroll_31bf3856ad364e35_6.1.7600.16385_none_f3e60ce29c29c7d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-msidntld.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e604b7bd8dbd1d86\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-tpm-driver-wmi_31bf3856ad364e35_6.1.7600.16385_none_cb820007d9f4cd19\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmpnssui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c7ae34ca97276b98\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_nfrd960.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4b5b2024613eadff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_da-dk_dffc8dc2836de4f0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\inf\MSDTC Bridge 3.0.0.0\0410\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_hidir.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ebbc86b85daa0055\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-hgroup.resources_31bf3856ad364e35_6.1.7600.16385_it-it_e20f1983517f4ba4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_requires.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..on-hkmsvc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b06ea24505da44de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..tyle-resizingpanels_31bf3856ad364e35_6.1.7600.16385_none_bc51073aee3391ed\Panel_Mask.wmv	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..oxgames-minesweeper_31bf3856ad364e35_6.1.7600.16385_none_fe560f0352e04f48\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnkm002.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_87a3257675275e4f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_aspnet_regbrowsers.resources_b03f5f7f11d50a3a_6.1.7600.16385_ja-jp_bff7ecd2569a521e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..lter-mime.resources_31bf3856ad364e35_7.0.7600.16385_en-us_301e95e856d36927\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.DirectorySer#\45ec12795950a7d54691591c615a9e3c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\Resources\Themes\Aero\Shell\NormalColor\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-winsockautodialstub_31bf3856ad364e35_8.0.7600.16385_none_66da0a24ee7d5fb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-terminalmanager_31bf3856ad364e35_6.1.7601.17514_none_524e7eb2b99a5a7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8f94aa63624b0ac8\erofflps.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_functions.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-js-debuggeride_31bf3856ad364e35_11.2.9600.16428_none_c130aee65b6597df\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Entity.Design.resources\3.5.0.0_es_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\1031\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-chkdsk.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3ec8c132f27998a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-font-truetype-miriam_31bf3856ad364e35_6.1.7600.16385_none_7b7a9e11df9f30a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-escalate.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ad6cea24cba1a390\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..calmediadisc-styles_31bf3856ad364e35_6.1.7600.16385_none_dac1eab162daeb45\Heart_VideoInset.png	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost.Resources\1.0.0.0_fr_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\header.bmp	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_pssessions.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.perfmon.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8ed5f2e5091b93e5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_en-us_fe8f8ca0a21cfbfe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_bbbc7ff70aa969f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.powershell.editor.resources_31bf3856ad364e35_6.1.7600.16385_it-it_01d84625dd09a6c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-shacct_31bf3856ad364e35_6.1.7601.17514_none_c8099d957fb7652d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-lcphrase-tbl_31bf3856ad364e35_6.1.7600.16385_none_308365e956246926\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_requires.help.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..solitaire.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6dd28d3249711b8d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_es-es_0ac4ebfc358e5ec0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wpd-status.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_06efd698ce3b5af1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.applicati..framework.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_5cfb83f6172c9e8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-devicecenter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_428520bbe4515f36\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..itycenter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5c4d282deb61e3b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cn19Iu7q0HAWKeS.exe"	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "DTVXXHPLQXPALXE"	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE\ = "CRYPTED!"	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE\DefaultIcon	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Cn19Iu7q0HAWKeS.exe,0"	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE\shell	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE\shell\open\command	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DTVXXHPLQXPALXE\shell\open	a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a0bd49531cc1790304dfd9c31e600526_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
282B

MD5
9ae5a4d98f14ecc3d4af1e399fecccad

SHA1
53b1bd82653b4629df5fd2f32be7f943b34cf88b

SHA256
63eff9791c0310c54161063369b1181c9d5e2819bebab5d84b9d98c040ed14ba

SHA512
aedc3c27dab633455e76bcf499e99e23a0f8743e72b77396147ea050360796a474acd637befd48f5e28de74c5657c5d3bb376b1f7c16dfdac2b58fe529da64b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
49886baa2466bececbcf43aa691c28bb

SHA1
46d26155de382944ffb112daf80ae0e4f6b33dc3

SHA256
95b092819ed597063145b7f9e0e034ef3482ff64544114524a5ce5329ad9cd15

SHA512
e2f67ad2cdbbd42b59453e7ec40cf5332da13eba9f2b782306461ad8f1ffee0cf20c99841b4dd0dbc0f34ff269f9eadbd43f2514145fc09a77e056fb8e481396

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
27455a93ac59cf75fabf3084f5f08841

SHA1
6ffb558bf16f5e84d3fa9a6968ba9bd812710b0d

SHA256
f8e9943807413de962281ed5d0a3e695a60ace065d95055a22f555b95efa8dd1

SHA512
2bbdf367758de414b30cdd1d07a4d5d804f1405ac2b9e6863c90d3305203aa99a9dd1e2fe0909550d2c6c8bd1c0d7ad9117b87ddd48e048063459aac9ad18cf1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
195c4c9c6cfa8a356bf5ea3b910a94d5

SHA1
8433c4b763b5fee1dce2cf3154323e595bded201

SHA256
c5b87c0119cb39b0d9fe1b323692abf5f5e2bb69fa20d73c4c8b68a08563f263

SHA512
bcff96b299b7c8eccf008181a2308bb4b5f34d8449a4705f078e55089fb73d456a1bf957c29414c159815c78ac8a6219fac16edd255bd764dfa7c8c02ab84fa4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
47a2fd6d105eef8383602e23d99f7ab7

SHA1
8d68bf8a227e31f00d133fdc09ce69d6c5649b3f

SHA256
d6903ad83a3ec5c2414c76bdabaa59444ecf9b4b7eb436fbb98b863a4648846c

SHA512
e2b2d5692062a7eb01e1465c232a1233261c16902201910d80d45b24df3a911c29f3e3998b09e3e542c284c054555aa5ee2c63f0fc9ad586753709d73769de8e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
2c726b34e12a7e2dcb8cd2fa5daea2ae

SHA1
e280884e5f1d75654877114cb1dd2eba01e8085b

SHA256
3a01b92ee973959b18cb7278170b9b57606c80fb4ff88928ff69ab5ae16e6df0

SHA512
839698e4dc2b831588be651854a6f2075e57c134e04e3182c7d9d7c8dfbfef141824252fde7a8fb6cea7bfa7f12d43dac301c05e44028ed8bc085b0b9a89739d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
15707c6de2ea91de44a9d53e92cf13c6

SHA1
daf1f5d8148a15f9b74ae634921b5cefc208b02b

SHA256
2a990819ca8cf8c3ae509bc103724864363bb63584e64fc75416d9c94a33a824

SHA512
c00a1221419c602e3b794647009b5e223a1fede2752bf91acd61f3e142a08cdf3b5b6f75681fd20f552a97e86f3f57ddb7536a35392bf45053cee51e0a18171b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
6922b29fd57cbdea09cc1087bac6d9ec

SHA1
bf01a8cb2fbed3d1fb21b1cd1efbd8d52df57eb2

SHA256
ca60f97f071ca5d37606901de84022b7ece46c2e5408ed6c4709307ae82120e0

SHA512
b897e2e8da15fe2f5cae4f0f0d1224a3aed6af6751b7c9f563c6ca90fe1481d94817b33e302c8c34aebaa2f83af1611983d5098f5684b4f1a7bd17d83862d188

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
dfcff984231706bd57c2807d305967e5

SHA1
2b4e9f3d623e8b5fb73c51a819415a2676cd72ba

SHA256
1108ca2506a221ec967a370ecc3755818d94d86415d131eff45ea8ba5d044141

SHA512
35842538b77c9827cb4a17c12bfb2eed4a8096ddca0e07156243d2edc1bdc8f96311304e442c567a0a633ab00d9944972eb3446dde2e3c870805275449daf9b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
852387bda0d05d6f14a928832bce55fa

SHA1
7f9a0a5ac05d1a01378eb42c42edd0cb63552f39

SHA256
f5c02c5286d68a304af1c08da9db629bdeb955414a558c30c4aae5c00d757939

SHA512
9b4a59bda550dc5dab53bb27f5b56dff9a8fef8b3e70acc6d6d84f40fe9a7609207dfd24824526bbd5496eb7c35be561b2f622e9bee36d9b128a8e4cdd11d9e7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
10cc2319872f9829d1bdb8b57e7cc037

SHA1
d1c771f4879de541aafaad2a80909bebfebc1b59

SHA256
ad2eb9729242498475c2227d2a93fe51c27b22feec916046cfc0240081f9ae6f

SHA512
4065464a0f2b9975f882df46133830c7dc12cce0dc85dce52a1f475e7bb26cb84f33d82c3b9b07df1689dbefc1055fb9d354e4ec4a93025593e94124f401fc32

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
b8af003fe8ada75fdfee5e0b26c84f37

SHA1
d4c4ccdaf9d764f34ea4b09437422129f7db3d97

SHA256
1034e03af94dcacd084f537484d83fc2b864e7d13217f8fae3cebb2b5abb7301

SHA512
87e1575c26a4e4d8ccdaf7970ba8716d35250dd52683f5f377edad638f2c59d642c3f1e078548cda9389479e76dc90b743c7aa24eafa6f4d3ce8d6904c56b223

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
73b5cf7df5018876cbe4d166659a261f

SHA1
caea280caac342f146c17e683930281a033d8057

SHA256
c70c24dab3efbdf5e1bbed209fba02d1e1302eda400ff9b955552311410ce190

SHA512
7cb9fb3713ce19dbaeca0dd891347aead8a5d1a849a6084db1c4200a11b64dce7d5323b52f1c4b37ca5dd73ed81e4be76a58248eb39acbfe7ed6ae295c9f018d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
6d2b9d3604ab9c47f830bbff251bf957

SHA1
a069633540651d6baeaa4c436e26d78b648e5148

SHA256
21551b49855d1a67af44b8859703ad50526562c21fbedf084d23f8705b94733b

SHA512
1c37c9da87b53bdbd5a1b55816b8bbb0ae025b77df3faf787560a0002994ddf1265299647c4e316c98a5fe4e3725e063b1900282f857174bc657153c4758f520

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
70a2a73446ec652ba8003000770b7e2b

SHA1
95d55c0324d67cd8ce4f3e20a1d913ac1d096161

SHA256
89fed6e9b7cbafe1d3f7eada8e31a05c973bfd5242c634475ed3f33c8500aeb1

SHA512
f41223ed19ceb4a0f3d5e2ffc4963bbf7ed57cd2f90325e279b15646f44366aae497b7bc27bf525df722159c1c3d4b9f1da19779061ae56f1dbba51cc6fd4b33

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
c3fbf8c3afe9f7559fbb73491cbee326

SHA1
a25c912c4e734173ff9b5c0d96ad0b563b3362eb

SHA256
6cb946398cdc33163761493d191e073d14061113989e2fcabdd47905d4ae79d0

SHA512
9f4eb313abaf222796e3b5c70f51ec745996a1219b87373d1c39d015b7b77448fca0e2b97cba09dadaa261fc0ab8245f058777dec94a7ed187e74a4bf7792944

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
8de8caa833b0fcb11a0b98c78f19b277

SHA1
8014bc629622854fdfd0e5f129a644550e5fd01a

SHA256
1b9ed1d96df4df9942fee76550802bc53a280ed32e1147be800a754c4a985a3a

SHA512
8ccea4179e3b6b6325173913bbf2f6f115699e7b40bddc18537dd039c97e916cba19e3a6842d94256603c33970591bbbc9a4c84c04a36a1d795476df26281db2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
0ca728d05069134249ce79aaa05440ac

SHA1
a4f5cfdec001440d7f70b84dbc9efa8c0ce3a402

SHA256
840fd2c51a9f8aab59f0a2fc8c32a725aa568f3d73c3502f5ac88ea7eee82340

SHA512
942565f1c9aec9026135c2ff591e26aa2e7451da2dd329b59155d6bdc44c4e4f5088329ed4727bf4e800de8fa711b879aec8998e4b03a9c71da17d19e2c20343

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
41dad30ad8fa26c9a7b6313d787bcfa9

SHA1
23b710a59a0621d2baafcb977f6c0cd4b091c1cf

SHA256
6e2f5fbaae5522726033281e523a13b31f3d15e0ec526f10272e8fb6f44e09ec

SHA512
02ab226580363acd4528579a4eb6aacfaae329b6fbe5e45fed40118f46a4a4df515f3dddfe5c20d8e1a426a17cb0851970af583c404c049282d097061902ea48

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
b52bbb354580712c335ec2d9a22fe7fd

SHA1
c80a486e2ff8c7315564d628d52ec68f6f3b35fc

SHA256
f6093672dc2f025f3a4e3a75e8edb929b23f6b49044d0a627f714dceafae83fb

SHA512
aa04443de2ac0ce97ab85811666fe173853a79d762be3c333cec4e29b3c02ebefb4908f5dbaa7626f833f7aeead71092ad92708ff7a85618e239911ba440eb61

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
ab1595eb36596ec2e17aa6f90bfbd64f

SHA1
1b2b29729820c1e2339cce555ea109c844544826

SHA256
819514fb3daff74bea4e9469d363f91f238a4842db8f0cd37d029d381bc3c8bb

SHA512
08cf49fe0ca1d5c77a753bfdab4b9ad806adfbc57c63ed764f08f4aae3e24b53b58600cf0a4157482623a79d7e1e010618a022057c835f27ac72a3a6fe77fb14

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
99052a33d268eeed4dd8dceb2085d54b

SHA1
51ff85d8a53519cf107debd78be3883c53055924

SHA256
097d8abbec7cda4c0932a5966c75ccdb5a42bb445c91a6fff7e4e92161f96512

SHA512
3e8513d015bf2534f426252333e3616e9529970edf1e3adf186bb6fb5dbe46537b5cbefdb6db7da7e9c40372e75a88f081c487ea580f14d972f73582669a7679

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
a8eb210e984e2dc1e11126e34e2d9f40

SHA1
d8421cfddd75b16eab67c95c4afa2061b3f43060

SHA256
80f08f2566bf7f1ac92e107d943bfa1ba9f051f64d77a512928332536b77e6da

SHA512
8a8fdb4815266b17555a15522f0186b4a1771d8d45d4e302d6830e00292e37b992c376543d782a63cd381b9618eb708504760383bd6ea676c25d36c9521b3ad8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
efaa9d66ed2ccbfc85f6da65e7665a76

SHA1
bd236e90b55879f63eec69067fb9b1013b3d6f76

SHA256
56084fad85d54d1447e897290093d6a55d89c0bdfb1113515c13b1cf65ba6cb0

SHA512
ec0f586bf5213eea2b334e4cba74ba8e9da04ccf3106e76b5f8c08250ae5712f0f1fec74f01ee1cbb3bdcb5e51c5f6ee4131858b77713e98ae4503f29aaedb91

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
6b893946706ebf25b4bc0bc8e55a7c6c

SHA1
8ef3d20fa4607bef25830044863cb1e9a38d36b0

SHA256
8cd32d4b84bacf0df7910eca2ec69f4327468537dd602de7919ee3176c711012

SHA512
a04c8acc87de6688465dde4004fd7ea864cb9b11973e62c77ab5639aa6fe3e254470dea2d44327ec1b1ca36eda58165f7325e3e051e9896fefcb2a5256d0fd45

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
d57599d32043d81a2165e96b45591b73

SHA1
f3da1795638241a039691e36dfa2c5fbbc6216b7

SHA256
8723a75a4ca048402b2cbcc70adf9c96f49c9b16bf8fe4aafa9dc31a08288995

SHA512
d67d3e8557893f9fd3ccdd26c5bc2ac2d593f810c9dfc2e6e087ba47d48c3fa550970ff96d1e93691800131973da4961161ce04191d1960fb1ba05157ebcdc2f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
6a80af6724437f9e0d726839f1c8fe77

SHA1
142a9613bd3d37eb877d0b8aba587a1a60e3e494

SHA256
28636e2ec9648e222dcdc7d08641dd2d02ea4cb236b410d3483863e1feb6b5d4

SHA512
8e7efbaf7577004a3c509ff010d5d1d1bf1326af6ef23d5181724f6155acb1cafcbe9def5ea03d9d1b01be41b20075b26fb1d7a07830f0eaf1375b8a551ef90c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
0e0d18e2c0980e39ef7072a7cd45623b

SHA1
9ea1459423129d791fba8d709fce644bdff07370

SHA256
6bc29fff225d519cfea7c77292e62cdbf79820bd3a097eac4c16d01b7549eac0

SHA512
c061099298985113a182e5deb8d37b21995c100167913dd1900a4fb6231371576ea54d4dc11413ff3d5eed61cfc194344d38a56da9d59b7447ce3c2841870bec

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
6434a4275ae1f73f0d8f5c742c1481ac

SHA1
41f378b86f21813eec89acec6d5eac12d7dc63dc

SHA256
5896b426bcfeb0f9e8fc1dec2894b387b20ba46dc6b6abee30a7c276e9740028

SHA512
650d136277d92154857d6c538c07c0f7dc3075c37efe1096db13d455ea673232d31a86ed7d0206842d816442f4069a0033b8e2c1c68bae3a4eb0724a1ab6d2cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
7717f6933fb7e9ed9112a7be0a32095f

SHA1
eb46321a63a548c6753b9dd6ba2a60667494d943

SHA256
baee4a1dbad06833aaa02275bf3201aad70a4603cec867f8db7fe9129bd912ed

SHA512
f32808684af2934cd690628aeb3b649b79d9062de29bfa2f4f7b83ee7997e1f8e1f53e9a0fb604f2036cff59e50185906115d82442e7564479b9edb904c353a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
f02a17b5123bbcefbf4bc586185ec8c9

SHA1
f509b3d463fc9fbaee8a8e53526fadadc02e6618

SHA256
5cb9bbadc9aa970597c416779033d9baabc381e42a69d3b707bf1660d26321e2

SHA512
cace019fc6c97addbe19f874bb824bc16f218ac692c39d17df0c7d0ee69f98f19feab6593b8400f9c1aa6340fd6a96fd14226dcdbec56f0672c5768222997924

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
a4d1b165b568597aea05a62d3b0e96ad

SHA1
2f9131a2f3f450726f4d1b4c35c1a819fa8fee17

SHA256
8fc05ed273eaaec15867f33c6c02ba29d87deca8df20c759befc4564016a06d0

SHA512
efe299ddf5e93ae7674034f7e00e1ee47e5336022713dec8d9cab71808e806297eaebc267fc594ff90ae4df76e582426bbd309b22fb2f0aeb9af1d2237b51c05

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
2cff1106994db3533bedd4a373c758d3

SHA1
f27ae7d53c293ea4a7b76893ab00c0c40abaf68c

SHA256
8265bc1b75873ad6ceb959bc3fa5668e55c8d21b6c142fe97e6ed0eb312b1c07

SHA512
30170d3e63678fefcc383ce5e4cdfc7e2fbffb691f3c1fa6439f6a27d4f6e8615344e6946d9acfb6d4d2e48ca023054c836c62b4a873bb290769160cfb0fcc3a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
d14b43dbb9ea0130a4c5cb7dfe248b0b

SHA1
b197554d8336270d7c4f762e100f1bf2ca746054

SHA256
5c8b509eb280113991dbd762bc175990697fd5206ce8b0a82bd6e2902a05b555

SHA512
2be4a6b8502990e91198bd0931a227e9f011995831de206c76ddf9ee388c2e46685e13aa528832e8eb747b66cb0b3b54a8eb974e711c64b5d7f5a53ac8958040

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
6bf53608001519201948cc59ff4cd7d1

SHA1
135ab3002ee1a57a65806fa55b2125202ce1a2e3

SHA256
e942dcc576ddf4408a5f748f1f29808048c717e1b1f1901a76b3e856a561a199

SHA512
e4980e56ff8046faff13fe2797a7465b7b797c4b86d2b23ac8b1ca902a0f6029d8cf865bf5436de1033f0eaf5b4c86f9e456d96b84165a44f6bc181070ca7e70

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
01be9fe27df916525eba21f1a3a095cf

SHA1
c3203937e4473fe384d7249ec1639258b89a97ce

SHA256
e43a27c6a05bcb09596a860c51864aab872be78d3847a177d36bea0364d7bf2a

SHA512
c89c68fd9fa7de7648023acc4adca4a9feb3e64b0708f2e78f66db3ee719fb4d103b33688870dce9735f220272cea263dbf175d4ac16d4ca6008da9252992d64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
65da5a027ca06ba6728a4f2e3f0a964c

SHA1
1ba17ac53ae9253ebf9ffd9d42b67e504532daa3

SHA256
e6285070d50f6b57f9ff5e3fabeb293ec45e608f1fe38330eae584a979f638f0

SHA512
3a362f902eaa014bce8bde71835590dbbe7f44d7928431a0c18a3817677d80f7669701ebd8abd9d0b894fda1ecc1a4b6c2d3038a2be621e09473ec43ca1dd6eb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
0bc7c632f6fef0a083c1f6770b53b81e

SHA1
4d8c839fdf109a41c612315652c7582ffb932dc5

SHA256
e02bffc48dad44162d301549b5ea32639da0d1ecf8c6c251bcf8d00a5d23a1e2

SHA512
0d21959269bad4f182bd6de7c57ff5b2353b69ba21bd030723a3a90b7552a7d8564eba6f9bc38c063cae7284cb3e92cc3cf586201aa971d85a11d96177183963

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
2e8b68a97f44843d97dc4ff9749d0977

SHA1
45bbf279120efafd5957c385fdb579827e3beee0

SHA256
80351a4eba298f00e36cfc9acd2b1646a4a4b46884f736b589a6a350186a5381

SHA512
740c6d00f30601c91f2965f5a547ea664d286a3204fa76d3409c978dd97cff4afba239457d0839837da0f9568f2428627a17e9e1a132de40d6c3b502bcd72c9b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
8046807230ce5edf4118b079ccd98e87

SHA1
944fbb3aef9eb2616a934d5386afed36b9d8a75b

SHA256
094b077075a81d829c32e98e32ade9bcf89e3e0500f252e75ad6350d0ca2bf35

SHA512
1a02103fa8775251672e8544bb5ed455e2f5c629d1038e4deaaf6cfa5d067f864d5273975bc0e100ed25709fdcf0f13c17ed0eaf0490f4b4d1fd27096a175336

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
77631dfb480c5e03cc5462ec7e0dd8e3

SHA1
14c571c1d547578f6565ccf3c4588285abb1636f

SHA256
528f5c7aee3402003586862b0eb811ed766841755e01207a7b2d614f22ffd5c0

SHA512
c5b7baece863d228e74f42b49974ed2a8487304035a0f1cf49b79b514e85d4968bc5e68f39a9f6178fbee73ed8e596eccecd576a2241ae61c9bebdc3ece15134

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
71035786b87c39243d38265067b295c2

SHA1
97526186e161ef0f8c8fbfab8f2b831398031a16

SHA256
98362a6e0169897b3c01d1d43aea1586dd5232d1b4c846ee410bbcd1da669715

SHA512
11add1941ad9b35f0cb8a994e6968e1364340132af15b4b89716cb453f21eab86f17a6d65e1602631d7afe44825e4b6bc1693c1d1be84f9c098dfd124d2b6bb4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
254dee046fac88c9425633463ecddb4b

SHA1
39c7116c33d08ce5f02e65dccdba60593350f810

SHA256
8f16b94d35c3a2139221d6a4b22bb03c57fe2944b0f73e95575d07180934cfa0

SHA512
830ab00ad16435df731ef652b25d1dd7675b0f0bf972e6e581c4f64600f1e679e48f4fca6e1b815158a09d0e004096514c2b2e6f53959194397bf9dac674699c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
a4dbe0d1489fd21c3efe9c4820ea7e6c

SHA1
474f5d1e3205b64ca072fcc7f920abef3a7e4dd7

SHA256
4f9714ca745ca614e4abe0fe8bc5fd8b47aee825d1feafc0b1ae4453e3d5388d

SHA512
fbebe6ab10095508aeaf36768c63f708eab140638ae12868aaa2fa3ab3b122e0e6f5443cfd0ee10df1304bd00f694eed453387dfefcb6f61d197f87d2f068006

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
e11d39724de4a7cbf62237f65f3942c6

SHA1
90ec223c55353113006107e45bdc38abd4a55849

SHA256
5a0a27b5df958544b0bea29aeea5c1f1e06b97bf40220205ce129a1214b56657

SHA512
9f387b15ac0d60e76dae80758da290ac626fb55af5d92b2434273e64015736f2edcae848d64dd350cd59e91eec2a9cb07e7b1c87d38130d40bd25e677750520d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
cf4dada716b4ef09886fa1b65036c2b7

SHA1
d8461fcf337cbbf41d7a2a7119f6821d2c67dcd7

SHA256
d55e5b2df5280bb43b25d2d656b1bdc5fa2fa0e008671f90c0d8ad876200f268

SHA512
e28b20e8c569d17cb0d33864935712a5ae37d5158d23fd396d431893f6f0f281391f1a965e6fb824260a9fef2e7defc3a8f0608f7dac77e12159bf83dc6ba6e2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
d81625a7f618ad64524b5b5034b95ad9

SHA1
eb572a5ac833f0c28e2eb7ebc3cd2bd9d80250c9

SHA256
a4e65387468c63270c7c80c722d27a2f2f0f03391f35433ebd6608db985ff859

SHA512
b231762117081d0451de36ec59af6cb61191b68d4d4061a6d6b9222e59067e35b2afafb32bfb23413046b0a68293b980bf7520e26059543f9a1878be04fe70b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
eca816490689f0566dff0b4715c5ebe9

SHA1
4e399c0a02dae975b8ba3425c724e9a04d3e2009

SHA256
a51a7164d4b897500f40de28bffdd7e7a402af387c2714d99fd193ae89ef35b7

SHA512
a3a4bd4099cfcaff6155301ec16ce1ee0675b9a530159f5946ea7c4b48ad18f7063dca6e9f7b9604dc2217220c4de2cfedc7ec98c1e3445a48242ed3a1f041d8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
d5948b48d35e79dcad113b46bd4e1907

SHA1
e01e527c705caed49cb429b38da1e3147e1b3943

SHA256
b80b9776603b02a73587bf19182edc313599d3af34c2e3ed7bcf522db5025e2a

SHA512
3ac70bafefcb7e9905e6159356384f3a01ce35952da9e9a545de68bba93a9e36eedf7732bd88fdaed0565d044e4706d2aed227ab58e2e969d76323a1f91d0501

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
95a83fc9d97ab428bdd827452035d5ab

SHA1
c87d6c11d50ec69237238b5ce782e1f6e122e781

SHA256
2497b323720e03ff6d4530a6f6263032a4bfa3f501897ef1ffe2ba0857dd9bb3

SHA512
a19e51e107385014033609ce9238c6581ee4ced08f785fc35abea22b62df0af0a28f6c79fd37763f694eb4ea093db9d25cb15dbab3cdbb66d73848fd7a1ec8c0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
8faae15dc2ccaa102fe578c5135f03b7

SHA1
5b945b406760434cde67e1b0e690e031cc61cede

SHA256
39f7f9a1e4c5deff6fcd94c873309034f14d5c378714d777c0269b93d0073890

SHA512
274a1ad813ad927c871b5d61532d6410c5e58e4eaaa16f6573f76926e5d3ceebb9c6b487284265effe3a7734a0a5fc24d2d7e0a5a645e92fa862deddcce61283

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
4b628ac6484de0931dd5153adf1ad393

SHA1
3bca62d2b2d902cbd9ac0fcec244b93f2b8176b3

SHA256
c92229f4b462a02a434375bb680a3abf6d8b9532cdb54b55a77f0a0cf0572b77

SHA512
e4d8964a1294c32ecc43e5ada82cf04f01cb3d37f8493f4e66df18fc6ef1ec5d9874e976e91018475892b01187cc47a915dcdc609f68210c954eb919bdbf1be7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
f3e83b644942d5183647e9d1bb84ca9a

SHA1
07c6d63d6f934d8c8e8b6e58bb7e3e728ff0a4d3

SHA256
09ebd01057b1f35c3cc83ae4454145cdaaceaff0b05d1fde8e154c76532c9312

SHA512
b2778cd8efdbaf5600567b8b58e87742fa28d19720eb89f58025b3a1f2f064ee2fa1496ddf47cff57434825fa8f3613117beb488c371d0f614a010dce3b640bf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
640e2cc5dc88f4dbb91047847ceb9982

SHA1
0100382d95d3dd517e9b2f81c9fbc97c61d623c7

SHA256
40252b81d6b0406b7707895185c3fae6d8e9e53d5a2ddcca97148f3165070156

SHA512
414eefba47ce9afb53eafa2795b4a3df7b2240b5c606a97dc38deb1dd404d67c3214c323db6064d1de1ec27d86cd73cfb949fe9f4a678843a833f997c59c7a14

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
d37ef62b938e065bbf3000e460ee53e8

SHA1
9cf42edb95e2628a0675119db5dd930887158d73

SHA256
59ddaa9463c624b3a98356aff8095760c4420b10f81ffe09ee1243fbf37dc26d

SHA512
b58be07ef27419987469711bd6e81a97c8fadd6439e3e576d3ece26b35e81221edf606af1aca7061ba0ebff298ac181d3d001fea69d01c9876318aec02437ccd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
6682c1d9896c4d316252c1cf3a8ed639

SHA1
38f5e6fcc81e7d1707faed212a5b76ee89e82d0e

SHA256
0ef7983e3329969495f7377b3cb97a40c41354d9a57adeee1debd4af251e6f34

SHA512
9e1c7c56d3436218bb2b16b1bb3b1a32a8adf2a3291a372526c47e3401dd85e6edea90df0ec120fc51d16a0526f28ff4ee33aa3cb9b816cb4017b49bb044dbed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
06c1d9ca37e2daf272203ac26bc805f9

SHA1
e1c659fdd44f206909e65ff62aa3fa3030ac6622

SHA256
683aa04afb5aa0246ba9ba30dbd51234a1e9b0623922ebb2fe3b692a37ae4527

SHA512
f314d220a848086d36bd16e99d98b0ee9f40457de43c5f7c6d0cf23180ce823fabcb2ec8a807ce5ad7e85c444102f67d72a78c022cdf93be77d6f5d938b9aed2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
f625ab7132f0d920949c7f34a50c6430

SHA1
958715c9098e757f588d24719ff3b1a25e896320

SHA256
28ee6b6a43a813992dc21367ff07d2a6430f784cd3f0bd444946e5b000b828c0

SHA512
4f0c32d7c3a870dcb81c7294bad5c50564acc273caee191c2b8d33cd00524e6c2fcd9a44668b2b1c8510ca04f1bfa7e4dea4d9583b0a073375cd782dcd67a2a9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
7ca143e9e5f583834dcfa883f8375642

SHA1
a500bec5e940183bcddce86bc402d068b5f1249d

SHA256
a4efc92cb7c7be563e6cb85bb3ee0b3a160710c64e31ee5b6a3db85a99b53031

SHA512
04cdc6740fd56ca234ca4a9271dd4bde60bc3c49facb2149ca1c8351f90d3a4649a407ce7c57f7f0a3fcded1d284f89ba007a6bea23935fa18b6ccef928837bc

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
2338c61b72052360eb3e4ebc352fd09e

SHA1
474d33ab517788b0c1b1916bf93341ba1da40646

SHA256
4f7494881b62530e577fa0cb0fa3e50363b13039aa8850fb1335821f4c1a3c9f

SHA512
d133b6be6e92a4751da47748a9308b905404742b61c729f80fa2555338e8b6732f774bbd024d35d2e2bfc5cb05967b7c5d5ad099fcd7d0d39a2505305fe47a0f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
e2d562b0615c18b7b67212f552f21f23

SHA1
4dd87c9637436ee89ec0d2b1e164b0f973210398

SHA256
d83b801194b853c65c191f51ecd299c9dfddd1e88a8940fd4297f4aea5d935d0

SHA512
9ad03b04f7c1b80c14b5b8f949c762de902bc136b4807865d2685964e8cbc1401c56d7241057cc5f9e27e9307aafc792a881f757e236e76a969b75b3eea263c8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html.EnCiPhErEd

Filesize
8KB

MD5
9d065f191549946c4ca66763153429f1

SHA1
670724c05ffac757bd222ec9e93b528bcf0ba2f5

SHA256
e8ee3afebcfefa729345ec0afa04d848b5ce42e1b128969345c2dfea70d456a7

SHA512
20f2dfa8ab3b72f6daa3399fda3d2e42c32480b37b415cc5570aa8cc79c5dcee97cba3357ad1e3fbec8f115bc74d97e206c35bebe484b6afa380125138d136fa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
07cd51e4a3a553e34be8c1bf2cd064ca

SHA1
9b90a6f292fa534bcba71f132ab19e8bd53b259e

SHA256
55f9bfd6e15b70a80578a6b5bbfa742c71ae67080a46d0976c67d248de8799c2

SHA512
9b756d54bb5c9f191826d09d0e5ebacb3050a36b5810a686b4120f56f0d23cb75628dc22d30b6225364754408a28e05e93c79b23eb0e12ce31c596e42831869c

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
45a0189d502eb032a178f3ac4da9d85b

SHA1
c4ec32a4cdd3fa708dc3041c8080cac9d82eb04b

SHA256
9840dec77de02b023bcde7946cb998eb326606328dab7d797c649265c5802728

SHA512
cd8c2c0358505856bbf6a01a49b86803c2437746c7d02626e69b348c42f4c7b6e74f10795e68f9df2c827c1ed00787ba1a8242c98930e3fc1b368ce7160363eb

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
08d3274613e6c1d9b1164c1ab71573e2

SHA1
91281f3c696c269d81ecc9f9e25f10daf32635ea

SHA256
0c401b79969ad0499e1cb22b84c5f6626e76e2cf4ae7b51dfd3d775d096fea26

SHA512
4d29d8ef2f44ed1bfbeba57efaa15d4f890e689cb2e8725bfc33d6861ec94b00d7f2ee3f29b890a7b75c5358a91b6a84ce1290f01d0717d779871b40022050a3

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
3f2e77b056d6561296e258a46a376efa

SHA1
9e868da9654bf65021691c04bf2057f6d8b8be36

SHA256
a2639910a69c64a0098fef3f87ef6b0aef54ec5a872bd2d8c482b474d6b722f6

SHA512
b9c6d1668a992fb548f68ff38416cb17458c10c18c2f41651b7d64f1a9ad1813e4ef05b350671082a39440185ba9dd581818effba040fe6751ef5cd994e002ca

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
2050614594f9f58f0176f530dc43a11d

SHA1
b7eec33cf1be36bd943e78378291f7af96a05800

SHA256
fc1e6e2f7ff06afa973c9b12ca4f092fa96c4bff992e67b160358be2975099b8

SHA512
672e9333a0f461bf5112bc4440d010ddd599787821eb5b741f1231ab38ad4bb72c813ea37b2b8f9c584ee2e6f85caa8c6f48fa18ae9422d3c9444053d95613f8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
9322449f9fc8543d2a441648df8702d7

SHA1
32561ca615be680f312635d8a1daef374d16347c

SHA256
a466174e7baad23f7e43f4aaeef0add94dcd84021e7e61cfbe53316a70257161

SHA512
65bd0853e8185079dc61825f42870ee1314436f6b00c29ec32472d945da475cee2424d5e0864396a861eb5ca6acd77ec8388c3354e31f5bd52f397fb199f50a0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
69bc66fea4a9351177d6c01c90e8f679

SHA1
4704edecba8b22d061db336409cf33dfe226f67c

SHA256
72b7b280a012ffedbbceb57fc4e44ecaf2cefcf43908411f3db7272eb66720fb

SHA512
ec1273b48b27b62aa33a5d137bdd7ab43c207b46c50e6052e0610b63f06b2b05429c838a4ae64becfe46026f6448b18298eb4f163e9ac6793511cb0c97ca36a5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
b385c5e7142e9524618ebd9db39a876c

SHA1
24dc0c88612e952c262bd9dcac4d2884874b1179

SHA256
726254e944bb7b25c72550ecadf8aa19e33b38dc020bd262414d3a358036e73d

SHA512
d3886c761098d4503defef442f162c471b21a8876b2756c248363db0880d846e16e966359000e100445ad3c6e3a731cbd6f5acf24a36e66235c31e8255287064

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
6ba47755c7e6270ec02735033d4e48cb

SHA1
9e14af2665f79deb9160a046490977764161ab76

SHA256
f898a813f9dea3a972dc18a1ebc787c282e3c58d1951b24995bc3f137613473a

SHA512
f498336d278ae6c2de911cbd27653e446b86f3334ba37dc7304cecda2599db010abb863cd329005b2650557176a0e2a939c98219edd4e2f7fe23af4a9e64e0dd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
d4944bc5d9b67cc7d7fa46b514ead064

SHA1
4d734af8569e5dfac338c912307d7138cefac189

SHA256
bc48fd775bd8fe8281119ef70fb44a68a37b253d56ab8f429bc1a18bb57c5176

SHA512
033bb3495fb1af73e97409179b567babbdc2d40666198d9b9ab7e5df12db2a32e7298016a6c6243599cf5bc91cee8fef557b52c73fa63f8ec35f490f1f2a3bd6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
72a4b75600a685b57a9e4c3541236ce4

SHA1
4f1691b0f641f8c25feb737021cab9479477ed17

SHA256
983c40d0e24ca8a504502bfa449ee8ec9e367b76bfdd9910c56660035be69286

SHA512
ef8a0b144f8bb04bed433b27499d1420f52cdd932860de54524af7637747bf71e3b0d9be61b0715243164125e1cb8b48092a7730a8df6d1f8bd71c1914b44ba4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
e87c9d0b15819e670c376f8ea22d267c

SHA1
d37661b8460ffcc45f7aec5297ddfbfa2dc20bf5

SHA256
d00104440f98c0830f00fbbd829468a761923d256fc865c02ce2515bc7092daf

SHA512
f9bd75e9af18e0ecbe16f7c8cc4b1e8040e774df028353a7f328a4fd6430a94fd2c959e485abd7974fcbab5c0e8f3dba5433fc3e82df0de23ecf44c84b83d465

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
1ebe63484b75b3b84423f7b7d3ac9445

SHA1
c434567ace639ba52c886a9a88224c4aaeb28425

SHA256
928d8647ab626e95700c4ca23ea9820552bcc16fb0471730d4a39f910f6ef55e

SHA512
ec7a15d27420bc973dc1180b8ebe43fe8546f90a1f09ef35c8cf03dbcedee6ea5e975638cdc58279d15f0f0920bd976c0987f57ca15b89fe7a6da1049b6bfeef

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
b73d401ad9b76f3d0647c1ec73e52dce

SHA1
ebe9140ac981b3b637d1c621ccbc7d43416ca8a1

SHA256
25c6be233bb649f96f095aab472e80e54bee0d7f1c9efe962839c5c709a7c841

SHA512
021640d7f03bffdd526a6f8dd8faafb2eaec868e661850c0273555d029b688955d6d4e362cfa4f300326a118500aec42c3a958b949e69b52d4030fbe3b9abbbc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
bdde1e109f712d24a5fc06c07117d0dc

SHA1
590f4a5615e26a60e91029b561bedde789b53bb1

SHA256
dab708021fa54e38c8312db6e17cfbd23562d91f8084d78b4b65aa44c95d5bef

SHA512
4358b973b68f121cbb086b31c99844578789bc06c931dfd9c62225f2823142fec157a6cfc9dd85b18171dc48574b202e198f80802b7d9cadc8b4f6057a879c17

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
c956abfd57c1f25e1eefb31251b7e69c

SHA1
c5df68b00b93c9579f5a9b50b5425fe1166a8d42

SHA256
fe6366f2272622886cab3168cec2cedd67915f010a1fdd569b678cd9391f34aa

SHA512
84705343502ef6b4d1076f4b715a8943acc43b7533afb1ae0a87fe3030d8b01791f90f24c45b11548a89a12874324a3bffa74c080fb2bdb9031c06e13e413246

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
48598e6ea39957dbaafb4718eca02e81

SHA1
8537e3f3d4312fb40d177922c538e7f241249d0a

SHA256
5ef0e648c2c9f2569ef5bab60222a7ac6e65b2b1de8e7e87d47cfa47a7c5c6ca

SHA512
68c10897a1e3bb30bdc79558057c25382933bfc2fc0b806756550a0370615142537bb6043ea8a83f6554702d5a776dffa807d9c5bce84a66958a0b312008bf4d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
24d9509328b0be4be357ab27b34aebae

SHA1
db20d5767c4bb58ae99bab02aecc95110abe51d2

SHA256
00ee80dfdc8938913d5becf2312156dfca8b2730ca84632d9bef58101b075be5

SHA512
41228d5662e4191d76e63f23c247c4d533d7467810b23b76ba3676cb46110e3984b245e72c85dde58ef29400c37cbb5208007664ae194f2528a767d644f5540a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
74b85f694c59baaf4cd6072ae7a9c0e5

SHA1
3953ba296e5ebcde9b082590e877b76f433d2e85

SHA256
5e7927981177361874aee8063e79760f2df36d4b70339600d8260a799cd77584

SHA512
a8e1aa5603e6b4b7505e77c6288e2c333161a1ae9bb68a41709c4f67d455e843f5941c1ee319698f676cc2cc59660ebdedc63b84d1080d1831dd9dd63303ef05

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
47b9f9d259d8abb940b76f99264cc382

SHA1
eba66bf174b309ead746d4b83f35c9eb52caba88

SHA256
0806a9597cb3c9e1b8e1d3dc3f3bc16063ea6bd9f5b4e9d0a2e12b922b4a3c48

SHA512
4e0dede4f9467b6327dca4c509cffa15368c9d609df7bca713804d9a3394a1a12502dc096c242658f66d4eff91f21aa26a5de419d21e9f2ae3ffd3a2c42a7e3e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
29499bbab5c6b7775733da53c3b11d5f

SHA1
6e56188b9d0c18350f835da00d6255422b902f3d

SHA256
5b21efdeb8c87b34f311aef632b56a713fe13a27628a97ef504b3ab26c82dbf7

SHA512
65a6d9b4dc1b7d3222c583e476e3fa444a3660ccfc0cef928ab74c1e4de272cbf0ba9167e80681e22369affe1baaf39fc5487fb06dbe8e43c8ee69ecd2c813d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
a0373bd52dfd5457b056bce4c966ee8d

SHA1
37084acd0decf22fe16f97c71421fd48326c7a95

SHA256
d0a14022bb01751fe98ac1aa956d92689d88e096a08266a7b84fca4a114091d0

SHA512
500207ed4eac8e8413b3211ff8e95f770b174347cdceb0aa03db677dd57c2e5e975c1b4c50a53a08a29298cd88fb78fb0a1a863f75cf62c6c1b12f6742c75a55

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
0ecf3221aa1e38fb120220eb86fe26c1

SHA1
f180c3bd3a5e54c70dd298b97fe7352e11f014c3

SHA256
103d6f225bb49a65924c1cb521622af3818ac36a08db44158dc32e85080e4532

SHA512
143ba1c645bb8b3fc805a8503b609060fe0128ceca109a2be41ec2db29aa79fc498fd6909c79cd3ff373ebc435685be11acd0db65b117973610d53c084300042

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
cba28952fd7c37e109dab56971d57f0a

SHA1
7841275d40bc7248adff4c94b94aefda37ceabef

SHA256
b01de1e53d04ad76f89221ecd9beff06271efa7863a85f8eb4e5572c49a888bf

SHA512
8e97f89cdf4d9ae98ea162ac8437b7e26f6a463385f5af53ed00f7693d5f635b29cc87d4d326188f996a4db01308a1accebf8c4aca1f4f814dcc533bd37d56fa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
51628c1aced46ace046a55793b69e0fd

SHA1
9a3fb0cb794a514f415bbc88a47b84799a82f76e

SHA256
6670c0936556d1a25f62ef2b725c538cfa3c627a82fd2d8e369ac214567e6d41

SHA512
fc07185c105740cec978264b1222dcc7fd2c18c96ef4fb7f11acf3cec27827a2d7be0bb07a2af2d91c8df1155c57ea8403c206f976a8c72b6d6fad4735f07793

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
8a4d2cd1763c36e2917db2e7aee7f2de

SHA1
d1a0176aa60b15b48ed29faf79f901a32025ae6b

SHA256
2703406d7e81dccfe724b8bf6922c03b7bf26af46fe60fdf17586241c9d86ca7

SHA512
0fa1e4433337a642f543d781c5a123a95d5a2b4756f0298184347c479e6086fc55276e9c653efaa9eacd98d7eef5614482d03a30d0f86505ba15ca98ddd4e102

Download Submit
memory/2792-7604-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-7602-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-9165-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-9166-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2792-9167-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads