xorist | 056f76a1e2ed80c2dd1f4244a58b596350401aac3074320ea23e6da2aca0a78d

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Size

116KB
MD5

bdd5ccf77ee8b5ce2b00c50f5b2c0910
SHA1

8ef2108c1c4756a5686618d280851aec77b6c0f1
SHA256

056f76a1e2ed80c2dd1f4244a58b596350401aac3074320ea23e6da2aca0a78d
SHA512

978e00bad5550c0c6997ebb6affbb9018920c7a55174071873809f40a3fab84b8b7c469f772f4d02de01f3d032d768197af39670fd5c52380f5a530ad3603000
SSDEEP

1536:ar4k+OoUPdn5a6r+f57thh3hPhGhxlqJZ1h+yOuOlXc5FbCpKYykhlSt8cuWDUaQ:arZV5a3lpY/7St8c97wFwe

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 6 IoCs

resource	yara_rule
behavioral1/memory/2984-7416-0x0000000000400000-0x000000000043C000-memory.dmp	family_xorist
behavioral1/memory/2984-7417-0x0000000000400000-0x000000000043C000-memory.dmp	family_xorist
behavioral1/memory/2984-9052-0x0000000000400000-0x000000000043C000-memory.dmp	family_xorist
behavioral1/memory/2984-9053-0x0000000000400000-0x000000000043C000-memory.dmp	family_xorist
behavioral1/memory/2984-9054-0x0000000000400000-0x000000000043C000-memory.dmp	family_xorist
behavioral1/memory/2984-9057-0x0000000000400000-0x000000000043C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2192) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jrXn698rs6w221R.exe"	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pssession_details.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcrtix.inf_amd64_neutral_e91a5dc0655e200a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-ADFS-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_data_sections.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\pl-PL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_blocks.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_PSSnapins.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00b.inf_amd64_neutral_89b555703683b583\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Core_Commands.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_escape_characters.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pipelines.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_jobs.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\acpi.inf_amd64_neutral_aed2e7a487803437\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00h.inf_amd64_neutral_96a8e38189e54d71\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\ClickDownNormal.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_CommonParameters.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbtmdm.inf_amd64_neutral_2e4da8629fc5904e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms002.inf_amd64_neutral_d834e48846616289\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_sas.inf_amd64_neutral_a4d6780f72cbd5b4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_data_sections.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\v_mscdsc.inf_amd64_neutral_8b1e6b55729c3283\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaca00f.inf_amd64_neutral_f7f7e179d99acc58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_format.ps1xml.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrf.inf_amd64_neutral_439e7d1dcac00aca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ql2300.inf_amd64_neutral_ca8487daf77ff7cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\monitor.inf_amd64_neutral_ab477c4d805d044f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_cmdletbindingattribute.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_arrays.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc004.inf_amd64_neutral_bbd3435eeaf576ee\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_job_details.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMESC5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions_advanced_methods.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\lsi_fc.inf_amd64_neutral_a7088f3644ca646a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmelsa.inf_amd64_neutral_374f9d31af832d6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00b.inf_amd64_neutral_2e6b718b2b177506\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcpq.inf_amd64_neutral_fbc4a14a6a13d0c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmp	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Line_Editing.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\SQM\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-ComPlus-Setup-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_split.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\iknaccfhhknnpchh.bmp"	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

UPX packed file 7 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2984-0-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2984-7416-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2984-7417-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2984-9052-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2984-9053-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2984-9054-0x0000000000400000-0x000000000043C000-memory.dmp	upx
behavioral1/memory/2984-9057-0x0000000000400000-0x000000000043C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Windows Journal\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\de-DE\calendar.html	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\greenStateIcon.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR17F.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\CHIMES.WAV	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_hover.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01292_.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\en-US\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\Other-48.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\EDGE\THMBNAIL.PNG	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\button_left.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0148757.JPG	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\CURRENCY.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\he\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\GreenBubbles.jpg	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_dot.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\en-US\settings.html	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21480_.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315612.JPG	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02058U.BMP	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099152.JPG	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.lnk	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files (x86)\Internet Explorer\SIGNUP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0174952.JPG	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\TAB_OFF.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\redmenu.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\feedbck2.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Stucco.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_m.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)alertIcon.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR51F.GIF	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\BlockTest.mp4	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\prodbig.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\21.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files (x86)\Internet Explorer\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\1047x576black.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\deploy\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_rest.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\x86_microsoft-windows-autoplay.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ed7f07959ef02f84\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-eudc-settings_31bf3856ad364e35_6.1.7601.17514_none_b84dc938eed78546\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-hotstart-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f0b795e8f857dc7f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c80cf1d4b4cdf5c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_stexstor.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_d5b8a3090cb0ef23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_WMI_Cmdlets.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ribbons.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ae6e8472b208da12\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_policy.6.0.microsoft.ink_31bf3856ad364e35_6.1.7600.16385_none_240fb5f394757090\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnlx008.inf_31bf3856ad364e35_6.1.7600.16385_none_4ad9791e5ccc3974\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\MSBuild\1a154709cdfe214029ea88c51ab2b579\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\servicing\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ipnat.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4008bb7ca5eadf67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-o..s-service.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b44416c7e9e09699\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_functions_cmdletbindingattribute.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-sniptoo.resources_31bf3856ad364e35_6.1.7600.16385_de-de_4d3f2eb2e35fbaa7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-a..olicy-snapin-native_31bf3856ad364e35_6.1.7600.16385_none_a5b522837df19ae3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-dot3svc-mof_31bf3856ad364e35_6.1.7601.17514_none_fed5505597978279\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_64\Microsoft.Ink\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-icm-adm_31bf3856ad364e35_6.1.7600.16385_none_6a7d82093200f4db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_aliases.help.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-e..collector.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0bdd1a1b9873aa8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\inf\MSDTC Bridge 4.0.0.0\0011\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\settings_divider.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7b2107e9ca749c6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..leshooter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9614391514d4c938\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_brmfcumd.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_fd3235c638fcc522\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..e_runtime.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4f0f793e87a75079\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6d7d60ea24be809c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..er-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f33a25822fcee3ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmiperf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_fae76101a7728c8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-alg.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b09e0ee225f9b48e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sstext3d_31bf3856ad364e35_6.1.7601.17514_none_625ebded763bbe23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.7601.17514_none_3bd2e487d8e769d3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.jscript_b03f5f7f11d50a3a_6.1.7600.16385_none_a6b44d3a3f5b37c7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_ab6782291b0ca7be\rss_headline_glow_floating.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.DirectoryServices.AccountManagement.resources\3.5.0.0_de_b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_ddores.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b860e3728a94f310\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_7.1.7601.16492_zh-tw_839e734a1796c923\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..-calendar.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_dc373b8a3c1190f9\calendar.html	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-12.htm	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-tvencdec.resources_31bf3856ad364e35_6.1.7600.16385_it-it_33d1f3108d482e7d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..atibility.resources_31bf3856ad364e35_6.1.7600.16385_es-es_55c9a92765e4c2e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..eservices.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8c5bb00ce4f9092e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netvg62a.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_963654db403a5d93\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..-setieinstalleddate_31bf3856ad364e35_11.2.9600.16428_none_8eaf79351dba1b94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..ting-separatorpages_31bf3856ad364e35_6.1.7600.16385_none_f1cb9ac3156bde38\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cryptdlg-dll.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_d00f6a32d935aa1c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8a027c6637f58839\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-qos.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2e571111c694db8f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wlanutil.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4c9b200c94aef485\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiaca00e.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e0aaec9067d9d36c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-h..providers.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_feed4020425c7714\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\diagnostics\system\PCW\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_it-it_cfbe612478d15836\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-appwin.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_86a3fe0653491d07\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rpc-http.resources_31bf3856ad364e35_6.1.7601.17514_en-us_b143921936942d2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-smbserver-v1.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c6ae52036e388d34\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ipconfig.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1ec2af16702e7c60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-rascmdial_31bf3856ad364e35_6.1.7600.16385_none_d37d716fb6acab61\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_es-es_45e192d8a828b8b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wmi-filter.resources_31bf3856ad364e35_6.1.7600.16385_de-de_199a79fb26d4d837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-pets_31bf3856ad364e35_6.1.7600.16385_none_d0d7ee773d711005\Pets_frame-shadow.png	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..per-tcpip.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bf22f74eb8bda0f6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..ssmanager.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b21739fb5c961bcf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell\open\command	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell\open	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.1212	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\DefaultIcon	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\ = "CRYPTED!"	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jrXn698rs6w221R.exe,0"	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jrXn698rs6w221R.exe"	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.1212\ = "ELMSMSPLZYRAYWP"	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ELMSMSPLZYRAYWP	bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\bdd5ccf77ee8b5ce2b00c50f5b2c0910_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
223B

MD5
1ef46aab9e588928fb923bac741f5cf9

SHA1
22564aba4f92b447fdccd7c044255004bc9d520b

SHA256
b763fda35333c16f77f24ffe26e5df21e4b0855c3bb31e4b2ccb03444ee303c5

SHA512
dc7156bf9a51fe466ce39b6ce30d4c65a7ec1b35a56697ca2653305b7ad7ac0a0a45e3f2aaa41ab86ccfb07b75b0b1528db051b3dfadfe7eb13d59b4f03ca0d6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
eb296ed44e5526c28fe30f9eb80bc795

SHA1
86cad7812db393395723b47ae7efc379a1710ef0

SHA256
35452f17cb91776384ef57b9206920b739f0cd42cd21f5f0d029209f31bbfae5

SHA512
c0f501a6039d494bd6b850ab43baefbd0e5e01764905d40d8965235d68e29a43e8731529f0ca3e95348cdc8ae30e4b47ebb1a45f25b8bde7e1f2ee0aa10b3f94

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
27a7a4539015a7fd376fcfd884714b95

SHA1
4a85824f7d18089369594f65db6628e1900551ba

SHA256
aa748191aeb0bf8544263792c5f3c1a9953c0ae1d9e2627b2e771f00a71611d1

SHA512
4dac4cfd159c6e90078bbafd8c23d9a333b3e7b335f539020d7e8754514a128901b594128501a7688a2edaa97d5063fbe118f5fe96515effee51df6d75797c70

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
a34f03a5f45155a89be7fef7ea99b4f1

SHA1
0271fe2c57b60151fc483e599a5c5f49c341594d

SHA256
b90ee3f799f7896b995905ad6e90cdf111681f4bf56ec0be08c32dbf1e82dc81

SHA512
b523fea4f248f78cdebc615cc69b0b99816f228c484a6df2fd23121275a22204128d7e2e305d49d9291753d4b50425438ea35ad97a38fe9da05911a0c951c868

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
0b5e65c74a98be29dc64cbe411f43f54

SHA1
07e35238d4751e8f5e14b9c8cca80b279c708985

SHA256
c8daad2203b6ce6d79db05d93eb6676f9d4bde901f1758d9f15afbe85e32a4f9

SHA512
052eb0a4c21b08240b3c26fc3a7a1e725d2cae93c0a62cf029327f16949549b60b501ba9f2a8d2ab4286cd75512b66439ecdf8f588980e628f72feeda6498ca3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
2868a31688effd1697519a816bdb7692

SHA1
2b6fb9e8501fe4c873200c41f40aa9b3bde845aa

SHA256
50e0d950ae30f2c9aa452259922193266de6f3b60f31300482e4493588ef3b29

SHA512
c3011134d082e3a03dcebaf521561e630a1a710726c6b886cdb63d395f971ab0eade24de391a63f6f487e9ebcab5ec28676ff6cb4b7ee7544d1d61065e7e1c32

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
ec484bc176d556e8574171510639b340

SHA1
5aa9864d254368f3a7c448be48e037a068ba3837

SHA256
cf5f002e79753ba154f435da81ad8af97286bb01f2bc733893db4ca4375b1d2b

SHA512
cdfe3c3f0ad26a7555890fceb84d2f32f45198847707d794827914660ed11f5b27efc109735ca7b3339d4cf734977e16604ab91cb94408fcc95aa7fc0aa82319

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
bd6aaec70f42fc82ccf9d000ad8f4d39

SHA1
d28580f267887a9ced3a9e577adbae57e61deaa9

SHA256
4fc381cf5930adbc92527282978eedc9216965d9f12f996ada3c9aec8b3f838f

SHA512
062220d925424716b8e60bd984e650b2b0d888aaf5800905cd615686282d72cfef72e5f713257d257950262e3d09df90f258ae7cb3a2aeb7f124f31fee04ff99

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
ade3df99d097ad352f5662227d02072a

SHA1
20c569de3f449c2606f63545a94acba018b32925

SHA256
c2ad850799789188216f1dc46ffbfe6206a8d8e4644702df8918f2969e06ef7f

SHA512
c90fc4c49a21c77f989d3d9a2c758b284f6bb49f9f3ea760c318afe3579ac2c212cef3d821456ab2cb71f69aac1088dea230e8ad556a6a6cb126164442bf7512

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
98c4bd6d246c541c8caafa91e749eace

SHA1
ec47547035956b52dc5ee71120f6daf585612ad5

SHA256
37a46fda5b52f89d0459b7aef8834fb31297ea26948d0e779f112b4ff03c86f5

SHA512
a3bc78b566c4dc8d3adb24077c5aeca02d37b02e0166a6a541ec9bad0c75d712c7b2f10130ca8bbd9d7735bdfb584ddc0b1eb5c5d9a6c64cb889f117e133aa94

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
be1eec6520eeac7b97d94c2f08a0f9be

SHA1
e25dd2c6da7e7e0fae9cc6115a07083f53205db6

SHA256
d447edb95609feeacd1e657351a4817432c62cb985aa0c01fa551665538ac0ee

SHA512
457088f5ace983144de4f3f5173c97bc957843269f1977403f1bf487d91f2c3d1d90f344adc7879d0af8cfbdca4c2baa5e9617d1ae8ae68bd6f0a5a32cf4df67

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
e208182008432154a22fb947ce6d0139

SHA1
73adbac41b38b72aaf70e0afde77addb7a5874c7

SHA256
87ba7e567084a152a8bce52ff0e0be6aba412499c5d1362f2c261ae64fafa39d

SHA512
91f345f4803818699de6b4e0095d5a20630e5acba7ff10d9a5b7adee16e2c2c09ffa1179fa14cec1f40eb4d6e0b6336e9e3ab02c2ec59b3a82f6c814b90e86c7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
0e43dc4c0e7c6dbd462bdff00012c523

SHA1
55452f064fd736e517f6a1161951e45424df0eed

SHA256
ed945676600034420c06fe90b04baa7dfa08a78e2fa8674f515788fe4c58708f

SHA512
c8d1c4483cce42e3be2992ac6950e91ca91bb5866b62383247680276d950f54ea5c80b5e80ff5ace60f74f70ca9b65f4b879da9120ec578f1ff43cd86e44d93f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
a002c5dad587281e01ea367336acd8de

SHA1
75781e2d938020cda3aa2ce33d44575417b8aa89

SHA256
ba3b2b27c4d422c4de6d74020b7381ae8f28b1831877fabc3e05b29dddab299e

SHA512
7a27f82331ffc3b855db7d0256c81a3e09ebffce12aff0ceebdbd6003f5721d57ee151e385d2451e47b49c54d256f60e7cc2d854068253918fba41d473e26a7e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
186a7f5236a2a2ceabe5e00ac2863cdc

SHA1
080523360b8fd1289c556357c0d84ef091cc8786

SHA256
75e3c8f0028d9f6a5ab6ac0f6d14a866f63f04adc6d1cb07be2f697a25c7a8c0

SHA512
78a6a830757f206893e9115534861f08023ccb1c70b163f9ca1fb7f97442c11cac1f6a96b863fa627bcd27d807e86a0e0c154043602d97432bd40313df278664

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
f3215d23d5cdb468f609dff4ddf42fb6

SHA1
7b991ccf8ab2e3e5bbb5d7f33964d2852f4d0fed

SHA256
15a0128cb3c6f6f2b0f8ad3ad93119db08de1dc9595b2d940ac8d999ae73cb5b

SHA512
b7717064df9825d4fb6534b79938c6a293b85ad3589be3d5168c8b80b7e43533f132d91fa800bce846d07690833d34db1820ef37003a107c0c2506759b94de96

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
84395704b46ab1895921675f6db5309f

SHA1
16a3ffa03baa2e953b4298c2a655171a998325ac

SHA256
7cfdf8cee8a2ea26aefe129ed2d56f6eca69949585a948295d795193e09e8800

SHA512
beb3295edb6d283aa4ae8f1c90c563f1d4e1afd27b83de6063c85969c879f9e33bb28d250b60a1e398919b5d8a9217ed37143ed8735ce9b799d559df6f3a1208

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
34738308e0f0d7372fe8bfe75b7c7673

SHA1
bda3c02c5c0d90d416f62dc51de2d1347a06a225

SHA256
4ce35e8a4be092e3349b381215e4343306020033b47ba241ed205d10d6fd4fa1

SHA512
f8bbaad99d7c45d27e4b5f55982d2bf6df5846a7c1705aa8b791fc3577aa2d1cf8b6d9567098a8807e42586e047d023616016efee207362b5395a56e6ab2791f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
137c4683a556e737e69110fbe198c42a

SHA1
dcd0067cb5155806cc0f904d3a8b1d67f671355e

SHA256
01b3b41b67847f06864e4c376c9a5a75841e3afe855e7c085c976d9e9698d720

SHA512
81337f112d2076c0c6e4809c53de6da520c74e9b8f84ee7b8c58b6ab69277d3e2f8d3288c12abde2668253b18ac1a008889947a2e0718e39c04a73cdcd78dc7a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
5f6501a9a4005f97609d51d36cbc9a70

SHA1
c1f5ced99fd37434178a7a11b699827771329818

SHA256
cc0326d94abd727bfc0e2c6491e3a0fc3f1e1b700937936c9f5015c39551f429

SHA512
467182a59dddf66a7bb1f589d6867a2bb9277db46b572c5c82f0ca723426a08d2aec2e1000e5e314dee1c6ebe9d63587e90022e2f20b22d3a6b08e90e33d87f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
1483a49c2e724178792ea8da34a17a58

SHA1
e1e62132ea1cbfdcd931cea03739d75d56d06bdd

SHA256
0afc530d37c030301f80e6013a744e0281992b744426160e1afe3f23b7e785d0

SHA512
7c48775ae0abc27ecfe862118b837c50f3779770d9beeb7dc1b8f4b08254a187a6b2ff1820040051da317b34f233901058ea1a2c076ea5cb0ac2b417d41f2b9c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
22deea34768c396e096a490a96549b2e

SHA1
a3558b26a7436389d52b97360b2ffb6152e2bab7

SHA256
df3bba8516cad110afca3a135f5dc64dc96172cde0b76cdf2771e579d78b0b51

SHA512
6f8104bfdba8b012691ce85b1d32baf677d59d74e740e2501fe93668feb0f6655ff7ec99dc19a3c833bcb16e07ebae91a6d975cdb6ec3e4305100e76654a2192

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
bf0b81167e7c30257b842ef40f4fff73

SHA1
bea1644ec561ff1ef65d897767a7416a0e88fe65

SHA256
b7a5f54a7a8f4bdab1f1d97998aa4939ae5ea0d960c69f0ac6410382ba7d9859

SHA512
af0881711a5141925ebc89e710525aa27631d8473aa7f5fe8deb42ec7bb7bce44bd57fb9ab83d05b0e857336ab4b9be4ebe98415c48f6289a2905d17faaacd8a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
244aff51f8d3e3a35ea0d4912cdc74c8

SHA1
84624329954edca58fc43a719888950aa3ee63d1

SHA256
e4dbd5e337ed5f0705a8c2d905ccfe0a9816d672e9c8bf08e83acc3b75305372

SHA512
cf3614f69ecc1351c0270db8c21440fabdf9045e1e2456c83247473efbf0ea5421c406a835329eaebc83a792a377cb2c1108912d34b1059627cbc946391e36b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
0d6935e0320bf71ab747f8b509309ebc

SHA1
49b93d628013d01f88444c4bbd0e6cdb75d6b09a

SHA256
d44bbd36863b9de23c86c7912e38d3c428ebf6c77a7c8c7e57c202f2309a5fec

SHA512
ac6a8571612a2d55bc2a0f38ff9d02b833418bb659c6f62658f94a0bc7de41f1673b9a54ede574de5a34735e0e898c2beb228dd2dcd23c3ade81f81a098440f8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
277481fc0d4984662af206c807c27d0d

SHA1
54018fd95ba92b1e9f9ca685c3798529399a9c2e

SHA256
943beffceb48b9337cc74f507f8f2c77bf228f2924ed3ab9f65a42671d35e89a

SHA512
962db909e76d24163cb56c016effdb1be86d5fa3ce60dac5b2c1e72d2c929288b176f8e52d08269ab1435f2e5be3c655c47a590877af4429583ef20ef8489cff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
cb294941d51d7054aec9850f3e61af32

SHA1
40efd4fe2ed85a04bca4576ab23f56700a21a283

SHA256
eb2880240848359a5b13617a27256b4cf5fad4bd108239a3e1cdb5ff8e4fffac

SHA512
bf9587d48ad51b7ef01208ee40431741cf2eaa5760c730da245161e9619d6e11ad2f16aae8a969fc07615c0423c0468ed97f7515dda946f7faa717b44c29bd9b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
93397dc69c8fe826fc177ee6a0c7f342

SHA1
6b2949f57533194a461f97ab2ca8825484b737da

SHA256
ffeb3324eddc2f87bc6d9c30c8d09f9fe7daf0432c7915d398163edaf53cc2fb

SHA512
6286910ba1f36874585ba195421de6873fa682ad408db3fc4a49e17aeecb488789d4a7633c5490ecabe2f7a7fffa3ca79fc63c7082aba979b21eb5138edf6c0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
6c41968a275b28a0e487ba162bab0f18

SHA1
457f8aacda89d7e35e8335ab4c9e322030f30be4

SHA256
4c62034a628e5c07146d170b15994aef77f22d7c9261b9c98bbbdf7c2fa478f3

SHA512
10aa22eb8b86fc7c858cb0977a78972d1067c7f96eb708c9cfb0cf699445a30a95fe4a455955c92f1a58a94435f6c7a05c8e0b333146fa36d5314e7945e9b738

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
f11152fb9a365627a27f0f4d6b21a767

SHA1
9dba66c61a9a122a1ed0400c6954e8c7f3b35b73

SHA256
ae04653cf178918e42d570b387c9a31d6d201cba968ee752be0c94e08ea380ef

SHA512
6a214508d4d816eba9e2a5ad04c153ee5812098ebb0924c9f26b5c173585d4ebc0240ee661d7e4d0972e046079456e3194e2af9ee43c0f886adcf0a3dc4a890b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
f11ffdef54295d5554c6ce0bd17ff9d6

SHA1
78e30dc3132f001fca91eaae8d47f97285deac5a

SHA256
eca8fc4e30b79313dd8c239e9fee40703e86db19f779a5e2194ec704079976d1

SHA512
d7c340ae177ad690260cf7b733b48ab4e9c45a3ff335087dbdd11c4b9a58d60b64dfbf32acc8b24b30dfda32234321a61fbe30b08f154c31ed76a68242f1c197

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
b6049e445709df8b57e98680e5a37283

SHA1
608299c614f3a31fbfc5e03144b1a6aee94a0aee

SHA256
0d3146db9d533c11b7a30334007ef9c31c5feb2318b94cc4a7d762d7feb14bd5

SHA512
96f1a9b87dbfcd9d71f183ce3d77ee71c3dbf5262d80de869eb42cb30a4652a689836d4105c4f5f8c77f4a427f5efb45e69c0c47fc5c9ffdd50bc10fea373310

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
d018e8eddf9a6ae99fae2e5de31112ad

SHA1
c2e0390d4c3a0b33c3633a41f3037333ac6e838c

SHA256
fa514b1222b1758225d77aabfc739504c70ae74376b7fe6b46ca3e64b5657473

SHA512
1f78de7b2873c442c41d1e5268db62b2b1797c252a1bcd16a8497d7a0ecdaa9bf20e212756b22464782291a788a6e380eb809bc618e4b9663f13365bf9ba4df6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
9af2678e7c29d65278cccec9f786acb3

SHA1
492f57d6c36d950af2c873a05dea22f3d89c89e6

SHA256
f33e96cd4234b4dcc081098685c45e89e32d99b8d8473ddab0fabde88de65bc6

SHA512
b73af2a37e76a6d33830e599d7af8cccb2c7cc2055682c5b045647d570c305f402d07fa2a03902f49df3d08897f64bc193f9ec3e8c0f4eddf4961396c80240bb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
7a40233cab9efdae4c70734f782c9784

SHA1
f26053d429b45e2f55983bc60688725d55cb5345

SHA256
4f1d18289e22394b3fcfd8272e8f9e4b4bf433aabf7c7fc7cd292cbdf4645635

SHA512
a811f7eeb6a887a1e01eb9e69b27ee0c481ba3600436b21e415f610147f1c28be0d9c04da930b72af816426bc3eab48565e21096aaaec539cd3c7e12f5464994

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
3d69948ac900f4fbe8b895d6f09ae1f4

SHA1
85efda7ed1099d8c2e47926c9d037c2a0207d52a

SHA256
f40adf37bb2180ea24bd9f46b3a6e1beed8e9fb0fc5c14860bcc168357a40458

SHA512
9ae01d55876e3c8d4a69fbc83a5a9a7499f1c143ac779d725747de84d81a92ee3bb549cdaa716d445256e41c7a7a96bbe176630280cdb019541414d68fc3ef4b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
c0b9de59fa171978c01bd44c897e62c5

SHA1
1412b61f5090377dd2cf7dd121df0142d3b13495

SHA256
40cab4fb712a506fbfca9ccc2db99b04ea4e9dd3676e0e1031510d78ff4fd07f

SHA512
e71c418b6ec2b6fd6b718c88311d2f4aceef28997474a4dd768dde7fbe47e2e85c6718bb301189c9f570867973e5e5ba6827cf4c661c00fd6bfc500525d3e5bd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
6d4ef188e5f600254c926e36e8d260b3

SHA1
b0843a149f49301678952b6bf997ac01c278bb10

SHA256
f6b3dd8dafb8b7b12e2183ac9ea9d463dea22009ad6e9062153c008a303effe3

SHA512
d63244072b1e4bcccf22dd47a7029a32abd48128a3040191a4576907c04d073016a1f2247834edaf8d2439528258db52af994a548c41b68ad0e7183e9f8f4c15

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
9662fb4e45ee60fb5b35a589664dcc2b

SHA1
8a6c05fde657755be57071fb3e72b3c93fa5cf7e

SHA256
85283e87b2e479f05a42903874fae0ccc8b84ab04d371297173208e414c7424b

SHA512
a808e96dd98be9d0fee5c79dafc1946b58b8c6b0eb703b39df3f7f3b6ac127c447849fd03e36b5ad57d454e143df85ee96da3010ee17e737489108a1e34af346

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
075e095b6839c45f02799e76ef1a55a2

SHA1
c34ab7036726cf5c297f0f56e630771862f4666b

SHA256
ffb810eafcd1b239441bd2490a7ce68ee25cb03f20f3d8f44105f083cf99fd32

SHA512
039c81acff949745b5a99e96746f4bc5ded1ae0059f7bff7938b197d914db9090ee396930e99dc6da4f76f91e80e712a397a5d94de009bb4752a78f323231520

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
5db7369e64fa6f871f951ee705e18946

SHA1
16d0b23d37ac699b3e7e257a5bc3a8b148be1eff

SHA256
b569fc4242eb447eca93795a583eed051699edc1a487723e7d20dbb0ec9dc255

SHA512
8ebd1e40454747a883b6c4be8e7b841bfb56178962f00c0c69469a43ba7600437b42f21664609782eb6f7b18b7d61cc632fc65539afd798d7101bd042f5b50f6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
b2e58c5dc27a2c164b26e2171301c5c5

SHA1
9d8ccd0784d20eba62ed571689c5ba44ade8574d

SHA256
47dbbc4252855d7f9c54a0aa6853e20fbb8e75e6e621488b057a67c8d20a27ba

SHA512
f82f92a9851f16893a23602ad9d8f151ce9105710c251a4efafa7eb7769a35fd12d5033bc5e157fd5fec4fa02b4850ddbb2769a09a79c706bfd7ba32238326cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
0281dfbbc7c49e0bb844b2cf42fbffe4

SHA1
7cf6b2faa14f84541e4ceca0537c8770eea1df87

SHA256
a0ce4ec7f41f43cde634626e37c38d2158a69be7da695ca85159fc3fa22eb784

SHA512
99eaa3fa613b7fc86ea1ea3c0636debe63358609970f69d6d488e809b3b5af06af716dbafdbf07ac34eb13b82eedecccd277483f8829f7e97bdc3d5c42e10487

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
0b4c29b7d12b5a16a2a4a2e898e1d0c7

SHA1
da8961d898c025de6732824af5c7dab8b1e4b164

SHA256
9e57dc75cdf0a283a466257fc631c52425e9650eb1fa1540ac4815e6ee391f8d

SHA512
418704226712b9a2a4166143ee9a78aeded7eef232fc9f2295d42726f718a9d77b04ebd1d59947f1f5ee8c38e2e99f8efcca311359a7772d4abc83806bdec5cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
ab606c2d857db74a5f5d266b0aae56c0

SHA1
f8ee5605a600ae568e420c45e3f6f027569200eb

SHA256
82440405e59d2cb65524e3033a440308d31f636a785b673bad2953f312f2b696

SHA512
d53b7027f832b0fe4dbb2543f5586208cc13b015fa6a896171d5ae458bbb5e2d9ed884802faa50f12f723c579cc83e5cc632bd365abc31dd1958899a33d165a9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
02fc559560041bd789731381e8e060f8

SHA1
f71fdf58b6556b85dfc941de5d0d9f9e9a687e8e

SHA256
64dd54b707af6f1a199df5a369ffd027925d7f258a96197dd6b1506d4cb92520

SHA512
94d2a73acd46e8516354b88b75fa1b48079d621d380cb590e713f95136d157b7570e412e06d5923a3761e02984e93be794500184aed5b1714953eb368243e7e5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
7023a5b26de6848ece8f1e0321a584b5

SHA1
f389a146ed492a0c5a61294fd2438707860be9f6

SHA256
023f93d33f25928477590624b07de1bad91d67692ad41601f12db1b049177a2c

SHA512
428d5703a5386c5dbca24718e0c2e8c1559d63ce11010cb8a5580e7fd0241117c7dfd543de16a07f12bf528247877fbbf281960710a0076b16ae90cad12f06fb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
f38d8f5e146541440468f7a82dd033be

SHA1
2b16366eb957980d787377d5a0ebb6dba1290613

SHA256
e69d9f1176e809a9608a6643936c3634031a7766087330af1bd679131315a306

SHA512
ca33e9a5c61cd198dd2f6b4bb188b0c556a76502b6b509fc0d4a328ecbdfc0be1c3e13a1073adce437abd77d3b4700cc0b9ad17e38e99e5f4917269b1f587807

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
7fcf1543890a55154375f2e91c81365b

SHA1
70abf0327d72cf5f15abfc896728012e1daf4a2e

SHA256
20b22ada6c1cc6db7068910ee85e3720e6f45e3a3f35dc66364ca7e378b3b524

SHA512
45f0d3b7bc69e7ccb2e2f40a464f27223be8e96ed66214abbb60eb4e884bc8e3dbff7eb46e6a428b223d9a14f378a27846c0999cdfc59123b4b15e633c9257f5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
3a2e2e31ba40a5e39d764c8a0c10b96f

SHA1
0038627963748cb2db8c6f0d0aea96deb3311d25

SHA256
649c906471ffdd2308ec088a0668533963d51056742e219464c352f5533ca547

SHA512
45ee1e96073aa2006e3661b79466904437950aa7e1141640fbaa65356124f3bd3fdb7a5e834783640bc1f9a7554302c8ef142fe21ad2b8c7cc8a82a25dfc654a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
096a8db93758fd33bffb04a352c87c4b

SHA1
ba58919092b292b3b719fc16e8152596efa512b9

SHA256
25112a01e6ec0c08afed05568c431dfe96db5affcdf83b31ab1eda3662984e63

SHA512
8cb94f244d896ed6053de23a268149eca02cfccbcf4b6acbf1b5e9a1b0c72748516435c683bbcccd3b6d5bbe81fe725c585f51e166e9a7a6f655bb3973b9aa6f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
d2f9e2a0c6a8d6876a9331913e0bd1b0

SHA1
96f230ce8fbd4fec24624c06f08266ccbd37c8e5

SHA256
df4a697a8fde5d4479ed4a82afcc4af94c73900f1a3da79e4c836b81cb657cb5

SHA512
abd44a5be0c38e74d38859a0af7700119467a025c9e1f988bcba14d151a0a903f9e5a501292b335ba751a2e90313c0c4268621fd1ac3d0be84a03c559616d944

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
b3ed63941871183350fc49b0f5af3eda

SHA1
cc02c36bc72695230356aec10da32c94ca057715

SHA256
f88d02f6590e122f0082d5446d03a5e3cc69ddaa9fefdb26be070fc8404a34b6

SHA512
92d179d6155b62be1f2af37dbffb6a0d9e58c570dd0384e4255790d4369f77b3ea14d69086b75df5e6323fe63e8afa04fa2b1babdce72042218a5a0dd4d891ff

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
fa022b91a070d97572728e2f34114917

SHA1
593bb091c400632296719d845ad8f1e4476dad22

SHA256
a229a06cb31160222fa9ca729018c091bf3c3b21ff877ad6757d63e109b095e7

SHA512
ee98377817d23a2a5185baab86d42c1081d1f6afcc1f98ec4909806c99f62d10fcb7d83ff0c4634e0ae01ee0c09b78ca804af18fd09aab4261e45a01b3b7928d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
f3ee436e481fa90c1ffc053d93fc711c

SHA1
04c68ad5d4805c9e8f2824e1833c4a51be67c9c9

SHA256
beb0f7c79378aba6c49400dc282878252318bda07108d35b08e6008ece0fc2dd

SHA512
bb124bc8efd23768a153e3b9667c2b5fc0866a40e1041212448fccfb6f1b2e2297e87506b21e1977502e4375e2ac0ddb7b3753f66c79ffca30725b1ee8532c40

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
115d6ec54ab5b98a604365f91155a325

SHA1
a4d84ae3120a5b4375092b2d3412d9c6f9710e2a

SHA256
d88f0553373dc8d24d242f85666a3376cfcaee2e38d28dc00703693ea9bf1cdf

SHA512
ff53255121cd879d44ff7756a2650c006510912bb7ce089a81085837f591a1a37910b2bf40094f4d82a92a004a728b7e695bbb02b29efe1d3e9b55039160fd9e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
84489de29fc74a104be1e82d57ce52c8

SHA1
f1c29e9de15540c2772a67c229034079bf13bcae

SHA256
e7a509ff63aafafeaa50e58e629f51ce1e3aa6df3154285552133c1dbd59dfc8

SHA512
01f1116c9a373da85d642cbf4ffa7e37d7ed54dc55677518578d1573df020c69d99549a73ab3f324e07999dc860274f1568181b4268e59e1b0c123ea9a6c9e7e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
5cf126aea8304fd5e60c62148ba3e1e5

SHA1
5c48b3397b924247b5d1cb1b6c08b1b749622645

SHA256
d88765c05d4b06a9d10426e5baebaa4bbb2187e130e39c937255bc13b6335ec5

SHA512
e59d81a75172c5b71d337545b4529d8432e628806d12a59bc033b46a681327824cb2f92ebe9d17f0e0cb6a94dd8dce399e46c34df16bf07a9dc54c23bdcaaccf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
90c4008bf605fdd2273e35895f4967ba

SHA1
90c5956d068329172dc71d1ecf386b6b87d2f77f

SHA256
d52e1f54291379655a69d6a59a02895c3182d58547918aaa73590fc957f49f96

SHA512
f5bb32f9699f13b18342b32b50cbdea20d608ed0a5377f4e21d01a7c4214d8ad3f91555e4cd7daa24403dbb0f1699a7af8abe7b77894921b0f1d194a0e463093

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
ee6740c40c31ab3cf31d8c042c7bf02b

SHA1
b20904171b70799fb8836fa6a7d581bc559bbb8c

SHA256
0725115ba1a5fdec4cd2870117c1a8d58d58a66e9288c376213b241ab5937a37

SHA512
a3a7a61b93a3f3b8267875605725aa5d6f31c649d65039d38d8ec2c43bc136231b98a0d41fa749c999d6dc583720ea388f804f4aa81f91cce32000ee10c88bf2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
0269df8aae005cc88e3dbdfdff89a540

SHA1
6b21ffb75bd38d909f5e614f7d8e096372188466

SHA256
487c75d4bd3d7b354e6008d6d6ec4a520e960e036df40a7a72b8d564c19b7bb9

SHA512
1bca39e061affcb12d5cf7caa14928ef8abbe4e10a1c5867c6fa7c2059f118597565f595d2608024ea04e9b95f4ef363c8e180d60f811e17c3d3eb55c277000e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
a3e794d48ee23861ad281b0fd796ce39

SHA1
106d1431bf59295428c4a57b440d1d56197d8e9e

SHA256
157112931ef3350ed728460e682c344f0149b7b89afcf91d38018b9235af3fee

SHA512
0f9f587e1d67e21214c33a62b06e83cbb7c28a748f75272849ed9ae0e2ea728240ff30a30d608de1c80210b43c74d158a6561a69711900708cdf65bbd725499d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
3b131c0fe72714f466a9fdc1fe231d6c

SHA1
883db1de6e0d459c0a698b1828525361fd605b7d

SHA256
555b8f1ae4501b9b784bbc8c734fbef9d6333995a122a69588974a9b789ab04c

SHA512
ba20ea5af4de2ae194d25bb65891eb43e56648c3370a8a571a9ad9b3d597c58142c17ac78d40381703c406b835cb7f7eafa00edd0f74c9d8370906570b3576b7

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
57b07798e24a767bd9c419dfa5e9ca2b

SHA1
f823f73d8858e60951592daabe4f311ac95c3559

SHA256
4b29149c8f8dda8171d3bf86b3f4df67d2bccf7f180c98bcf5c8f24791cf3d4b

SHA512
b75168aa13e3ac7e85d43833a854dbaed0eaa05ba1f1648052f812c0b9b8b9d9746b8e6008052c86f3dbf7e531e72f1f16de13f934c93ed0c582f0a2c67227e6

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
5666d90d9d4d25ca2646d1d33a782dc2

SHA1
5e70ae040da8b5c7de99622f1f43983b2fd447ff

SHA256
debe3b0bd9021c31bbbea3eb4ea161fc3c48e7668546ca328aa0483e3e19dcfc

SHA512
fdadc1e49088210d1debb74e9305615dae831916c9536b3416c119885611e0b1b44ec734e1d58f8532b4e87e2daf41af34686f1e98f13732e7748d5e984bbea4

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
af17654c832ccb181b70e1acc3cd8bc9

SHA1
b857b36638db878672e0b2052efe32b7c9a8189f

SHA256
80bc27b572416312fe15e1a7ee773e6842ffcfc15cf344c446a781ca780fe942

SHA512
bed7e1fd51303a65eee45791d1d88060439448559ae16fb6b1918d58d2df02edfbac13ad7c8e0db9ec6093e122d750280c70ea13834ca98e6b4e1e11dd5901ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
47b06ae557c13d07981159a2072ad277

SHA1
295b4f5dc86e057b2160d22feb41d0514235daad

SHA256
b7cfc82363ce02f5b4d3349d3c72d9dd41659525c2b0fa071fbabf5ffc2c1a35

SHA512
2a8362cee6a01c94216b1661706d03b0926a93612a6ad20a97dd8924aae79b660cd928ccdc0151ed9402790c5805b9c2be2998352dba5b72e128192310c93357

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
d612dac73790ccc7e72ddbfb6f2a518f

SHA1
dc857fb31a1419e13e372ed21caca1b6474129bf

SHA256
248ae5162063460228feccb4eee6123fd8b334f39a83085f32cfa45585598b28

SHA512
5796862fff4415edf18c0b0619c5b4e987e1c9db4278c35cc46b00c9522d1b0c678e19e2acbce97cbfb0b0a86e0d02f278e11a198bdb1a99982d4de53c7d3976

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
f6d007bd860d6d1b18a1a750cbbe50c1

SHA1
55d280c74f107f6f5a38eb42149a5ce6dbaf0a7f

SHA256
2955dcd1a1990a8240c370b9a39adc40a7104eee5442faf3c05f54f481f7d8d2

SHA512
a4452077d466553ff25f595025ac8df703dae5625c1dee47402227f367a474eac56044404e8a7f8f6ef6de63b79b4fa8d175b9ca11093664c8d90202d8484311

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
5ac4b55c92fd734f8cbb1f3ec59dcadd

SHA1
e139e2fdbdd02bd1986ef4ee5f806bdf64133efa

SHA256
0c61647ac45ef777079ae324d55ad8b1886ed628fbec4db6ba0658f1f1bf623e

SHA512
c60a8d5b9e7d00c4fcd4f783015b66e724ae390db2ee82a50a2d763c90098f154ec614b3cca4d39078c35bac756dbfc235f16991d8a8d49f13742abe59c951ea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
1cdc5eb33ced5156d7364aa23502f0c7

SHA1
053919b4de728e334c9e98a07eaf4cf0a18dc2cc

SHA256
3c4123cf0a8db89bb356a1e1db0cdb4dc61f8f8fb7266e3be90f407a57fdad79

SHA512
fa660e61ddc7234045ee667f7f26d5c52261535e037989290d786cf7127522fff6ce87e887ef5e1778853275ff2b757a97cf98bf805119982ac000a346388f44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
a7938bf5343216248268cd3146b4b22a

SHA1
52bd3aa969adef8f348ae78950ab8e5f7b2c9314

SHA256
bfb1225f6c40b2368a86eef7e3205843e45b467fcb809443ca8629282b8dcff8

SHA512
8f24d4fcfcea7c22e07683aeac83510e57ec9c8b9b1010cd8884ed8af155cb7413b136ed11406a9d4dd9abdc9344e6f5e0d3e5e5012ec5ba3bd022c01143cf8c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
4b438d3e0b466dc731484d24a7ab8d61

SHA1
cd1b564dcaa3c647f1e6a7dcc776717b1bc01e0c

SHA256
e7fc67d1ff8e208d39d44913f2d46e9ab3c7525488459ecb66f0e50ab36068f3

SHA512
e73daed557e9d7bb2ca58d92fb7a6e2b561f140eb735336af4d4557f4b1bc994bdcdeb605776c8d38596534c00b8ba4b32af2e0ceec81c25ed06479cf2f3d7a9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
f39c22dec62284b36a6ca7561c3bef63

SHA1
4054c31f49769a9df651f8ccd168808e5e43e665

SHA256
93b9560de045cbb82e7af3ad568ae86be221395861ad73533c0154db7d1f3254

SHA512
c80d75f83c898b3895337cde1cfbb76b766c83b3e5bf8f02fbcf569b3a2bcaa5442a0bcd98dce18a8099ae2f9044e4383767ddf0881a1a2845d3a5fd07c51722

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
83c7e76f5ebcbdef37b265e462ad818d

SHA1
b70ad57e2cb791b42d1edb7010ee415545ddf9e4

SHA256
2338f175763ecc13ff3232f0ea922ed2087dbf6cbc08a39655b3716cb9f6d66d

SHA512
ecb5a5adb4f09d4b633effed08add53ce6c272c5b674026180b3b633e0139e5230b8903714d47452aca27a18ee4872c131a7b6a43a977aa5764b3a3e83552346

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
370b303bf25e17f832da3e72b9213af9

SHA1
b5d73a37fa84744e28e2d5547161856b13a9bb8e

SHA256
1c62957a7126514954bc2d63ad3a0a9f106634d896b0c6108299207d79e5928e

SHA512
abb4efe7c12b951217ca95c629e1dbfa08cf43ec5f43a26650a76321866de389d482af411d906cb3fc76f2d43e9501820b4d036c982d7dfe9fb1d7e15ee6ec7c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
f9f7f8fa083b7351999c21ae1a7d2133

SHA1
94081c5dede0d28f3a26b73d74ee0076150e4ec0

SHA256
e3b2d055ff392c5d4c52ad25b313e6fba5b62452d8d6a27261403c052452fad6

SHA512
ceef4d46469f5cdc710745c9ee2da2796dd4ef8bb8d0f4d1af9e625181a4d685b7be0b114ffd7aff175c58f556c4d115d09feb6f390645f0c32486bb45ce62f1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
da0ec559ced534212182d949e3721d5b

SHA1
6ee380c294643c57182c637898e2fe400a38b327

SHA256
e462fa8831031f7e4b24675f40f3c4a55f380cd12ecc59d193f9b4fa75feeaac

SHA512
93f566e83165e0e94cdd4838b90a842eb14db6befc3ff89d17a7b60d5fa2520502cf3db848c1c9253ae0074f80573d10a19afe4c14716634aa04124da8ceebab

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
fb6040aad3ced4c93b58a953be901cdc

SHA1
0e35d0162268675b6949443273df15f9fea556b4

SHA256
a372ae677e9f4dcf6600fdf1b8092a12f8ccd52cb3c71c8e3ba07b8070211ea4

SHA512
965e0b03d8f3d9a3e523cffc3bf97e7e15b9e53f7656b44920e4a48fad36c755f49b4eaba3331cc3de751a989282133b90054672406cc51694df172ea6004b28

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
846b2a6ae8223bc2628f95f63d05646a

SHA1
d4bbf7554000f9be32d19c31f6ae09d6db4f2caa

SHA256
88a0a4adb9d5e20067be025e8ec81d382dc1bac439027c0a3a2d1354be5bc835

SHA512
47a2e69bd87e5278a8b2e75fd967d7be614a88aa118118b5d9168aa8c2fd629871c4321c37b0b904f95da7c3f5122863ff39e4fe906579e2b204585403b597f6

Download Submit
memory/2984-7416-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-0-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-7417-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-9052-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-9053-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-9054-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download
memory/2984-9057-0x0000000000400000-0x000000000043C000-memory.dmp

Filesize
240KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads