xorist | 0ea08c2387900bb5a3c5ae32b601c2a565b4615a42b935e43b1f31cc5f5c549d

Analysis

max time kernel
117s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-12-2024 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Size

40KB
MD5

e24b89d0a3ea99f390d038182f6acfb1
SHA1

4fccbb38f64b9f735c4a789c9fe1110645e84005
SHA256

0ea08c2387900bb5a3c5ae32b601c2a565b4615a42b935e43b1f31cc5f5c549d
SHA512

9cc81c84703ee54d2b7a25e16a2c123b89a556ac6a6e370b097ef2387a09a93d0bc0fdf83a1d228343d3373ee2be45c9453833cb2b393b3c5aa5bb6dd0f0e110
SSDEEP

384:yebFNw4Pk1itKkpAjjalrzhOBqYvjSLkDCgSwYB3MB:y0FmBkpKjgY7zDCTE

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/1908-0-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1908-7782-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/1908-9194-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2213) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kn3VIGskr65mt7W.exe"	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_scopes.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nfrd960.inf_amd64_neutral_cfc8c0013e9ede68\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky303.inf_amd64_ja-jp_b054bb0d59e0a3ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_trap.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netxfx64.inf_amd64_neutral_3336ecb2950fdc45\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\WindowsPhotoGallery.bmp	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Comparison_Operators.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_output.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\adpahci.inf_amd64_neutral_b082e95ec9f8c3f9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_While.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_arrays.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\sdbus.inf_amd64_neutral_735aa3b5ee832f62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\nb-NO\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_script_blocks.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Line_Editing.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netmyk00.inf_amd64_neutral_9c0c35afdddc16d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaca00i.inf_amd64_neutral_de104aaa48ee4b00\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Comparison_Operators.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Ref.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_regular_expressions.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Comparison_Operators.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\LogFiles\AIT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Language_Keywords.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_execution_policies.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdgitn.inf_amd64_neutral_09132735f1063a47\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmisdn.inf_amd64_neutral_061c61abd3904560\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_providers.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_command_precedence.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_operators.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaxx002.inf_amd64_neutral_fbe080a7dd77c4a3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_script_blocks.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcwia.inf_amd64_neutral_817b8835aed3d6b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_neutral_fc6bcd80e9e6a3c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmod.inf_amd64_neutral_5766736c47b90fff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mstape.inf_amd64_neutral_c2bb3ef1c45cd5a1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00c.inf_amd64_neutral_79ebe29715d2fa47\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\rdlsbuscbs.inf_amd64_neutral_351e56205fd4c200\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\de-DE\erofflps.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcsto.inf_amd64_neutral_2d7208355536945e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\com\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\megasr.inf_amd64_neutral_30b367f92ca46598\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\IME\IMETC10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_PSSnapins.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Windows_PowerShell_ISE.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\usbprint.inf_amd64_neutral_54948be2bc4bcdd1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1908-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1908-7782-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/1908-9194-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplateRTL.html	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\my\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\drag.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewFrame.html	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_left.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_rest.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\access_output\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\settings.html	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14755_.GIF	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Windows Journal\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TipsImageMask.bmp	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\Computers\computericonMask.bmp	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\weather.html	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\FreeCell\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ja\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\lua\http\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\SettingsInternal.zip	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\flower_trans_rgb.wmv	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\rssBackBlue_Undocked.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\it-IT\settings.html	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_SelectionSubpicture.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext-hot.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Media Player\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\THMBNAIL.PNG	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Components\SignedComponents.cer	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\audio_mixer\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\PROOF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\TextConv\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\DataSet.zip	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ef8c08_256x240.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\images\vlc16x16.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AIR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\logo.png	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\olh001.htm	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Visual Studio 8\VSTA\Bin\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\clock.html	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-e..ehprivjob.resources_31bf3856ad364e35_6.1.7600.16385_en-us_f2d8dcb146b08b94\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rdbss.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_236ecf107413133d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-webdavredir-webclient_31bf3856ad364e35_6.1.7601.17514_none_b34bcf2bca512dc2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wiaca00f.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_f55e1530d42f5d9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-audio-mci_31bf3856ad364e35_6.1.7600.16385_none_79024acd05e90673\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-certificaterequesttool_31bf3856ad364e35_6.1.7600.16385_none_c405852b31194b0b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_it-it_04f87c1305f0d058\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ie-htmlconverter_31bf3856ad364e35_11.2.9600.16428_none_f151276ee40bc690\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_avc.inf_31bf3856ad364e35_6.1.7600.16385_none_084e3f0eabcf1e24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dot3gpclient.resources_31bf3856ad364e35_6.1.7600.16385_it-it_018676e68e1fc109\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..5linqcomp.resources_31bf3856ad364e35_6.1.7601.17514_de-de_6d6aee55bd035553\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ilter-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_01f3199aae0b8674\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_xnacc.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_77c05e551298994e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..onal-codepage-20838_31bf3856ad364e35_6.1.7600.16385_none_5277936547471708\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-keymgr.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ecd317bf4cc234ea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-networkprofile_31bf3856ad364e35_6.1.7600.16385_none_d49043018fd6ce7c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_networking-mpssvc-admin.resources_31bf3856ad364e35_6.1.7601.17514_it-it_2bc0ea1577940f69\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.io.log.resources_b03f5f7f11d50a3a_6.1.7600.16385_fr-fr_a76941a47fa5cc21\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..registrar.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_bed0e53afdf90df2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Garden\Windows Hardware Fail.wav	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-alg.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_df6e5718e33fb3ee\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-c..questtool.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b3ea6debd40ccf72\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mfc40.resources_31bf3856ad364e35_6.1.7600.16385_en-us_76fe0af11a705ffa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..soundservice-client_31bf3856ad364e35_6.1.7600.16385_none_b19d574bd93a4175\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.Resources\1.0.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v3.0\WPF\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-dcom-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_113ce102e9a7f941\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..i-ntprint.resources_31bf3856ad364e35_6.1.7600.16385_de-de_26020d0fe0d138e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_PSSnapins.help.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_nete1e3e.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f9478fef83a24677\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Office.InfoPath.FormControl\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..native-whitebox-isv_31bf3856ad364e35_6.1.7601.17514_none_4777e36e0649406c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_brmfcmdm.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ef3606e77a162ef9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ification.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_2933ac3bc2e9c8cd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..cingstack.resources_31bf3856ad364e35_6.1.7600.16385_es-es_8c5b6dc8f63dad6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.mediacenter.playback_31bf3856ad364e35_6.1.7601.17514_none_ead17d7ddb78651c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.h..iverclass.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a390f049acdea28e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Speech.resources\3.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..-winmeetb.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_4a4444b9f6d87dbc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-wasw.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_218fdc47c352aaef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-us-component_31bf3856ad364e35_6.1.7601.17514_none_b52573ad8e4c2d89\US-wp3.jpg	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..g-fdprint.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6dc5297496bde7ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-v..cprovider.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0cf89ac6c095e719\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-usertiles_31bf3856ad364e35_6.1.7600.16385_none_f385bacaa98d1e8b\usertile33.bmp	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.security...icyengine.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_32ec604b60eee61f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..p-utility.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_2541e25eba7fb23b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\Speech\Common\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Afternoon\Windows Critical Stop.wav	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Characters\Windows Critical Stop.wav	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Entity.Design\v4.0_4.0.0.0__b77a5c561934e089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_mdmbr006.inf_31bf3856ad364e35_6.1.7600.16385_none_c218b25e6c778a2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-articon.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6324a0fe3a215514\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-wu.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4f6fccfd152ce835\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..ence-mitigations-c1_31bf3856ad364e35_6.1.7601.17514_none_6a483d9908ebf60e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-devicepairingdll_31bf3856ad364e35_6.1.7600.16385_none_c9f831f51cc159db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img9.jpg	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\Windows Navigation Start.wav	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_05129292ac22f63b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-whhelper.resources_31bf3856ad364e35_6.1.7600.16385_de-de_992787fdf80a08dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..rectinput.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0429edff22a6f4c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.DynamicData.Design.resources\3.5.0.0_it_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-advpack.resources_31bf3856ad364e35_8.0.7600.16385_it-it_3a81cf2d637ac8be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..iagnostic.resources_31bf3856ad364e35_6.1.7601.17514_it-it_cfbe612478d15836\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-pnpibs.resources_31bf3856ad364e35_6.1.7600.16385_es-es_574d9547b649a60b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kn3VIGskr65mt7W.exe,0"	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX\shell\open\command	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX\shell	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX\shell\open	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "VTGETHGCCSZORMX"	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX\DefaultIcon	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX\ = "CRYPTED!"	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\VTGETHGCCSZORMX\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\kn3VIGskr65mt7W.exe"	e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e24b89d0a3ea99f390d038182f6acfb1_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
643B

MD5
6f94726d7b1535e48d04e8a99b1e7c61

SHA1
22b1b0e3f1e37fa207b866714be0f7a68fb24088

SHA256
908c824ccf1067b9ad65502442b39f06bdb6e372eef63770ff7add1e54500757

SHA512
1eb78b47be1a3405b6af2152551f28985ff1d2bd073f9c9c9fc705bfee516b9a16505a873d3bbd81bf61d045e4815230ae86437c0d7d2c6151f1e547252f9c31

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
57c5303a82c739aa2bf3696a78cf9e04

SHA1
5eef8522910390648691d70ca1888e1699c2d8ff

SHA256
fc157b8db62dc86a8bb93df9a33cb5f3e39d17c52286960eaf9c42a80669798e

SHA512
eff6890655321ecded2f397278ea8679a96c3f90bcf288d252b0cf77707eddd2e4806b3ddaf02b823103c6cbc1ca6086c0cec82e4f63b367304c8b699b39730b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
c806f7ef506802c35ecd71f0ae3ade98

SHA1
73f202b1fe3b53cc1e76e229b35713806a432f66

SHA256
55e75f9e6487b4e2738754a8cb0eed1046035d8ffa27380630e66e3070ffa4f7

SHA512
97d3ac5866bfc47549684a9bc95f071a6f9cdba44319bf9fe9be7e2f43cd47fd8b07cc1a33754f498a9401b99777be32526a039ef84d38c0364ddc15cf13b79e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
20ac08b0a8594aef94e4afa92b3b2fc2

SHA1
149e463ce0ce1ae434dd5f5d669b6ce2ffc02d26

SHA256
d7d5c8dc9b400fa852a2c96f90404fc4202006dcb35adeaed8e3c807479c1f4e

SHA512
1cf8094c9772e79bf6fdb02547a183017a2440f946ad524f15d4a3801f75d0b9426240ebacd2e7629427dea96449c7f308aecde9a52b3091fac12c5be7c8db89

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
9679cf1f19b730a8b6151157f2178ebe

SHA1
544bebdc9f0259ed3116d6698bacf1a5d900d4d4

SHA256
9d0033e6ed06d9780bc36ffea0c9e3679ab91773c4ee2d4d7ef16d101594285e

SHA512
99638ae064b52f2d239666515810e6a9a55ae740a8e9f05a4b3867e59b26ef8f54a665fcf28fc5d8bbc6a71120ef7bc07933b160cd2f097b672ab6eca63aa1af

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
44c4a440fc5b8218503a76640c08f388

SHA1
bb0bc9a2d4bb3ff92d5fa6eccdfe6e4511b28945

SHA256
3fd55e1b8e20b990297e2b0053ddb880a22d3b485bd8da5c910aeadb40e52d9f

SHA512
4a78d8a32c14f14f01e87f60b65e0e09bc854572b366ead13495080042c18c517805e45a2129b39041209fa0874d589499780f3e77d608501479c5cc11cb228f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
36383ca685ee47e73eefcf1e312a0bc4

SHA1
80a6f14aa3619eb66b96a71e673f3d71792edc59

SHA256
03f1b8df9664313e57eb8f958af56baf6065ffe717ef84ef549ebdd1063c44df

SHA512
a5f143284ab5f378564404af81d85b90d8886c2dd06cd93cda9825bb1199be202532a7187e68421b25420caaf46d8258fbcd938692c02292507a343426924c60

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
711e4dbb698791bd74c69f1cdc93915e

SHA1
5bffd7b15cfb3f1891e9cf17a8767fd068427953

SHA256
28c89ab9a6db8b96832e9141635ad7743029056bcd17f838d477a3e1ad730b05

SHA512
ff5bf8a3f649060eeb7b95753085fbe4469965ab628a8ea3a736d383f8afaf5664d0a0b19142c4e5e6e12db95b459f4917b16faa7dcf92058cea8e6407313ac1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
72c6889299bd0d2efee9248e461a3732

SHA1
52d33b9c36f71c1a4ecf5daa92a50d30c25d2dd9

SHA256
fed8f253ef16b9403f52959da67fb8b4f928301b854d225aaf668a372cb6fe4b

SHA512
aa2369be7b5212f2d32824a60143c53b1b44fbae8c6964cf0c32d0055030799b9328036cf87bd63d102f739d3c67b419d20b001f282bddc3a423eecbf3cdd5b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
83bd89dc73a8332c7d5a71f022fd0f8b

SHA1
f5067b2edb41007755469edf99cf894a7e603196

SHA256
63811deac2e3b33c163961ca26180bb0064ef5ec2c19cb7ad2883d281daf263a

SHA512
efd86c59bbf84d13a3b7d849f056e52956e7d1a10349f629b75219b65d769d739ea8876699cea05ce0818b05d0ef18f74a9b1dd923e149fd77710e3df3e5948a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
d2aaf895fa9cc615254f1b33cd11b1b5

SHA1
364ffd052d22f39203a871428f662f6154e9bc41

SHA256
728c53de6d7d6574d2206c604886a440d9c1a5a2098b3cdb80c0737996a2c2e3

SHA512
621c207382579b2d5021f15d73fcd9781e32f22e4269cce834e4031d121c5828a5179791c4b7618d068579fc0e6311789c621c2c3bd19e49212f18ac6dac22b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
bccbda4ae7afd1775d18db719debcf2f

SHA1
40c4070dc6d9ff0f3bd0600a3e301e55b98fd1f1

SHA256
fefcf098c8d80836a5cbd384dac50504879d527020fc4dc93b2ba3c9a6ee26f4

SHA512
3a06b7021bb8237a6a3fcf71ea90c283915f8c5fbb7ad59bc49602d10f49b3502de1eedc28cef925db0d689e017404377d2c5a4e5f2aea1dba8473540d4feda8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
7e2f01ac0d7d803a89415f72ea2aef86

SHA1
f09a767216384994ee3a5d8ee6ee91583c6b593b

SHA256
ab8cce825bf2a5ead8e4b7d087490f5f35cfc55270f1e5badc4e92d93a633343

SHA512
f2ebe566af5d3a94aff6b64694642f9960b7e3e58a4306ce85d0f7f49da318482750e345b95447fd0f6ba93bdddb765744c02d406befcf5350b26de6b3dbcc20

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
33b02fa8dc4cb0ffd6d425cc4cf33e2c

SHA1
cf5cf3c42499cb9ebc3ef8e2788faaf168ed593a

SHA256
d5abf0762449d5d3b511d4621022d8885fc123a385aa8eddd988887c42b7a18b

SHA512
68dfd1bdef255af35664ebaafd77dbf3fecb17f5557874d2cd6ea3930657e5dcb42da135b0888fe8680a934f39d077e67ef0fd8955f2cb18a51c95958f06145d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
e4786af5315aee930164d5e78e7db800

SHA1
d1c05aa1464b3edaa2a85ba4282073aab7853d21

SHA256
2b5aff949c473491b7697d1f58a0a65b45d34315e516a86508deb7e1e90ad852

SHA512
025b1a946d46d98daf3d485e1998be2ddf565a353f1ad80a60ce28ebfb848bdb5a270813ca0a520d8a6055a09464bc557a8f462eacb71731bd6cf4efb705586e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
2289ad6bf7958b748be752efab6e52e1

SHA1
c788ff83c0a1d55c04cbde5a21e6940487d17176

SHA256
74279dabee2adc36ea1591af8b1e2d630d7e7cd815d7cbd0169f24941cf2bc34

SHA512
fc03fbb00d00b2d770211e55fce8f0e96629abfa344433a66fb0a78439b254b14b119bac76580a490914c773cd2534623662bd0c0b80cda018f197e7b8209959

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
f06b1a0aa726276f62b21cc24064ab66

SHA1
e4e8ab8aa1f7f3f5001b1135210d55bc3b203bd7

SHA256
9a24d6d7f796fddd4cd02d7aa8dbe4c48be8a73e65b3a29708ce11878b18f765

SHA512
44c10980e035806c9ea25abfdca6042ac55e3eeda91134eaa8ada9dde13a0cf1a54099ccb5b9ac14d1f907180553aaf7e1188964541cab74b2398b275577054c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
9429ef7ec7666d71d9e67220d3fcf416

SHA1
66b11a6b456a69182039ed0e91850f802ec27154

SHA256
fdfeaef2adc6503798a859664c55383e8680d62f466df43a24f04c0488b36029

SHA512
f29e2f9b95db7b07d2612f9a541298758ebf6f636a551abe6bb88f470e36341ac83705ec7d834ff400d7c9c6bae06c9e85bd57e612ae65d609d0555478a75147

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
6df7948a283d7380eff47e5b94355f22

SHA1
917d53921571f9cf87d3327e9d214ca906ae2841

SHA256
0824e40344f993b4a7ad071a260f4ec2b4f06eb6b0becd9a97a2315e854e6770

SHA512
425e4a1e0cf868ddfdc35a7d30e183763498503afbdcde60af0900784061af0dfdd3847b00f7ad98b0860c4f03a90af4d46db8e5fbc6ed3aec44fe736d9cd5ba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
287095c7e9c84dfb6d9bfe920c4fc6ef

SHA1
ba1a5c8be07ccfa7370473dda67c1425c1c70a13

SHA256
70162ae554991db8900f3b3fa21a48eaf67c592f6726df8406f132af9954e7f1

SHA512
964a0e580a0bfdad20062d8fbbf415b9b40e818b18d67cc9e042dce9a657dd8733ed8c7db3ac35b388e2a18ced7070079b5c60bdf101c9b79d29f414d0e1ed07

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
178233d842d1bce1bbf5870588011aa4

SHA1
dce6dbd1f64c96aaf022faca0ff1e67ba25cf84a

SHA256
4a27d96c7c1763e6be70c6fab6ad3c85c6a915bed3a34d9877f87b7e9af14554

SHA512
ff988fdc15c0de9c447d1c3a9024ef456504eaf638389c5815fbbe22b47467663f0d54468346a9993dfcc67432f33ff92c4190ce894ab1aab90c46c0675924bb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
12cf7b8db9a11eeff37fc3b193e8448e

SHA1
f814fcb6fc6bfad5cfc1eb3a3e96ef073518f8cb

SHA256
db557ddd33d53bac0d922c038cfe93fc4c61f4b3f3652328f9dd485924e40f8f

SHA512
ca5f0393bcc32565396358d5ddea91088cc2a9bae3f7de8aecba2c2d04cd8ceeb53a59bd91ca8626ed7b5d6eebcab3c34fa9ce57a0b49bb8003388ff1f22a553

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
b390a361f1c32cd00e847e07f4e49791

SHA1
7de9fee38f1b1e466e9db72b3a4a5acc34a6e00e

SHA256
fedc4d6ce49837ee48d34a54965615920dab8c82ce65fe3cf56fe0d697a0bfa1

SHA512
d6467df805bcb2881e52f6549a2242d71561d7a42b984a5cb90344f30f0edcf0df8c3946199046ed3296b11491c8f9717e4d6346952420634a4a7c9f84ea2b11

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
3b73a882af778af6f71d2a57186e4f48

SHA1
694eab3f19721c945a66ac3f67c86fbe91bef867

SHA256
0b9c81aba7e46ebeb4b41bc07897f7e87e59919ca55cbd32a8e35adf3c605735

SHA512
1693211c8fde28449b72bb4a5657e8ebf734967e516b7385386e0721d031631e63e086ff9588594a28bfc4fe1fdcc1e2b02e8cea691df8d16b65fd0df1fd8dfd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
8458f613577b1a294382b2ff749948c8

SHA1
5bc6d92fc421b4eb27ea501f3bac2df4801fe7e5

SHA256
6badefc8dc99143bdad4a6820889e7610f16c49979c69757d9d2114d5d88086b

SHA512
7dd8388391a135188a6b10f11b1a7023575d33f6a5b21cb9e968b1a04619fd3e43bcf4def6755952b8bbc18696ed35d0c5aa55a306e4ea00d51279d2c6545f1f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
05c9b25322dd1fd16529bcc3f7fd9366

SHA1
6078bde29e3102781eb14009e22235413d66dd20

SHA256
59add615cada3468e599f2bba37715c385dbb49d0bb49e3fd2599ea41f20f57d

SHA512
bf9b96b62fb247f2b2f306b0ee8d62d816a6a4272cfead925ecdb574b65137688cbdc8a39b926fd2253f15c26ccbe946e2e6d2afcd7373ff814ee31d5e66044b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
35617dcdacd1236374512ba80980cdb7

SHA1
94b45cb746c43f60108503c9979247b0394449c2

SHA256
3b1ffdc8edf194720126b3cf78175a1fd7bb1ce471dbebeaf2781740d450b33c

SHA512
77d25b72dc82cd3bfe14b44c311c6ad5a1d12e484ae76448b83116060851199ff944f25b332c5e8fd6cdb2a427ee8419bd9eedc7b19db38091361560483c6d1e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
4ddb6585d472e784e7bb35de74354f3d

SHA1
ed8edd6c705133699586b30be9f89a83d2bfa769

SHA256
3e09d89a5c2d7bca4a2369d5f95db8ae19b24363c21df8abd2d7bb9c3918f4d0

SHA512
7f1aef4d106c2d3769d90fd8501e216587d79213a1f8215857a5c4ce8fca0778dab555ba9b0e5129e264cdcdf6f768b03cfd71f7a535ef4d60588b7739fa06d6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
de8822b63d87aa846499b550aea30033

SHA1
acfe845144b43e5f5fe731e81835aa777f2c8c1a

SHA256
790dc7deebd2fbaca27ac5566c0911cd5a8b65c29470cbc08f4b225aa8c096b7

SHA512
b72e25e13c4e52f0e9a712b40a19c540457c674403a6eac749ac7ba4cf338469470fd21963b173f32a7b5e9ac9334971dfea11f36b83dfe018746c80ba403f9f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
585d4ca5f5cedeb0fc5e69b40c66098a

SHA1
a67035cc5c1aafb53e402ca94a066b368ee0be0f

SHA256
1264588062fd8698e1fd110fef8bf8fe4871bdaee55da61165ce0fff5d8db53c

SHA512
0f701445aad80b49a82e9fbaa4e1e5e376871e4064f6e72835a1faad59b23f3f2f6fbadb0f0312d86b441432990e8123463a38a0f02f5c0a430f110bcb1ff1ab

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
b36261ad7cd5176bca8e79f94b9fa51c

SHA1
44c46fcf32abd71ac3246bb669f2daa24de85227

SHA256
f16a68d9a84ee0a303b76f3b5388f4c0e732ef15752c1a959d7db55b2c9e1cc2

SHA512
2db459a40d1f24fdb4c83847d34458d29b189cc9e08a6dd3d53c3bd8d276b01c62b569e88797521ea28b210604844064fb167fbedae1597018b2203e63d93b03

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
11e764a31f7b49dad65a3cb4fe654397

SHA1
6cf0b155c23ed7de01aba59e3a9cef87a42b8dfc

SHA256
b1e5e76099ce585b6db334497412e63548788f5be8ad6a1cf810b1abc2ca6cfc

SHA512
283d094cbafd80c02c265d69a14c55574350fa35e526c930614c4bc4f1eefd0c1c4f5bbabf4e672c77eba33fafd7813836c28ef6a5f1ab1f12dcf2bb868c8a3a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
de73bd65d3caf0e47e92392ddc345041

SHA1
8c15f8bfa979201513355bae13f5e63f3525d469

SHA256
9bd6cde50a297ef64aa4725161aa90229773bcdb632079182501f15e88c1b435

SHA512
86f720c298a7991b0436cf9a792325df36ed39512d64a96fffa3737fcd844357dcfbacd934bef61465e4e37c52aaabadb266e9c19fc905414534d44a5a4dcd4b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
f5e9fe1ee2957c4caec41dddc78993c9

SHA1
8bdefa2fd5dc5fcb887127a042e24d7c2ab0fb82

SHA256
af1ea8ea34dbb7631a0654d1b534d9662da0595d18a5e665e3186f1417ce1828

SHA512
ab1ebcd539dd3ef8ba8f06339d91f4b06ddceb11990159cc8b399a643747a3e3dfbcffe3f9216bf3cd797f1670967836d20c41e381284f44dc24312333d2e76c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
2d434aa877e5c8f47204ffd12a8d0ef7

SHA1
903087f948382d199efb496ec05a2f13c8f5ea38

SHA256
060265ce1dcd4fe50c2fec838a29632cebe06cd31f91403fe718263018180547

SHA512
c278541a6307f9695ec2f98901cfa81a9526aa684e4e6d77df7f9844741516f735f3619f714bbad166d0c3b0342112423f7df4fb47d019a9eb5ac5f3b4b86b1e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
5b40d424c52b3128f9e7b7307d264153

SHA1
3685bfb4ba96464417ca1dd0867b0a9e3a2e6f83

SHA256
f70fcc13bb5706073b7f90b2f6c1e0fc826508c1df5bb90a2bf0c4a166f3df77

SHA512
66c2c779a9a99728ae5e294a3130bb139d55c3d4f09b52b553cd2d49a1fddfbc36bd0063505266fe78a3960667e68f497c88ff58c29c1229e9bb8ad69b1aa7dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
e5dad015382b745eec7dde07b90125d3

SHA1
41fd8bb71aafb79bfeca609648cebdc43274170f

SHA256
e98aa5d9d97df4a68ba6c8da48e72e9839ba6332534ab6dcb87cbbb7cfd3e532

SHA512
c9a5c719561af37a114220ed3fadf0a701683b28844b47cf82a9f50fb281f840987d4501b89371af830a1acf30bc9dca494985ed2363085ca1c216269fedad79

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
ac4857b878dc47e702f994ee7b47d30c

SHA1
ed34f322bc19f5d3b2a807efd1e4644acca122e5

SHA256
630f13099ea64181404e0a73060975908dc8e19cb4ac2d08e8db94422cccc63b

SHA512
ba96992788d70217c7de71463e298374bfc05d13edb48259da30b57d69e6ff8f4297b49ffa7a59ee0e717afb86058c4f1a7b1f4c6d34920453dcb954e44ab690

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
a47de85be26caa5ecbcc754a2e0550f7

SHA1
11102f0b704743cef06c4219e3877dca29c0ffa3

SHA256
cea78b4d33999135d675d1d972a91a902b53526c1a0538dddfe11b781db5dd28

SHA512
18ad88b62149cac410e8fe3b94b136e4156d600a700cdc3401d0344a4a156b0b86236132409969a3ffb877052ffccee931cce7e75f1a0709a5b682eca560d709

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
c7af15703823614ef6206c3259cf2545

SHA1
ae615538b36be81dc43f3f0379d6530587fc123a

SHA256
1a633f0b0b669040169e3d8373107c312ea223ec71d34766eb01faec99a85b66

SHA512
e820e84f508c76b18c9351e88f29cbcbfad5edd9cc3eb58280176ee74f628f77ea66b6f041a43d6dec58b7c9da16fbe90cf6e38570534c8bc47880049ebaadc0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
330928ec54292ab525e05f64cc061029

SHA1
95c9d4d0d7d379a1c27c2de1d702d6ee6f909b36

SHA256
cb4aa01b8c50871d06690972ceed652356db4c40966226e59e437c25e45ee1ca

SHA512
836c3eb119a536af15ece8c85d71b88d5b9474440300a86f5a7ef4ee8549c1762793c7215962959fe3a72cd9137b89be7eedcab976d4bf4b04b4d4231c766d29

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
eb58684b65681c8c5b73a441c50364f7

SHA1
6a7ad4454974766e3cc16149144664701df4cca3

SHA256
8e520fa5b2983e22be67cbc46faab97119bbf0c3dbc6d4c8a367ff6eab9fa160

SHA512
9bf78121319dbf5118674d92ba0ea3c6e1c1e863a35845be526513f9b319a7d2773ce376429bd05022ab8664ce039b8f6aa206da1049a97405801134956e1651

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
b86aec7be58bf9449a3d66dca396e8f6

SHA1
0ef0b90c50c709499528139d904386d638ae5d1d

SHA256
bd187ed61c43f904f05c0803ce3887735f3b613db95130ce97248f819045a3a7

SHA512
0e5cbb2619c8a2f2d30abcc59924cc53bbc3b678261e251c6bb684d495442038086fc2f27f41ddc361b73b891cc74b773a97aa96e446fc52a2815ae249b36031

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
954d06e7506def7c0bdba884a32c9db7

SHA1
8624d4ecda3fa3ba3a7b76041419d0d3bfc46441

SHA256
3d4f7e3ab65a6cff524810eb21a0e6dc7a8870ff15a4639c807e2ba847fda8d7

SHA512
79857df16ff6f29feed249a71f370196695de31435983e7e4e8e001386dcd757ca11556acdbdf5c73fc104b79f9275591d67547366fe7fa3072945e1abf95eac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
78188745fa211b83afb00ddd65bca002

SHA1
e47b3e4e611e916bd36b99c0745d5fe9be79beff

SHA256
f2ae286f9801a9ab45c6a8480d17eddfd41a6febe33ca0281c7b6669d63518e5

SHA512
940d03959b96f7e17ffdfd4c233bc9d211326f65a09cb5260fbf53bc6434378ea033e6f28c669d98d68bd2e4cd0df0d8a0637fc337fa14d82a0c0e02b7c5eaf4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF.EnCiPhErEd

Filesize
899B

MD5
30a84b71b3c3422911afc8a88c4d017c

SHA1
91c965a97ffe28853f181c884f0302e85e0466cd

SHA256
8384fd523ef86765feeca43d55dfb16816a928e84441b345473157bb7f588017

SHA512
37b8a825006f56caf890bbc6f3d6401305d9118b45aeb14a406738798084019b3500ac9e0c0d5367ee23225168d945ed06f22528b5547451f58b83f433bb0758

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
7ca47f1170ffba50e1dc035b42fa3c40

SHA1
b0694a988d9bed37a9507bdfe545cda462d4f43b

SHA256
e1b8becece0535f6b236c7f7cde2199c8c3c45b3756fc02b56879df63145fa4f

SHA512
eedb7530cbb870209e0c3f1850eaf58279c04635f06a435dbbc80d8ad91becade72cf1993d7afef5c31d8493912c050946b85b86209db5553ca7bc7a3c5107bd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
1b07e02d628e4d5db3cd9e1be10eac2b

SHA1
d6d2e1cddf47f7c835bb9179b0a986621e27b3b0

SHA256
284d6aa59320f1c420d8119931f8e967c3d7a502ea3806d0037cc97c5e37319c

SHA512
23abe86877f19d542778ae68c597dbb8f5eedd9d3c1fa06938b54fa9c67a57c9e6e0f8e6018dca961017fea00c0d18482e03975dedc200ebaf639baeec96dcaf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
77b0dccbdff2ec3939c54c8258938189

SHA1
d496f6f4172efa2e9acc4880216a1d1eb5be8e04

SHA256
c37af343cdd62b070100799c6dfd62ee92882006a2d74923a309f02d6000e83f

SHA512
848b20ffa37681cfc315362603c7f3b87388039fdb88f58ce7b9031e9437978294d80f1e2a1c71c54ce4e6da76ae992fc0738539c7a820c20a3760a1b4b7dc29

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
1228d1f6dca627dc91208e3b3b201a7b

SHA1
9ef1b42fe35d4948dee51cdf24bd3b1ca8fb9f20

SHA256
05f9860b1d0ad3d61b116cba8444f5b95e9d088e79b9d5e2d2c128299b699839

SHA512
5a5007f6528593868c18df26d6b9a32cad60f78a513f740e00e653b7212c5795885812e9d55e4e01cbc39c1678983ffce94e2381d932d2ee9872960a8b333b06

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
86edc71d161c1ffa100c3ade6c2a6b72

SHA1
bcc01da194cedda0256501673a508e7de859f92d

SHA256
fcfab63bf05e27e8b713373b116866f86d8b558e944d40b8b11dd42137f2eb6a

SHA512
07c1092d3937288caae171f6d89e5ebfc01f496dccaa6d711fccd760f4f9c2c03a0e77d06f0cea5c493c51dd520342ce27fb987f255f866f7b9637fd18bf12f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
e058dfebfcc6887e37ad4f563ceeffd1

SHA1
a56e88fad16e0b26406cdeaf334b8cb5839d3aab

SHA256
571cd20f571e31cc615986d87d6c0c6ec486791481d28fe63a4985c8171d1b18

SHA512
82cfb540a2e1ab0c6ed99bdf54982536738bfee18569cc6f880de8283037bb96d7e3e998c7fbfe62e6ec456bd1a137aa00aeacde67d93da0d2921691f551f2e0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
f53edfc9f70d40bcb3115e6be47d50c2

SHA1
95e2810b1861cfdc7338dde7e6361b5b25ece362

SHA256
31abf8807a58aeb92c6e346b6156b7a9ca5a1dfc1a9b1acfe7ee1c48b0189577

SHA512
8e83a92fa314188216aaecfb30af83a753965d0109df8f9d9cf828ca54cdf343a7fd94a5d745b7589f53ca183f49ab5d1b6081d7e115a52b241c2f71ba3be062

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
18469d1ca7b4f6f8d57683d251410d1b

SHA1
b6c0b10f3d6530037d37159f3a84b77ebb7757f5

SHA256
3b73b592cc52a1f5d3f7d954788897c396732603b37e667d9249a41ad9b801f0

SHA512
4153854749f210c89b45d971d3821de3e8a23d78e912154f750a1cf517ac6b68559d656e9ae77a27d11ffd0ef0ff0a10f616189aa5ce1c5966fbbbd16270bc41

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
8228a9952a219c2b3fff1ddf27023e31

SHA1
80b5c26ad079d4d190788f18ed6bbf07d06fb357

SHA256
9036d0378c6271a64627fe6e30254f7d7d9e8a374a2a2772ae07df9574bd8327

SHA512
44dc103f7b4075301388eecb661e334097bb4e9f14a4e7f558cfe2b189bb7f8bc9939544d0dd547e54422fb0bbf1014af2ad93f421b93ff21aab7189617d888f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
4319751f3e118f3c26ae2e7ba8ed257e

SHA1
8bb67bc42243d77eff8a3cf527b916032e2ca7f5

SHA256
74b9dd366f509751f72fcd20304c28050646982c454170396a79d332952d4f0f

SHA512
c24a33ad7737d346b754b36f1fd428dc7a5c5fdbdc2b5988a1fedf13f90b0bf94dc4d0a03aa90f93d653f97f9a50f91caaab6778589b98648753bf36843f02f0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
b32495a2a2abc54517af02668bf1afb2

SHA1
6c2b965c343addb9db71367dc59bb651054af3fd

SHA256
36f3cc1155626fb1f7fa4b3777a39142cb14cba45f7bee27c72dce968f123b51

SHA512
2b84418794df8d6a39cb50e58475e0196f60039bb8c25ad69efcfb70b153b891107600fa370c20890b156c6424102cdcf5147d91b7b23ce49017231049d06ad9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
ab35c870003457aa59864fc5af747ed9

SHA1
8d99287e80a9c026f0483d540ef2618bce907383

SHA256
690ab784ac05460cc7f617dc1cce0fb9cfd3fa188923922cfae050ab6211751e

SHA512
8ab140947f225e100d72f10534c6d50eef53576db7f509812b08216773ff808511a69cb766c3e4ff52845c2a4146df182330f4616358a739e35db7c22b7c235d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
7c213a661084d6f99e4ced6e833b99e0

SHA1
afa4e448b7334e55f43fd4b79150a1d772b7d9c2

SHA256
254d8954e81b114c641cea43730ac0fca9847801166903fcac1eac7e96903e7d

SHA512
2254ad1fa85bbe62924272369c982a557cd535c9de61b326421e7b8b4e375c53f8fc7d59692e59c06a158164f4f89c69ba52b5e9a5d0b2726ab40811cc3930a7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
2274cf6f46026a2c8dc403d1758327dd

SHA1
20329de78424958b9cd15fea0e50efde8bbcab0f

SHA256
b86a28dae3cc01d475137fa38568e73a753fa58037a80e9e552f1a1644893bf3

SHA512
21178dfc56204548f06b0f918f82472e284a97822064b189be7c2760c0966377b37b279d5a663b799d6969e0ed6ae16d4a7e6fcbedf1ab419305294f3487b390

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
adad8d0dbfb66b557a6d31fc17ccf0b7

SHA1
d7e592bae88c4aa74e050ee8ccb0675d370702bb

SHA256
2bbd1a56398f6964a9d4fcfdae5589644d7e474fca347adaa29341abda00e0ec

SHA512
78ab9ceb8d16b26c4c84995326ab6478910d396bd136707e62b315ce2ae8e78e7541a591d11f9912a3ce9822147b01e2f6432e148db814ccf80372d8ff0cda4e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
daa574a93c546e4b0351e25303d8968e

SHA1
ff0f070484e4ecc290cb8bd40ea61f51dfb5709c

SHA256
25aa70ac923907fba728c74a7000b3ffbff3eff608a7eb0dd9b872fca712eeac

SHA512
b2cbcee3f5e6c143df7a2ca2ef3a78db9d80c71ec6174f2dd10af65ce10ae04c75462372f2ad13a391030e4b5083578e0311b823a5c460fa52ea87daa9942a76

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
3ecf5603fb2a051702ac8ce560ee5746

SHA1
734c3ef500432daf3bd28900c8ea2b54421f2273

SHA256
3efce90675c04b52515a9205948632bad533620c98f3ec52f54f810f8c59705f

SHA512
fcf5867baa3fb7a1eae86c48b402cfdde01d2769fd32d768df0012a7a80b34df1fb546723f1e94d58b8689f4453e3273c105d8f86c03f47577bf90b71d66fb89

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
a221c7e08987e23e4eb4f854775f9f12

SHA1
b70bf7a85f1a1636094353207e3d7bab35002dd9

SHA256
949157e79fa52cf2918c5f550f1c00467b5d8da86f927c42c5b36706e11682b3

SHA512
680a7c58665dc1de8d0d8eb343750e7014e6ace01db35599ecfb77a3c8f89b1fa7e84081ef3eb2330afca183337ba1828217be5d267582c15eb6657a1451a817

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
aed8a7f5359e92b1c1292e9f7f17d991

SHA1
8396ec6c3045ff3ae9580b07275105d07a7c5fb1

SHA256
49d47b4fe1264e27a83033996f1dc1e3b1a25f19d73ce6388caf7101ef2cfa14

SHA512
ef88bd0ed09718c15e3c1b110bfcd64708c68b8ab87ac4db6d94958bc58193d1231ad1ccae12d65627583e755dc2e1775b0336969479916920cc2436ec670865

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
ba6f40b1ceedc2fa7ec6cf338a941c98

SHA1
f19b567e4ed6b498034ca95e2b66035a3123ccfc

SHA256
cab37d835d2e0a3ada029e41e23a487e3492e5ae1e056d3b1b373f28b9be4ec5

SHA512
19fd2d28d8df617d78eb293f4a8c56181a13b1573a708dc071bce3ac2610f39f31d586f2c22c8fcada7cc206e39dd1eda73130e9a29312c26f321bb21eb2a52d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
64442c0fcb3d46fdc15690811451ddf5

SHA1
600598d05f5d7e3aac64a48bc1e6397d7d8aeae3

SHA256
744f270b8142e9413b3f7dd387b62d4ec1641698d32d34572f4abaf115514839

SHA512
a6d5460512c31ba12b5bf0948b893f34f2e725c4766882d4f5c0894a397aeb549c6577d2db61b55d93fe2baa2429cf26a973e36d2fd980aeb7bf30dceafb2a10

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
b945ae34fea9cdf03eaf25ba43cafd28

SHA1
ed1ed430799a95c8c5092cdfb69055f2ce6fa031

SHA256
a0afb9d3406296336040c6abff95cf723eaeef61d9094ba843f9014efa18f7c3

SHA512
13093ef483cbb54474d0330c08b5080ec2bc7d740a4f5a1138cc029c31951ac3d5de3205db9f35cb608933586fa839d9ce8a715526b71f3377c18fb3d4a3acc1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
17606d156bb2eda1fc95b4bf77fada76

SHA1
2b176da8f0c833417d6e85aad5fd7346a0b945b6

SHA256
f6a0814312bfba2404746b27258531167ef488ac78f8f3d9aa5d8b821323dfe9

SHA512
aac53d08508236e513d63e1c624664d035055df9a2d26b0ab01bb9e4dbb00658842cd053e6525a47153da04309f978327e8f0f6d9904eccba375002d9ce568de

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
1282222e90ef6557864ff5e8cb00a7dd

SHA1
a4478b7a5d5baeb56afc2d234abf3e8fbfcb298b

SHA256
329e8f137110b6dd893132c3c11e6308df7d827c741cc76682325ed171b5d1bd

SHA512
55b892537e5184ad9ffe1d61454d7f0dcf32464355b2dfb050e07752529c40a0e61d837898ffc62874b777fc51a309e858484e2e651e98eda22f1f0ae8b1ab45

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
899816a010dee8faa8ecb7000c0ec2a9

SHA1
336e0a658172fd3b61a3585f39a9fb71499891eb

SHA256
13dbd7d018714a07334c0a07e842056d2794410c6ddc5b7a3bb2ce57df150774

SHA512
cc01130c3ef94955da144c8848c0a61c654cbdc07fc426a84e3420af4d38bc0715f5c3c3293d7766c7192a569d3ca9bb59aeed0d8d74856735869415a1fd760c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
10115085a08a04c1bc6414925c23490b

SHA1
768a8720c4ee22edfd8fc3a87d9bb0ff18791827

SHA256
46b647b95ffcb64b2ac355d0855252542fb0e2288f6285c1da50a18ec89ec65e

SHA512
cdf8a0df2b7298cf8db96e67075f1dc9b029806cdfb210bd1200d3994c599348ac0b053a985d546a443d8063a361d5397bded004e17a111e83e0006540f5a798

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
0de357892ae2216c4486d7bb7320c5df

SHA1
086b4daa1b8ba40eb9b4fbb8affc0a482e0684c9

SHA256
37af96250bcb92b01d736e9d1915ee11cb0e215993e6f36df2a3a6af8253171d

SHA512
74fe735a6bf94c46b09bc1b762e24e3a774da0f0e4e135608a1c083dd5f788311d6587d9364ebb2632d957251aab0854fca78814f4c8b6bf4e690c67c61f4768

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
9bb1b5133bac3fe0689b3d4101d741bf

SHA1
c50a786bd1af346287ea109a8501bdcd5d39cd34

SHA256
cde720379a80fca2a166442ad7bc8338b0154936dc93bc342e8193e5ec87d1c1

SHA512
08f842d3cdff12270f7c5a7ea486882ed377708b38abbd9743cfa30e187e208c10514d5fcf33c72d1bb293136325982f64bf110d07fee8e20e36a7d03532a2c9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
4ca2682bf28f7f68ba983e30f8133584

SHA1
9da8b61581690d5de9ab5fdcc137640824d272cc

SHA256
d48931c749786f7798a9049856cb2415fdbd57f0c322c06921b5edf2b082d271

SHA512
6aba2b13a3028110a9393876f10ad45e719314019317e9834d9dedda513203da677eb031d7999cdb8bafc5fb0a230d801e96e78269646569a06ab88171e4849f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
bdcb274534587c0ff3ae023b20b30498

SHA1
689252be76cf6792350c68db94ba3d711e4907fb

SHA256
8110861dfba176191433e1070344288c3451ae6f6e5ba3fc96c2a3f381b222c4

SHA512
6dd6d1ed51a189fc7a99ec5aff157d6da649837347a4dd0103250f232b4655d033f1e1d90fcb2b75317072d42dd62aa852bcebee04bd6094c79bc807e7748e86

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
d63c78054d67371ccae839804d659bd6

SHA1
84439cb69cea1c710536a5dceabdfcb3af4cde55

SHA256
ac0cfa0de54fd2f0f3dedd99d3bbfb52cb29f3977235646c199a3eb9c6b646e9

SHA512
2ff2e275ea31945b78c9eae3ac6490f0e63483a413b4bb81d849c41a0e8be56ab692ffdeda2d85438a60fb99ee11cb2620aecd55e4057cd50f8542d382149656

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
dc05ff1ca60f4c319bbfaff354ca8e5b

SHA1
2f1ad092e1a4cbd0fbbd71fbdd4482e905da27a3

SHA256
b15211a887bf32e570b06a6e078029bfc66e375d289bf43563c7d0a75f57bee4

SHA512
7e7122d21f4ed09868164fef46c4036c9f635eead412c487d6c87ac561978043d5423caf5aa299e65d32ed5eab424b29e0a055e53540bdb97bdf77d1badc752f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
360758951bfcda161f1f13890815a9ea

SHA1
71d8a6d63e599ee69c21753537cb6a828a11c309

SHA256
b1512a183504219ec7e63107a2f340e5e290edeeb1083ec40af34b048d434ebe

SHA512
26db6d66a249551b1ab19752368e091b8e17c7b0b755eaaa1dc15cfe3656be5ce6bfdec02326f75a4cd312a82cf49c2a18d76ff41ec99cc0787bfe8f6f069872

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
b6e28261670dbd02a82fb5846c4d027c

SHA1
2c8ff7d26321f78871a04324e959827628a49331

SHA256
7cc155940cd43c328fb79d9ed0fe1fa82577fe0aeacc914eef0516dbcd1f5266

SHA512
f3cd8ac3b2f2cd86530218b74b0368a17d48413bd6b5a550ecb7df1b4c3f7014538c6fb470389087bb17a294f0db74af0ac8cd2c8262a4c12989aaaeebcadc00

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
a7811e78bd54c997cabac1e82fa745f9

SHA1
c5277e9dbf47f06aa635dc1d87cd2cd43f2c8205

SHA256
7a4eed3596efa58d269a00b93fd8d1d65a0bbad38b1e24454089c64c3161f103

SHA512
ee70c23c7d8caebf9e6b6c135a9799771f38330561e32f8f1505a28d8e27fa5cbd8e5a52f36a6b176af42ce62ab480147abf3e0089485e9fef583c9d6847fa8c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
9b66fa58717b9e191a60f39c49b846cd

SHA1
af8869b9879a6b65e245304de8f4619d290dedd8

SHA256
3309c484d2f69b90f0c903caff4d6bfc561d179d759f7805d1e7174403dba812

SHA512
eb439b39408cf82934310787aeb2c12ba8eb7484df079348a0a72c3c4afa2297976e4d9fcabd05424834626b967cc9090e65daa29d6f70e4a90874465038b193

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
75c44363fc9c6806aa36f47e80d506a9

SHA1
a1f770ed26f465fd891f7aad119dd9db70de98d4

SHA256
0b6e799639d0b5628830733d42bcb84bb69dbd5b19f18be892ea194a29e01ea4

SHA512
d9d3622007291f5a54ccdc40d1c23d5d143dc617ca027a302c255866a2fc26b06aab9b31203e9c114980c7e8fac7f827918d10a09902ea85a855d4cd79009acb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
8a2bf957192f208119ec2e00ecbedaca

SHA1
58dfd22806f4876a56a1415c28cd846e4bbf5854

SHA256
f0d3e3e3611504ed5fdeaa753f72cec5147001e658047f178e671e7c20bbdb2b

SHA512
b752ba4e067cff652e39819fc6f0ed6ef6fa0667e8f99032502a28cb8aa4d92034bb38c608bb214629f8eda05cdecf997e1cc6ee039422767b0347c4920a20b5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
c031ac76d2089c43c10c2e7ac9ffd02c

SHA1
133f873e4f1cac077286fb3a04325d1064b3136b

SHA256
858c73ec62760b639eab7d1a653787a8f6bb682a6a6ab548e282273c85f4a5de

SHA512
97686b00fa0f8680c5baf80db8dfcb500f192b691893a983457b2af61c9e943de15d09b6dd8aa14ec532ec1fc00af2e37fa37cc326578a621ab5383deb3bc19a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
5f96915e7e5da75ea84efc58df9a454b

SHA1
5be91368c1ad33badf24eb474915debf8ed552ab

SHA256
cccb6c6f7de37d1ebec7e1a3a74f1e4a5014e5e217326775ed26b5052dc81333

SHA512
7a08c3a0661266b8753caeb16c4625701cf107262f8ce2719322bb1453cfc589deccc148d6151cb04fd2f3f05053028d29440fc43d54467cf38707757dd67c3b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
0a176e39ceb2167c8f6820fd09a70235

SHA1
9fdc2cce0c6b7b9c34bbf043d32abbd80888fa9e

SHA256
631b881b2be2b5f0bb8be4c93d2049b46e39dc1ffe5c970cba8e9343ec69cb93

SHA512
09ecde6daf0bca47439d3414e6780e54ec7a4521cf66f9c45f38d3c4eac5a2fa81893c6d1aa9c56d68a4707ac83ff4315056dd455dc2a4427d0f9ed3f8f642ba

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
2ac1bd53ca8661910eb2ae84dfd77170

SHA1
a4118b455ab12a1448d5ebe75f2322d7b7d27e23

SHA256
b32e14964d122c398eee3139bd0dec33bb8aa3af92e14c0f7ac70d14caeea3a3

SHA512
6c95097e9f8f5722252cf766df76d8c718eedbacd854fd5a31be03e4093e74076bdc712b151e5eb75bd68a8fc5ba50ee102aaf1a804bd3bdaa39031d74a14499

Download Submit
memory/1908-7782-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1908-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/1908-9194-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads