xorist | e60efb4e13d2810704f408c08cb38c77ee03537fe22afac654cb083f1549a642

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
12-12-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Size

7KB
MD5

e846328e279ecbd45736abc229569c87
SHA1

b1ae6a995d31cef7bceed2a084df710eee29c94b
SHA256

e60efb4e13d2810704f408c08cb38c77ee03537fe22afac654cb083f1549a642
SHA512

5fa4233b6efdc4bdededadd099f73947035d8893ae3eea8769c683021daa38e877d8c5d00c463f6b29034fa0bb322e828c98ea2ad2dff78cd2dd966ad7b63abe
SSDEEP

96:1ZXvZhl8wdS+r3yOYW189fTwUVF0CWHyjk8P1LOmjXfihExaLm7Zpqcej7jRmW+5:v/zdrr1FG1WDCgmjPZaKd6XMVaRMUA

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 5 IoCs

resource	yara_rule
behavioral1/memory/2760-8839-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2760-8840-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2760-9175-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2760-9176-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2760-9178-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2205) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\W2K2m3v3gt46wif.exe"	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\migration\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_While.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\bthpan.inf_amd64_neutral_024281c0e4e954e2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netk57a.inf_amd64_neutral_8b26ad5d0cc037a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep005.inf_amd64_neutral_f2fbc5759618d8fb\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\0019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pssession_details.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_transactions.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidserv.inf_amd64_neutral_f2223e39f37c69f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnep304.inf_amd64_ja-jp_27c560b15d9928c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_preference_variables.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_neutral_e77f438012239042\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmvv.inf_amd64_neutral_14cb440c800fe9fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnok302.inf_amd64_ja-jp_708c81a8b0ad8846\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_objects.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termmou.inf_amd64_neutral_207a02df8e9e6552\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-ActiveDirectory-WebServices-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wialx006.inf_amd64_neutral_ae607a72b46f9cfc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_modules.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_requirements.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\XPSViewer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpin.inf_amd64_neutral_2415474b9db0a888\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tape.inf_amd64_neutral_c6a6811d3d827dba\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr007.inf_amd64_neutral_442d902f3f3dd5b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_do.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_aliases.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmaiwa4.inf_amd64_neutral_6e97842bb8d9e6a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\nettun.inf_amd64_neutral_bd24fb174fabec97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx006.inf_amd64_neutral_cc725426972d1293\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\Documents.gif	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\OEM\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl004.inf_amd64_neutral_1874f16002601f78\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmetri.inf_amd64_neutral_f89b8a357327f615\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_neutral_23613e3dd9401f10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\msclmd.inf_amd64_neutral_413d17c790177eef\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Setup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\xml\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Command_Syntax.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\netirda.inf_amd64_neutral_93a886f96cea2847\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_try_catch_finally.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr007.inf_amd64_neutral_add2acf1d573aef0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnts002.inf_amd64_neutral_ad2aa922aa11af2c\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Language_Keywords.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_join.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-PerformanceCounterInfrastructure-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Path_Syntax.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\averhbh826_noaverir_x64.inf_amd64_neutral_2fe3b14136d6e46d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wstorflt.inf_amd64_neutral_3db956c41708f7f5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_logical_operators.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2760-0-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2760-8839-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2760-8840-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2760-9175-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2760-9176-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2760-9178-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\nn.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\HandPrints.jpg	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_corner_bottom_right.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341738.JPG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR39F.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_left_disabled.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099198.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_over.gif	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_ButtonGraphic.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR47B.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\de-DE\settings.html	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0284916.JPG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\photograph.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\America\Argentina\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\THMBNAIL.PNG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115868.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15035_.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\it.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\spu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0177257.JPG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_settings.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10255_.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\time-span-16.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\ml\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099162.JPG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0337280.JPG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows NT\TableTextService\TableTextServiceDaYi.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR43B.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\de-DE\settings.html	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_gray_foggy.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Javascripts\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\flower_settings.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\alertIcon.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\PREVIEW.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341534.JPG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01839_.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\bin\server\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14883_.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR26F.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CONTACT.JPG	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\activity16v.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-vertical.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21390_.GIF	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Media\Garden\Windows Hardware Insert.wav	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ec4c8e32bd9a4720\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_functions_advanced_parameters.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..-binaries.resources_31bf3856ad364e35_6.1.7601.17514_et-ee_50bd07dcca28c109\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Calligraphy\Windows Hardware Remove.wav	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..mcore-dll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6440fd5d555a912a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wpd-status.resources_31bf3856ad364e35_6.1.7600.16385_it-it_94f9315bed0fcf39\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-diskcln.resources_31bf3856ad364e35_6.1.7600.16385_es-es_150f921fdd6424e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-vssadmin_31bf3856ad364e35_6.1.7600.16385_none_c453ab9392f73dca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netfx35linq-microsoft.build.tasks.v3.5_31bf3856ad364e35_6.1.7601.17514_none_5077bea082d2585e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cttunesvr.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4e7b462d2b57df4c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.workflow.activities.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1529190a88e68bac\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.GroupPolicy.Reporting.Resources\2.0.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..structure.resources_31bf3856ad364e35_6.1.7600.16385_de-de_9af21da7de20db46\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-encryptfilesonmove-adm_31bf3856ad364e35_6.1.7600.16385_none_0f3bfe2038024204\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..xe-common.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b782d21ffce64151\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mp43decd_31bf3856ad364e35_6.1.7600.16385_none_10281d340ae2249d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wusa.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_68a35d21564cfb41\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prngt002.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_4060ca3886538c9a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-s..ativehost.resources_31bf3856ad364e35_6.1.7600.16385_es-es_97f172a850c09f2e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\Globalization\MCT\MCT-GB\Theme\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..tional-chinese-dayi_31bf3856ad364e35_6.1.7600.16385_none_6052679946eea92d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-mail-core.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b55e5b1ca09e5089\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_de-de_0410dad38ea2e84c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msmq.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_651f2e372bc89b43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-smartcardksp_31bf3856ad364e35_6.1.7601.17514_none_b7f7d8e8e19ade8a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\000E\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-r..-resolver.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6081d77d2eb3dedf\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\btn_close_down.png	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sysdm_31bf3856ad364e35_6.1.7601.17514_none_c0a8382e8bdc6241\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_networking-mpssvc-admin.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_e57a584ae804b8b5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.nfs_client.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_9167a708dd169ec9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_hr-hr_caf6c1e0049b2c40\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..onal-codepage-20905_31bf3856ad364e35_6.1.7600.16385_none_ad61f25b00674077\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_de-de_2d0d87080cb9c10c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..n-clients.resources_31bf3856ad364e35_6.1.7600.16385_de-de_14f12ab5983c4df0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.web.extensions.design.resources_31bf3856ad364e35_6.1.7600.16385_it-it_2ecc92c6cf6aa4e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-cdosys.resources_31bf3856ad364e35_6.1.7601.17514_de-de_b9615ede3154164a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-capisp-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c6f5b12ff205670e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..lications.resources_31bf3856ad364e35_6.1.7600.16385_es-es_701a185e95e0dd14\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..l-keyboard-00020402_31bf3856ad364e35_6.1.7600.16385_none_89e5253262c1ff2a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msinfo32-exe.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b27b0a643b545c81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netr28ux.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8aec0349fdcbd611\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-a..wdm-audio.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c799596f74501936\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\inf\SMSvcHost 4.0.0.0\001F\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_sr-..-cs_690f4f26ec911a81\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-themeservice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bd289c780c8805eb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-n..-security.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4dd77ce8a60e0e62\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnep00l.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_12272e88b3e66c2d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..mhardware.resources_31bf3856ad364e35_6.1.7600.16385_it-it_773cda3f2160c3a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-b..isc-tools.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_85a00075758466ca\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-sonic-tables-alloc_0_31bf3856ad364e35_6.1.7600.16385_none_aa70146e4305f280\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..publicapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d1cb10d32d0148ae\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.Extensions.Design.resources\3.5.0.0_de_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-adminkitbranding_31bf3856ad364e35_8.0.7601.17514_none_ed30b91fe51eb56b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-installer-handler_31bf3856ad364e35_6.1.7600.16385_none_3acf7ac36580942c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Switch.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-u..erservice.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ef3f3b3b9e7e8bff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-choice_31bf3856ad364e35_6.1.7601.17514_none_218cf07ba262766c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_Core_Commands.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_escape_characters.help.txt	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.Skaype agu1237\ = "FCABMLGRUFNROPY"	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY\ = "CRYPTED!"	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\W2K2m3v3gt46wif.exe,0"	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY\shell\open\command	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY\shell	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\W2K2m3v3gt46wif.exe"	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.Skaype agu1237	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY\DefaultIcon	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FCABMLGRUFNROPY\shell\open	e846328e279ecbd45736abc229569c87_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e846328e279ecbd45736abc229569c87_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e846328e279ecbd45736abc229569c87_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
287B

MD5
131bdd9bf2adb03023bd15badd3a6d60

SHA1
a6836578ada43633ab42012b0591c35bafbf3b1a

SHA256
976b2f53a7111775e6a78f0e29e2fa9eba7c1bb1397088f25fd007ad4611dae8

SHA512
b85460620a61753f8d8a9a94e4ab29a1e6ba88a12cfe9d965a707e7604802ebd5819790b48c2ee0c42d98fb49e3c74cbbce1a6a800214487ac7572ccc16e8fee

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
573d31af707dc2d2ec1c9e0d3b73aa8b

SHA1
d09c8eb6cf9c392d3f3e97484923fc1a8ce51880

SHA256
8b2376869b91357d500f544387d803e67e4f86830a58effc82e0166f50453bb1

SHA512
268c9a5d76a61fd2761f9226211195a6b446175bda04563d204efbc564f4539fd815ba0866766b6c629d7fc8df13c34d441d15f5f86a909df5c95393d5ea1bd0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
a5451432717f72dc4f2c49ee4c5489a2

SHA1
45553857d98bc2c7f1ee9a26a7e524cbf1c52282

SHA256
71b04e5ab531eb587ed4586d1b8f6c878784bfe8eb5a1385007c0c3f461c4db8

SHA512
d94fee0d5e8cb5713cd2a0753488147a6e85f47e396d22d4d5001e4853e64879f04d72fe054fb026fe6ee927f844aeae98979079f66a52c4b12b931a90efdfab

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
0208a18fb28e65286452aca669e6e1f1

SHA1
77838a4ac22624eb2d171f9f95581968a364ce87

SHA256
9f101914967f188c92eb32631d49a0389d24e42dd7fd6d85d2dd57fea922d0db

SHA512
a8268e66a7558c7f6d309288409105976505f0bdf944af8f4b206bde0b634486bf211fef0e03acd8275fcc1a76c23795b5de14167c73bfca160222058c8cd299

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
1e611a7c8168f1b0c1727d5cf41439b9

SHA1
975c74cbb2bb6e22aa5036a384d4f90ea7f057f8

SHA256
199943f19c551810c4f5b4f1cde2908b88ec6e21b531e491209628caca99d1d5

SHA512
072e696f8cd1ec672319ac79331b0ae705e891458b348e33ecc78b1ce392ad6eab79b0f1792f22fb754d66c8ff4ac5b101a7719dcab2cdf7aabf6e1f3bd44f65

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
0478648ec9f4ea5bf2449eb3ac670637

SHA1
4b6955e73ba1d13c53a9cee753bff20e5f3f46ee

SHA256
321c0c107709d62b76be82316939999ab169c9868a4bc88c52b6b3a8d4988e43

SHA512
aa0cf769d81d47c411f419a59b75fac0cae8ee70c4a57bb70f30ff4432302da182df7f59edd26bbccfc5d8ee25a5ca813e51e9cdbedebc0f150aab73f8050d3d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
7cceefff2b3c16aaae9b304fdb76971b

SHA1
9e49a63f5188efee7f8105db72e85ad329451ad6

SHA256
1a1ad96a082191543dbc9916d51fee63ca0bdd52595964ca2559df02149a3c11

SHA512
e96c6c5d1b7c62dee7be384a07b2a8de0d2d16a680cbbd727f4092d3b9b4e162e866481614fd11a5a0d7386950c02771b601b223d881a4d97decbfcd7f0469e9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
1733c8e0fb1e5f2ecfac3bdbf33f9763

SHA1
d720100e926f5f48f7cdc0c4fc994009f22ae72f

SHA256
7800d1b174cd31bc69c63ac58cf9fe3e5f58762c440aca40b6a449712e1e6a50

SHA512
fc764163480de72dc8caf7e192187e911d341a76c46598a980486e87af1800497dbb9382a621cf0b6ca356a76903cbcc20aa2e2d2f562223a02cbac26069f928

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
0aa764c70e68c36cde91a310156cc15d

SHA1
b81f99331290895ca6da06166d18f4fb7703326c

SHA256
9cc50cd3efe45265032c23f8504ca1ab4933d23c74a75a428370b7842f16e488

SHA512
cc6f2ed767129465122d2e74b684f4773a3844a4a42db25553c60e91a5c445cfa51b76b70e975f1e120ca5d06d12f6909f8a7864cba388e8ed74fb5cfc50eafb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
af331843bbb1076bfab1048d250be6b3

SHA1
5b326570277b87eade9dce21b4cc1b76dcb40339

SHA256
87952178ce8e903a3337f1f4f77365c843eedcc30cbe501751cff720993ef354

SHA512
1755fe998dfbaa8497ead1ccfcd288ba9cf8d8f18415915ecf7529e1466218b8141daaeb102a8696cae78a6ec97b77140f184b4c4fd34b5b86773e6395fb2bd2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
0674ba8b3f4e7352f8f09ad746981060

SHA1
2752eb37c2e60fdfa21f3afabd3115ed6c47ce34

SHA256
37529fd5a04d97a49dec76cbd1156d77aef707a323d36208fedd9d53da1f8476

SHA512
39f6414a702993d891624e79f079fa657f161be47aa59ab7b06d5102f8ef98e3639847b05ebd9c6e1bc79eaa25c18b27db8ab6b42983f7d905077c9d8602cdf1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
f02b4482d130f27d79061e3b59a5f8af

SHA1
5017c3416f7d2acda0c7470d511a55d4de366cb5

SHA256
e2c1692aa408e0f8bc2d594404deb3a796d4dc31ab45af2d245750068cb7deea

SHA512
f3140bac0b0913e232bff2cf97832130a1d8fab74e2ff123f1f4309cf47164b4457990ef9411ccf530533e717ae995e8627072bba3c6248c29c0006561cfe8c5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
209af850e6dc9a366d6d8f0b5be6616b

SHA1
5f921e396b427ca3cc3137363a592a18c657917a

SHA256
7ccb08ebbb28640d356df4c1b4564dc038b79210668d9c850d16e4f1957b76bb

SHA512
82290e296317c1c5ca771feecd29281b693cadbc6c32c53445c460e65c1acad4c496d942ea3373da99611211d64c962a689c594dead648bf629f2a10f2fe0e64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
4d2a5a846ff3787d9b0a44d40e16bbbf

SHA1
57d52ab5118c65eff3671a02df91583a2e2501a9

SHA256
b912f81e2b272604ae7cac9c37429e6e5617b120704f0bd7f21a3251c49ae1aa

SHA512
e73510aed936f24d18afec05dcf41216141f5455df078c6cb4bfd3e330b9f6e2cccd4b7906bacc0fa10cbd42c8a55e4cb62fa83e8a691af551fbcf99358e1135

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
1e89185a23e53c2e3f56e8c3c2b985c6

SHA1
cdd9b05a3028877556ac75c2f46fecfefc95b723

SHA256
1ffd69277e54e6a4f78a217c8afe89f36cd29bcf9c0f010c7afb3e532d856196

SHA512
4e76a9e9881066f43c8cf9a7478bdd7db382a3efffa78746cfde7ccac822eefa2d76d5f505be916c0a219627bddcda12bfcde21a68b87098fcc90cc1e76bb195

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
7bfdf2c8c46af19d855a1cabf413fb2b

SHA1
880dc74d3b9b76302782a1596f7c0f5c39077f58

SHA256
11de3421fb6d8fe25bd12e0458fdc2dedc0e71d3312dc3152167afd65dca0e2f

SHA512
2efa35a2b2d4a3b154e18e95623c0d1a3f1656de44f80f69129a2a3e0506234475a71691ebad18359303c7772df0f1d7949756085a1a7b7dd99457af8f9bda03

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
77c53bee9f89411c8f102649abf6fff5

SHA1
accf9ac0d5c20b0524fc9a167e2155ec2139c769

SHA256
8b2e5aa8b971dbc127d1db21b951ceff8db702a15fce0853885629448d0e94c4

SHA512
c4d19aeb470059d19cae29d9ce55c4bc6161a0253e12ad89fb2972f196ce3a6256accad073daf4b015c324f78e5c5e8273ce62906744f0d3103aa5231e9348dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
e7cd78e4bd2d75f18a5bc05460483fd5

SHA1
484d4c047eb4b918dc8046e2173c58955b60e37a

SHA256
8b4bb3e906a8567bb0ca668fe38da6bd708548eff810b2e87a982ce6d0154c6c

SHA512
c2d760f3c44ebe3e0a96802e68ccb8dd412fc8633c6819ed82246412e661ef261ae8e90e30783e9438c96f192388f50e9750d94153d5dbacf2e0b1c603f53c76

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
5f9180eed1a0c7376d5b952dab45c615

SHA1
a0929230dad3406e0aa2de7dc26fefe735c25c67

SHA256
b4bcd946d5c5e6641e43eab52c78d6d9611709cf73a672059a52f3aaed9b3f6e

SHA512
849f68f7a6fd66dc685c9485899b2aa018c5bef637275358752eb7435c68a353030442b3c01129e2fa9fe23781d4aa293722b59784455b4dfaecae22964248a0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
d279156e8adc35277461f281625dcb61

SHA1
661ba07d1355c0bb32fc958ddb149761f7089d94

SHA256
efd23f069d71d331c06b93d43360347d42c0f9d589a34972878c46e6623e44fe

SHA512
39d648af5011d762c12afa0d828dc07ebdb01fae5410991c394288cec79ce635298d6118293154799be9c2c9c280c61aa30e05711a87009991d582863806883a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
4a6c673a796dbeed46e56a7c530d8b89

SHA1
e710c8a54e68fd0eff60be2ccdac98dc04f7bf97

SHA256
10f32d43fde06cb10d90d638cd7523d836ace5fe15726e3338d7c207c96d4be0

SHA512
3160e5f474a092f526bcf9a3e5ea593a9ea54aa468da0eca1e3a636640ce80b16c2bfea11fdf05ceab6c9aeb9cb7350cc8c23670cef46ae0fc4e488c1d37993d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
442b5e3d2293a54e7a09730cbcc42a8f

SHA1
5e78aaed2f70bd66286f2900de4eebc4745c05e6

SHA256
7f56718f5fbf9c7b7c6683cf0e82560d655eaf4946dfcc6822b1138018d0064d

SHA512
71a8c30883b15bd11429acc76508b50a6a950f64d5d06cd76ebc2885a519fa913500601428d9a14702951a163d5b4ab5eaffd848f7062a3eb6cd9ee67071b41c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
73e03e5aeb7216a0a65ce962bf684880

SHA1
cb8817968c5284ff91b306f911f32bf0fa9aec6e

SHA256
88800137051b15b0508ce551501c9b7a8632ebe0b020ea36e859cde80e9985cf

SHA512
cf838f214debdf4c3e5e3720b202dad8e96d4233b15a256e90f62ba1ec6ba1481e1e84ae3a09e44e9b09c2c58b24d9b1ecb5b47b372dab76bf6da70dce4147be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
a771de222bf270190d4ab12e62fc3330

SHA1
eac376b1f1952c1fbf8c9bd29b21c07de01511b3

SHA256
a9c02a2a60d91fc6a087d0f8b2fab4762a37b5342ad01dbaf3d0929099209d8a

SHA512
5941c87d0f0901c671d22a4397b0d625b5dd995ee69c3d2912e4ce8097327b1aed6144bb354e33cd3fecaa6f60dd5a88ba71de56718b708a4cb703607f68bb36

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
f879580ceaf08dc2b4fc2fee636a3df3

SHA1
f9bb576ca98973e616e66bce59b4201d89c6959c

SHA256
b506be09f50d4df484357c6649e482e5da4e4bc731a17f7f31d7295266a2657a

SHA512
8daa4136d24e7706f9cca1a65a5188fb120ca3628ba9253ef18736a234730435fa6b36df7f0729321e214194ac225d66b8f901c1a21e831260d7b136268a6f41

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
11249e460550660b1be70d62eaa55455

SHA1
7894c222ae9779d31697e45b08af2e8a20f2b421

SHA256
85555d397872eb6f2d36d057792219ae71a15c805c3f30679d5bcd0cfe642abc

SHA512
7d434b36a5b978244ea717b218910fbb5e18d4bd7f35ada51d01e57f19cf19e273a97898199fb0aa94f5bcd5a35c0e0f27d9bbe8718a80c1dc85b53c71824ae3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
af089db26d403105f53bdd8a20baa3c4

SHA1
5fcbc2d7b20e6c4d1ac3e4247e65473b3b96905a

SHA256
ca3c3f2e945c60edb599d685798de3badcc279ab0421461f252d81ff19d72471

SHA512
3908900b3118344f4443981d6c5b62f841639bd4638d36103cd7c6ae9ff8d07ef349c8ae0ea12d6695a6893dc292c38ff7fa5305525a12b11577ba725e51fa8b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
14d503a23ccdb32cdad03e52cc33e36e

SHA1
3407f9bf13d3e7ee5bcdc28aca4d18e300ca5bee

SHA256
74d0aba432bb970036851b54313c5f63375b2d3590c5e680f7083530029cfdd6

SHA512
3cc2588b5f6fff6cf39b73c5a332075ace8e5e02fa626469986d9fbb0853794d351511614ecb63219a81fb3b28e89d35a048fb192493c0b8a1de968d29499971

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
e8c4facd394e69fe248919d6d9501793

SHA1
5ea513cf2bd1feff5eadb1486abdce740d56a28b

SHA256
a63890675d975e9e55f1f85aeabf7ea7572251f912cc2beb79eb6aa04bc97a5d

SHA512
f7680f889defe043b4d1f49987461ea8fd38d9799eefac7f5643cd8196d563b3abd23fc8afa1d83d7e7a64aca832674dda0c269b2c3743801e4a1db0453bdb56

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
4a3d3fec2dfc67085c03dcf15b42e2f8

SHA1
bf879089df8f0c83b3b3a9205f88d28b319d10dd

SHA256
4ce4c0b4a9aec6b7997e60a33e5a540ba3d77d17d053bf827e690709a886c867

SHA512
9a7b80b1a30320ac809eee48ebaa104deb8b07093de5aadae7e166846b4a311c235f80d66b71b8d0b56ca2c7a8e33a0faef483e0a710bbc98302f043b593e4f1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
acb83bf2c7f37a85c97cf3d4b9ec116c

SHA1
a112398983cf1d4826c5f9726441b2f2edd39575

SHA256
aa51e87d18ad78098e75b3d0a4854f43d65be539512e1ca53d54d7af0ea2aeea

SHA512
6c9738e57e25b90befcdec7da92951facff3842031175267ec0050f9775710100453c70a4ab26c2b138be62ab16625cc75f79dadb87d96c36c5269b4c15a6971

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
363619b042c809c00fb12ad0f953d177

SHA1
1145eafef7ca11ac12cd222fd6c48bf0f1f14ca9

SHA256
313389b3d9ac52a7ef054dbb4e39318b88d9e551164b63140c773079a508e4ba

SHA512
6b9603f1c6878305b65f761779fc431877e39307a513c7993931f57e213fe0efac008ca6aa478017e9ab5cc75f38e85f51cd81bafbaa7744ff1223f1d2cef770

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
1cfa166d79ade4d30001196645fe6c3c

SHA1
86612820b932f763b3ec7c8bbb668d8794275c9b

SHA256
a2981bf4f7dcd8543ee31b03c01dd9b40d28ab9ea100969abaa550bf420b380c

SHA512
0242e1f14152c164af113ff64222af360911ee44f4febc51e47bc7a3b8642a5c2f9ea1144510aedd77ed5d35d0b1dcb718f376dd75a3552982d2ab5b2098656a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
3c783d5aa35d2914bdc52f8b22abf21d

SHA1
5648896d0b843c4211053e67c50cb252d6a7a47d

SHA256
5e7acb903ac3047a18c5fc1413164fb74d49eadedf007c8f347c40b184b4e1ea

SHA512
4693aeabc684a9e58682385c089f3fa6d216e7e1ab636e6152c74c684239b74e8bb1b77d9f41e310e1a66be3a1d833e3db79ee4fee6aa7abe62def201ec203f9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
0930578c556428fd59596d7bedc84626

SHA1
b22044ef38d5d527c785737af8c5fdb8ce0b63ea

SHA256
f64625e9a574185fc9816b4113ad6ecf5234f4c767e20573dee7d074a3e3e28e

SHA512
baaa7150cf4793e299ef42fa43b87c0a42220346637e3c05ad965882ec5bfe1dd143466215d26b4876eacfc3272572136abd9c208aaa135e52aa27822ceffa0a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
55004f7e16ebbd1c95f2a3ced312282f

SHA1
10dadfe9590be0775518c0599d5ae5dfab23d6eb

SHA256
f9b0c55a9163be879a2a027ad0b9ec996295246fca67d66d2bef1b9329a88ae0

SHA512
6a485ee90030473490913dda5a09601dff5f8b7cdceefe5175e67097c4cf00b3a7b567cb7327af77d346d1220c77c083fcc3c540f0c01ab6e81031e6d3388ef7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
026e0bd5c5385462d0c64bb71252b8db

SHA1
502705d4d52c7384932e76618b18e097aa7b7bd6

SHA256
2cd8a01056289c47afc23bc044353845e375e6b68a1fff525f911ec0bdb96093

SHA512
21226258b67067925b5348592fa54a166e408e3cc56c89dcb89a730214824d1bfbcb175df35a8bd21e56c007d2f16b8a0226faf17925f65c870e23188927f901

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
e5c133562d9bb26017210ea7548c2e90

SHA1
0a8cdfd6457b47ad7a50ec78fa614feef5b7a62c

SHA256
e578f3be8dd5ecd620c1143b6add379ea9d2c27f403feaeb834c5676dd8dc160

SHA512
9ec3e3a13f0ac5d58fd18d355ecc953eb5e32a3bf5667ca6eced3239aeeca0bf11e232f0683bfba854ad4e3713a1ab0062157c5952e93b299754036030de2afd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
25a366cc1eca05a4c0f134e61d165ac4

SHA1
00ee287adb494c9c5ebcccc86be5c225cc88bb0a

SHA256
0e663ef405ddee39ce7810288ff5cb37a42b1121bf7f81867dc7c12cefda02fa

SHA512
2486254095e7f4768b44ccc8a26bc4ed7941b38b3141bcd08f1ff50cff13ecb8c96a2ae86c4b0b97b8e587ced0535c82ae9a58768d6a49d187614fa46ae4ffe9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
6049b8d104f8ee0e2a9d09a66b926eec

SHA1
82b3d8a02c6e52c3339bbad663821164dd3b46ee

SHA256
cfe3dd238dda26ec819f51ca476638f0b1860e6d5251b12284fea57ad7a6caa9

SHA512
4094d584ad8008c5fd8af2c1438d213fe03e5e19d796c40609f1917a7f2d7ebc9e4c079f1e7dbe0afef7b76fc6571d227a12fed8546b4d2f6331888e7731040c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
b1bd2d3df2c5506f431240f1580cc9e9

SHA1
84fe73e232e5ee30049316b73d8b10fdc09969de

SHA256
8ca307887465fcbcdc3d34de4f226c0bac7818102a1ee617e919474bec6abb5b

SHA512
1e1fef571d8c96de68fd7edf27a40fd8a8e4fb7deaa2314eb836bbd4a97da4d6eb9a39316666571a43c9ab64ab7cd493715f8be0c353f2637d501f96b26889b5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
3db45212cf55a3a236edd5f09764211e

SHA1
8090f79dac271bbe45953468fcc0f48518167638

SHA256
d9f975f08b4817f0c64e95347f5c10a14da2d9715a7138746db7cf2a5011b2d6

SHA512
3a0d83f658fda8512c6411be805127745f9fab64b3ea5be0dced725819b38f1cceb5cef48a6aa42f8a1c0db2afaf5c8c64464bfe6b6fee3e5273e1f05e9c47f9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
9b33cbfa0d2c8cf5ad0e8711ff2613fb

SHA1
04b5b50557d252b4a158adf2c9eef08ab2a9ddea

SHA256
86282dbc21dc75cb8920f51a98b38a87bc18eb5fbcb05a5405d5dde10f9ad3c1

SHA512
48e2177085561db829658e15784ebf3674ababe895799a75ec12039d488919be075358b7c35cb0e861c0c299cba13ee4c11d82d7214afd3ea952b7189c5c1f6a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
8b7ae166a5ef8abb0df2ef39a801e26a

SHA1
e0e840c893683a2dd2aec7f90292f3194cd4eefd

SHA256
630a0ebe51b6e3424414a01cbe48c754247a90a417b202103e419c51a31def5e

SHA512
6faaa8d41d7e778d8c78e9b1f973198a226b2b1fef84b7a391743aa9a3d8dbc84de3d4c9836f082e561c0c3fb3a7dca6b9cf2f39ec8b5122e072fe73ac160667

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
d691651bca8fb32acfc917b161df51b6

SHA1
2a90710933778b3e0a4539b801a94e32c1321686

SHA256
6c9f48a2ca1a298a20001dcd0ff8a6ba2179a9781a59bf9519c5dadc50124ce5

SHA512
63cee837bc8b8408bc9bcb0147b171b45b2cabc32f5a97837ee1d1a28d0ed9f08417e9defa992e71387818fe77592ff34fb2458f44a4e3d346bf9bf7023d7ae6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
658aaeb46d5a423590e4c93756dfe9e3

SHA1
e2cfc38b9af987551bc4037b2b379d5f03c41781

SHA256
f0532bb2f655e206c52b256d17ab04115a7a1aacf27b09edb562bc51b012d634

SHA512
9da42af28015cdc33f51b68759c9a40015b3485da42c1328aded3d2f446f1e04851a515b04b75525e8d920090ecd3692cbb780cb6fd8cc322f8ccef4d3c33706

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
821f4b9010252516529cd73d77ac77a8

SHA1
17961fe3efba9d16fb640d9297d1431c44cb5c4e

SHA256
a6364c139b9e1fac69412cea924bb59e6a0c993551fcd88946ff3df06351e18f

SHA512
a891040ca670e08c30340b798d5440ed14177cc9936d6c188a85aabd6cab988fb98038f148445625645b59bb473b799f32f8ad1d7ed207a6e2e247ff7d6f3cd1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
25c914a3e281c84c5ec1ff37819c69d1

SHA1
2faf0e476c7d1873024d5e1d49dfd4502618134d

SHA256
dee91820012ec7794faf98890f61baac8dbcdb7735a7cd0cf7413f65dbc28835

SHA512
61a4fdc923be2ca0cf6ce4e0507f876ea4916a1686a4602aef656c90007b62ffa3cf891438f46f4324e5fdbf7e5a1c7cde84a67270221bcf7bcb567432ffee18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
e01d6a1e1f54502f2a10a4df60b0c264

SHA1
a1f7994906cdc2ee7d1cb9a0c7e74773bd465a05

SHA256
22159b35a814f67f80a5a099aa40c315a970c3aa403265a36c2fc08d5772b25e

SHA512
bfe4dbfa83cfbc572a6c80abd1c12ee8f398544715b5c360784e0ac1473a1d9be4ee9e5186960241b2820d18c7682f2f00dd7a5c14c2512dfa3572ab87012d4d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
48dc42ed05eeb660310eb3c53d66986c

SHA1
3051c16c259e9a20f2a118efc2f08d37380589bb

SHA256
6575623dbdf7204ad66afae5c0ca3f6daf652ac1ea24bb6cdf249659be991d16

SHA512
b6c0dd6a3c8a2e3641efcf34a1441b831afe643d315d7ae4ba750f5bc7c9260b0312c9f286cddb179d86d95b159745e4b7f532991751013caace45e564c42db5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
2d692a1b963a20119628e6114cd90ace

SHA1
1549b2ca64c9e5f7e49b4c5ae27a6e02786699eb

SHA256
d5a7784d78f3b0d69402d7ba9a3c76ac029609ca173cf9d0d389ec1ce4261024

SHA512
7120497864998f592ae11307dd7b104028ef99f871ec94a4bba01c6ca3f46edb3c3a17b6a8f09a1f80fa51c430c239ab42afe2ca46953d32447fbe82c64c3353

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
4d59e8e7982b8bdcb457f05b1e0a1a3b

SHA1
39ef85064c00254f3dbd2a0caacea422b60e1c9e

SHA256
37a39e89ae7ca92a46310b70a0b8790804588331724a16844975875bf19e356a

SHA512
7751940ba67b4f58dfe78f38e2ab5eb95c348b89602c9463cfd5b64ce741662693d93d6d54a6348ecf09ea0e7d17876136c27eead5911575a5a24db237b1e2b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
247815c1fd7c47edee58224991426111

SHA1
70d3e590fdb3f06bc1462ae8e553323da869b600

SHA256
49a7e25accbc953dac9947c2d0a212bff24c9ed1a51d3d17663095c179cabed1

SHA512
7445808f63bcbed8ca42e4a392960873b686beeed569724f45343b65b9b2f3a4f4bae05b5df0a8a36c84aa6f466440cd814c960b1d9b715cb0eb56c4ff831b5f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
8395ab659a053f4c0d03559178f7c29e

SHA1
26db3622b12e8ce4f2598d01ee9fe82863e0660a

SHA256
58eb995f0d513e8ac75eef756db57b10671e3a7edd79970778752c8783eb64d5

SHA512
446f7508aa7633b1172c85e24192fc7b425d9d48ab8f80154624ae4515f5c99acd5dcb4e8df43e971bd664ecf212790c6a3c28c0cf3bc45a9a930df3de14f57d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
2be1d0d0151b784c29c050af559c02cd

SHA1
9469b326aff7457e9888e6cb28e7ca308e407d4e

SHA256
c2e94d4feb687c4e359f6476d1ccde8ade0645bca335c4cb9f2449d143b7459b

SHA512
d5d092740b8e030bfed9f6fabd2138d94ffc80db6e6916bb5ab591cfac5a58b0c802f1f3c9177564e2c89e67fb53eb07a34444eb455088cafc52bf7a21896c20

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
fdd9ef348e966d86139b47911b145575

SHA1
1e3d35f6a8a0925184603a97ba9b6d898e476b6f

SHA256
aed7f9a4c0df9678c2fe1076c5cd596f3e0a2028dee7903970069386f399fdcf

SHA512
5bc4c56565234c631a57c8848f9febdc67ebdfbb7895b2b68fcaffc4bb4f86752dd7e070b7c1325b00a222df66484918b7df524e34dac91c3600fa2f58e6a677

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
b86730a60d5b4de44d3bbc895c3c7e0e

SHA1
bbe8671cb66e06f4fc2af6f2c0ba383b17a95439

SHA256
3bbd074a44cc0c4b028c24fef24e720c3b1e5b9f45bcc257b62fd1f6ddc04451

SHA512
53c5759b408af57b09ee4785bef760639c2821b8f465887193155f63f999f87b4e74a4194505fbb6cc9bd39b800083b6e2f0676ca36bdf51c8b452c65df76e35

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
b0c4bdd5d31cd5744157f3606dd7be93

SHA1
e547b79e1dbcf12abcf044cff41a408629c1924e

SHA256
a9a26792afb99376f1b1292ddcd6c5aeb2edb98e2ff7d94ee37d083bb648e1b3

SHA512
91cb0b4796bfac04dda939e912f72b0a3e629b797594d502d330ef57d815d96eae590c157c7c91caee4c2446107969cae8e4bdae36d2e77ac7bb709894b1f9a1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
28954f7a1e9e92c324955f9535eb32d7

SHA1
9ec420d3abedfeacdbc13caa55d6f0229153b2c5

SHA256
6f2094ffbb718c7c19a2c62e70b1e535bd1d7be9502c1b84f25cb9fd141c6af4

SHA512
b6c2227200ddfcc0d2b914d4fa3db6b0acd805b76f79d69c10731f2281b8e59c3d60a89f377350bf0753e47d5c9c61108d171d4635b0e04c52043e0fb8d86e67

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
c0672786ee200ea0dec5a3e4d0abcc2c

SHA1
79f21c480a9abe51f1d3a487d149d058935e628f

SHA256
f17b31d54ae42fbcb2f0b62f59e1b9c6a3d0f2b211ac860f9a1dae643642f04c

SHA512
1746463c4869191ad16b97d1f88ebb3c27b71ceaa945e8f14e08e7e1eb288796545afa15c4bf9cf0ea4debd7614f73251de1df1153fe59c9364f5b8b142a79d6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
b8f27504b94a0d5543081f84a3db14de

SHA1
c669771a68f490d09ab6cdeaf69a9fbd441c1201

SHA256
27f715a9b05d1107c2dd34b0035724fb4014e8fad78f08169b4406efdaed1053

SHA512
b314e663305c8a67af47b8d6d0c99b8cb6647ee82cf7ff9ec95b6f43160128d09e02a673c252683fe6de5faa44ada1b963ff46c8cd9451cfe68237082de71798

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
1e38fbf43c8cb806213599c7a5b4b878

SHA1
7e1148f4ad19da73356145f1b97904d3f08db286

SHA256
74f8edce2b7c73f463b2d5236d8e1f642afa785d77e6787608a08dd5dc69ba35

SHA512
4a2856a7de72be94c753810edea404d002f22327c92c18d7eebf75e55e75fbefaba0f57c3dd90bdb9f3768c800e0ea734a88f438aa0891e2d9a3bb027e2e6485

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
dea1565d4f7b6cc0422770eabfa1ca9c

SHA1
ef1221f5707305f4ee978f8645c72678c810a93c

SHA256
97e5853672be4a0f3c551e6b80333742b6f2ecb76da4b9c099819ab36323c592

SHA512
6ea2830a45a1320d79bd1407e45f4137bf39a7b5b2519d5e4543b9f38d7b7b25f120c133323b3bc7946b31d1bd89803442c890a5ed28d68836af7115712bd743

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
6cf9b2951a2f20bd2d8a531a44179aa3

SHA1
d348b37f64a2c65b21f4a89a5bddefbe823beb66

SHA256
7e5b7e93a59d8ba1f684c3616c6f49ce3a1a44afe1534b376c1b4a0da49e1e4a

SHA512
3bca57cd4d5b67b6e563f9cbe7b12a4ac0b6882a9eb51fc01f872a45b48ef8bb0ded0791c0bbf9efeb3cf5dcdb2c6bc9ae9ede62d19f2d7f8a7298fe9505c37d

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
4f7ba073120bda942d97a01b492ee7b8

SHA1
783b37a116660df76b3c238aa8cc5a997c7fad61

SHA256
2277e66dd77b840041a053ecb4b46010aa9d3cfbe93883368457a2feb20a88c7

SHA512
334acf82ca7aa9e1d8531cbfe4f4cf51aae479f9eca0b05f49f14969be8550e4c402a637bd88e6cb61b6dc7ee6062dfbda696eee149330e0bdcacaf8461edca8

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
d37cf4cc8eaad660ea1dbf4e2cf9ff7a

SHA1
3c5eabfaf918bd9e4fce484fab2441ed1a23e7d1

SHA256
58fad501d029330fdec561d8218565068f69ac32da41b15b1b52f906dc0aec66

SHA512
6cf421997bbefdd0a6fe90c216f95147f3f998f3a3e6ae3797bd78d4c1a230ec1fe366145977436c091378971d40989025b7774da68feb0f1d432de6664492fb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
2c7dc85e37d73979e29ae27234e0de9d

SHA1
b392b8bd03b130055492247148e561bcae9ff044

SHA256
34c975e64b69a0472304a6fa8c77e57ece76e7fdff4c7cf6327e8698c4bbefe4

SHA512
98489b68fbfd5413d84eb08657ef0441c0af827d649ba59560e0da47abc145934b35a3a012ffae8741490706f4992287445dba1d7485fc2e6c6fbed47d5d671c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
d9ec43fe20279aebebfc21c9d5621ec2

SHA1
2112f36e184d87451543b911fdb7123a7c009ec2

SHA256
a0933c7342029ccf4e6ea9a43541e9b5a8e58b4749d5bec2885d64fa6f98fd4a

SHA512
f36e5ae07ab7eab105f116269a1053259344c0c7c6444f90e5c2080c674a09b192d4498a8e88cd94cd94b8d6b3da066f7833203bbf5170584294545a10e1c674

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
6eb80eb1e4b9679855d5347d8651abd7

SHA1
7b8a2a6bc3385ba31776921abce00352020a4443

SHA256
7cf2de988d1fa5b3f0cff103b1ef7e538fd6814aee477073e7542b8580b57ef3

SHA512
24f75cf9a5991ace5c4c039af9a97b69a2528d1a589d7724cc4b7de09a3f5f5150e1f3712f607874c14fac890b4e76fbc02e5836513b25396e2bd8edbbf872bb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
ec635dbb0fd8d3d6ade95065d834d130

SHA1
05ac5323c07c9e0bb5fb2b06de6c83f86452d8fc

SHA256
3ba18f053d9853585ce742a0d70a8c32a08f650b76065da0ddee1e76c09256cc

SHA512
79d244145d8ffaff8950b761d747ef64742740cf8af07755bc0b327eaaad61fb7e0433cff178be50d93a998e7b156e652a69f3bdc9b498682e941ea3ccac01cb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
5f01260b280ba7659523cdcc12ec9aff

SHA1
192a1fa005e9ed2ecb666936ab38e9b44dc45ef3

SHA256
9e91074220b348877e62fba91ebb161df90306dcd56a497d93603ce20a8fbf20

SHA512
d35fce8d3492ffacc64bc7655bf5f6496056b31da799919b222fc3f1496173a0c40189899770ed39b33c4b78b282e254b9785a66fe722152d8503e4a73cdc250

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
520f2d2d926ec74d331ff4c7f011a94c

SHA1
c807cba9006b8d1a88ff61c5026c7f31f8e239d3

SHA256
f09497d18011b06d43475f2801afe44079e148cb74a4e01049be2544d93888dd

SHA512
a4ac09f1339847d6b5b693cedbc601555448162c867b17bcbb369c879f4e5f3b64bcda75cb21f58426fd2d5d77473e6b051f1692448a94e01bf38ab6e83227d0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
872a604748510631b042c35894895695

SHA1
22c5f6af1446866b1aef21184aa72ff7a9df283d

SHA256
3c7826a367e8903b72e7540376c02579217373e04140177acd398ebd3f781b7f

SHA512
992bc112c5dc3b31253849e6de468e8c0b26a5f984d0c5be6976cce33220ce3f32fbd9142b733f31791f0c76c09a089c01930231d62de6a2b857ea2e36458ef1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
4a8d89053dcd507eb56c9a041d66e09b

SHA1
238d0e8722fcaf2d512d2ddca3ffbe393a146ec2

SHA256
62b632d8781f069c51dae1c69b54f45353285b6107819a2f2978ccc366d8b37b

SHA512
8f7dfcbf57729ea876e6442aed467e34d04b48cd3ee5d8f9de7a69b899bf5673c36059872e116156c3dd5751724330b47dadbf9ffa24712d15cdf03ebf4b1505

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
83f6f37e6b02de5fb09bcf90998da41a

SHA1
ac56341bc955e1c98df5ee1069010fa0831b6e4a

SHA256
966090e1975c2b0c330f19f2adf82f8e1f53b2f5d1f0f1d741af458aabf3b9ed

SHA512
b31caff03a2083dbdbb9b8367d8edb0dc585f6d6440b5a3719eb83741ccadbe1da3d76ea2b657a0c651c7dd21a109252c774ebbe466f291d693bc34ff8cd530a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
afb9fe47a181dc91f0c25b6fb63e90bd

SHA1
972ca99e6fd2b384018f9ec8f7d834da737248e3

SHA256
3e59c4d6cff7103df74c13659483098495bb12f75ae2fa1eb0505dd1cb48c97b

SHA512
31e9497dfca67bf7c2efaa02d1e76d0b24bc14da89ed82036e461edb2c7a0e04077a30acd8e2c9b1fbd51358e1d7d2c8bd7caf29a2a4df791999b4d1862cae36

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
adf2418009770dc423fed51075543f13

SHA1
4ca42add33bab1170c03898a269cb5db1f44ddc8

SHA256
078734d08c627e6b1b889a821e0d1ac2bd0b4c361f4a4dcc50ccfeccc9054909

SHA512
8f6ff182ac62a655206a479e0c23f4046adafb1d8662abf393249773f440526978660012d20099bdd2c145f323c292eaa56ff033e0cca1975ea510897136858e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
b75be34f04154dab6ccd7600fd908aa2

SHA1
46a9d664798ff821d7afcb1fc47e69bab5b68885

SHA256
fcafe6e15dd60695acb60a4fe51cd59e5073c017b9b6de506b080957554d809c

SHA512
c71a49878e31bada355c412da1c9091f0484f5f771ecf17f6486f64b07aac47e5d64593baa79511a9506bc64adeb77501d45166d9241550cdebacdedaa6804fd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
bbc9ac2550e2318d36cb6a2b1441c59e

SHA1
a143f91cc06692d03135117eb21c4348ce120270

SHA256
3d232ce7169053964c2837a6684b1d167197084c97d10f404175361a7c6cca93

SHA512
3a93cb43f95c403b8767b784ae1f57f1409a6577e29cc79ac5af2635b3c4f416be5c9bac5c2d7ea27e2d33ff1ab77de46a25f89806ff1800305e169a6a513593

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
3e14d5721b51bdf0f8f2e23c655d30b6

SHA1
78ed06332f8ad7e4ae5fc0552ef1f1140feb65d6

SHA256
3d0809b5733a06d1840f4e68b6f861b217da70e3196d95701a4da38ce7a47b9b

SHA512
2d5bbd788c4b08965b796c0de42e042479ece34a3f062b4cfd3480acac3c197ae3975d1144dc548fcce74fa881e81cee2c13087ca9876f6d7992309ef5e5cb7f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
15c112735f4e7bab22fdc215155891de

SHA1
313f15245dc70afee3d3d332079c969810e9ee27

SHA256
b5ae520da48e7e3459cd27cd2002fe5f9ae3a8a83c301932e2f0d0877bca8b1f

SHA512
52661ce689af03a272f63256d42f4bb5ff5fc568d933b85333141e7c0237d69535776b66ca55ed6b51de9ea22300e6a87a2d57406348fce3c21a553e18dc3301

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
063a736fe9cdd915193f56431afe379b

SHA1
f271680627aec9460fe21687225386da35873ad9

SHA256
0b90ae10f5f9738d088d20be24bcfce9095fe9a036fe0e1cf807e4a1c31570a5

SHA512
64b942a27bfd1d7ad971cc796b8339b63a1f480fd1a1bc58d85aa124b510003611efae92f4284d6af951536f92a7184af7ed5b09be64e7232bd8904a2b487a50

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
73d75f7cefdc50581433de59ab6f47a8

SHA1
b1c28ce6ad1ed11c08c190fc7dff4f6c9c9eaaa0

SHA256
b3500b69298cff885a0ffbb34f3e7bfbf7b68126f3a6c36a9a884fdc96f449d9

SHA512
5dfd1e16ea621634eaa765a03e519cc09a6305f65af186ae9fa6b7f15e3af784c4966b8773972bf1d2f24bd42fa801962e7a9792d8f19fa8b14990ac06c62d62

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
f1153ae91d6665c9e79f4fec698947f0

SHA1
ec541c74b3673b46809bab88a834c429c23abe7a

SHA256
d45403d053019fb3c931a8711cf3af6dd2a8fa76c0ef9f9b95f8a22bba9778b0

SHA512
c7157725f06d8e824d1cc2da4a9e73b46fc4c351c2e4a7affdda521bcaef0eca50d348428888dbff595830b46783fa77e037e3fcd72ae7afbeb0953205ed062c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
4ecd94794b45f853e23b983e656ea1c8

SHA1
270ac0623007403d2b4cbd59207546a8762660bc

SHA256
cea08e837102ad0ae13df2b47c2b42f5525effad0b72cf33a8cb2fa03bed0a5f

SHA512
02eb2a6f040a1b1010dd2971c30bda09398225717d4bab57fa40f9c5cedcbc65fbb9a8b862217dfb207ef45defb716f60af7be4842e4f57d80c61e936e628eb7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
7377dcdfc494ebd786a1ed924088d744

SHA1
735952baf671fd68ff5e281a2543550a2456c860

SHA256
eca55d6afd19ae9d79b70f867e919a08e94c47838ace4155c5b4ba5ff8bc2eaf

SHA512
43b25a57557e847921017703128e2696fc1dd7022fc004fd74aee2780360e3084719d8318f95c55c46b5468843825a1f149f1c002d1722a3782411ee7ea3a262

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
2e9c2f254c652887d2ad1508d7c13c4a

SHA1
8bf61da75f1ef9dab9613554d40943b4d50b074d

SHA256
77dfc48d3a3635a273f8ef6b30e5b6b58106fdcee10f33f6443341e559b02da8

SHA512
96287c6e8c8604e461cce25caf37e74cf144cf82901858b26f3590c0f62aba186c2ad58debed2069852983afeceb1efbc7e3b823a1c080d9eb8905114b5e1c38

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
890bf8b1f32dbaf27f65bb4c38b1d560

SHA1
0ab42fc2d922a11d897ecc8b91f7cb5ce5993ffe

SHA256
21b9c5a073c88fb548fae19a459cf45e1d9fb70a0c4643916f8655ea0918be4d

SHA512
4ed3a6b9453609363fb2b752d87ae2714e39018f74a7daef89c9008c3437fe5c42adc63ed1b816a3c0fc53783f51233d1bd901e2d66ce4f6c5ca161901996fff

Download Submit
memory/2760-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2760-8839-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2760-8840-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2760-9175-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2760-9176-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2760-9178-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads