xorist | 82cad9aa8dea2b0cc0b23646c0abaed713a879b3d917e8d9b3cb64fdbd08915a

Analysis

max time kernel
94s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
14-12-2024 13:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Size

39KB
MD5

eee8350b227cd738eaf16ef108a33320
SHA1

37730704943cd65aa3040df35ea8a1901357b0b4
SHA256

82cad9aa8dea2b0cc0b23646c0abaed713a879b3d917e8d9b3cb64fdbd08915a
SHA512

79937bce7616f65798b7bfd63fa71cc893af1e77ea1fcf6dec980fdbe31ccc627a0cd3a2b9215b3a1cf0d8282a4accf12a18daa1e93798380c353656eb8e6d8f
SSDEEP

384:PebFNw4Pk1itKkpAjjalrnkqYvjS3kDCgSf9MYIMB:P0FmBkpKjYY7/DCv2c

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 3 IoCs

resource	yara_rule
behavioral1/memory/2412-2-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2412-3241-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist
behavioral1/memory/2412-9744-0x0000000000400000-0x000000000040C000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2511) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\j7Clgm55Cj4uys4.exe"	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\rrinstaller.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_try_catch_finally.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dplaysvr.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\af9035bda.inf_amd64_neutral_aa11aa34552d1d4d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmeric2.inf_amd64_neutral_a0575ec9ce5c7de9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnlx00d.inf_amd64_neutral_ce7a0b4e23e432ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\IMEJP10\imjpuexc.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmbr007.inf_amd64_neutral_91d259640bad7d26\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmneuhs.inf_amd64_neutral_d1563e8412461eea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00g.inf_amd64_neutral_6f76b14b2912fa55\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dxdiag.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-GameUXMig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_jobs.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidir.inf_amd64_neutral_5b48c4b1b49ca54a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\hh.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\runonce.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Break.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_locations.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\termmou.inf_amd64_neutral_207a02df8e9e6552\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ieUnatt.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ndadmin.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\DriverStore\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scripts.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmrock4.inf_amd64_neutral_e45293c539584293\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiahp001.inf_amd64_neutral_aee49cdf3b352e58\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\rekeywiz.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\dccw.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\IME\shared\IMCCPHR.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\SpeechUX\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\default.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_logical_operators.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_regular_expressions.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_locations.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmpp.inf_amd64_neutral_a9cb77fe1985cd2c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_WMI_Cmdlets.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\avmx64c.inf_amd64_neutral_8ebb15bf548db022\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmracal.inf_amd64_neutral_857b8ff74e5a7073\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ts_generic.inf_amd64_neutral_1a5c861fdb3aab0e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-windows-iis-rm\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\diskperf.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\faxcn002.inf_amd64_neutral_3d392ccc357e04db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_regular_expressions.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-TextServicesFramework-Migration-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_job_details.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Windows_PowerShell_ISE.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\DpiScaling.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky307.inf_amd64_ja-jp_e40bd14f18e8ff7d\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\odbcconf.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_troubleshooting.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_For.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Command_Syntax.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_join.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\about_BITS_Cmdlets.help.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky306.inf_amd64_ja-jp_97f0de39317f6837\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2412-2-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2412-3241-0x0000000000400000-0x000000000040C000-memory.dmp	upx
behavioral1/memory/2412-9744-0x0000000000400000-0x000000000040C000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_rainy.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\15x15dot.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\flight_recorder.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color48.jpg	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.PPT	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR41F.GIF	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\is\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Resources\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\en-US\slideShow.html	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\14.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_SelectionSubpicture.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Windows Mail\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\default_thumb.jpg	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_cloudy.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15056_.GIF	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_thunderstorm.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\include\win32\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\logo.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\dial_sml.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10254_.GIF	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Defender\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_bkg.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Java\jre7\lib\zi\Europe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\setup.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02748U.BMP	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0149018.JPG	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_pressed.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CASCADE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\THMBNAIL.PNG	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01239_.GIF	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-new_partly-cloudy.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\an\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\spacebackupicons.jpg	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsPreviewTemplate.html	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\de-DE\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Common Files\System\msadc\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\720_480shadow.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_right_pressed.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_snow.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\CALENDAR.GIF	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sk.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\license.html	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35B.GIF	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\ja\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\trad.png	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\TAB_ON.GIF	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Defender\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7600.16385_it-it_43c8f8ac0805bca7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rpc-locator.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_a96eb731e9ea5ea0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_msbuild_b03f5f7f11d50a3a_3.5.7601.17514_none_ea8ca0c25e350957\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ab03602b9d6cb924\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-halftone-ui.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9db31541093af182\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnts003.inf_31bf3856ad364e35_6.1.7600.16385_none_1a5ec630d9861d24\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.managementconsole.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8f1bc900791f2205\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..iagnostic.resources_31bf3856ad364e35_6.1.7600.16385_en-us_81d97f02413ffbea\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..nager-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2fb3a1d5b4c2dd1e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..client-ui.resources_31bf3856ad364e35_7.5.7601.17514_fr-fr_28835b247b8dc014\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.build.utilities.v3.5_b03f5f7f11d50a3a_6.1.7601.17514_none_1706fc424884a211\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..revention.resources_31bf3856ad364e35_6.1.7600.16385_it-it_6becd7c8227ef44b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-partitionmanager_31bf3856ad364e35_6.1.7601.17514_none_3fc218fad10f1ad4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-14.htm	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c80cf1d4b4cdf5c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-g..tallation.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f71390cf9539b05a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Calligraphy\Windows Information Bar.wav	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..qlxml-rll.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4f807b381bda3cc2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d..evelapisets-windows_31bf3856ad364e35_7.1.7601.16492_none_862b61bc350b5a4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-docprop.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_9600ddd948c3c1e7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-ehstor-api.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d59953f442e57255\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.PolicyManager.Resources\6.1.0.0_en_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-langreg.resources_31bf3856ad364e35_6.1.7600.16385_en-us_fd709e41934da35a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-ie-infocard.resources_31bf3856ad364e35_8.0.7600.16385_de-de_49651b6146f25613\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ooler-networkclient_31bf3856ad364e35_6.1.7601.17514_none_9799402887898e33\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wincal-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c8a9a3a2e8e288e0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-m..ditevtlog.resources_31bf3856ad364e35_6.1.7600.16385_es-es_59a756fabb56ede3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.1.7600.16385_de-de_a239ec74ce61c438\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_aspnet_compiler_b03f5f7f11d50a3a_6.1.7600.16385_none_a5a135380060b978\aspnet_compiler.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5b0078129ae2bf07\405.htm	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-m..ionengine.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_1bbf4d3f544a1dd5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-power-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1c0de23d79605787\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-e..collector.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b4cdf0148751b64f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..environment-strings_31bf3856ad364e35_6.1.7600.16385_none_54770154269f6123\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-iscsi-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_06d3e34946d2cf79\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.tas..eduler_lh.resources_31bf3856ad364e35_6.1.7600.16385_it-it_528c6fe21823b5d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-wab-core.resources_31bf3856ad364e35_6.1.7600.16385_de-de_073d8f900a01ca4b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-x..ocess-mui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_51b029ebe2ca826f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-fax-common.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_48268639435a097a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_64\MSBuild\f4a88265ac4ad47978daef8c5482fd30\MSBuild.ni.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cryptui-dll.resources_31bf3856ad364e35_6.1.7601.17514_it-it_ee32fccf7f23c0c0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_msbuild.resources_b03f5f7f11d50a3a_3.5.7601.17514_fr-fr_ce53794cefb4dada\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\Narrator.ni.exe	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\404-7.htm	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netvwifibus.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0800c2c75a54420c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-ics.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5fc652bbad6091de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..-localspl.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c347d344b4180fd8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..lprovider.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_998776b7c69522d0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..er-engine.resources_31bf3856ad364e35_6.1.7601.17514_cs-cz_05d30e9dd60825a9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-netprofui.resources_31bf3856ad364e35_6.1.7600.16385_es-es_53ffa70de90b78e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-credssp-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_eaee1bbccc2029c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Globalization.Extensions\v4.0_4.0.0.0__b03f5f7f11d50a3a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_uiautomationtypes.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_a3e51037fdaa98d5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-zipfldr.resources_31bf3856ad364e35_6.1.7600.16385_es-es_13196c7ddfc6da10\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\inf\ASP.NET\0019\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\401-4.htm	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-scrnsave.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_d60e0225bb629349\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnle004.inf.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c8cfa18adb8d54d2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..tbranding.resources_31bf3856ad364e35_8.0.7600.16385_en-us_10cf56c2df959d7e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..atson-adm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_ae75c153af624664\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_acpi.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9c52999aacc0f8fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-help-locatep.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b1dbe16bb6559215\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_es-es_3fc6a921cb2e7ab2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI\ = "CRYPTED!"	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\j7Clgm55Cj4uys4.exe,0"	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI\shell\open\command	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI\shell	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI\shell\open	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI\DefaultIcon	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KXOQZUNHYUIPMRI\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\j7Clgm55Cj4uys4.exe"	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "KXOQZUNHYUIPMRI"	eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eee8350b227cd738eaf16ef108a33320_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
288B

MD5
8115bed31b7cee7b0b056d1196cabf40

SHA1
006eb04a3824dcef13fe4bdb22ebd33ebb72ddf6

SHA256
0d10d27819f45b102d532862a233eab90ff31812c0019143eb318b0fe16a2bf2

SHA512
af1f6b6bd9fffda2b7c10fab77843fd0f64b37ba5b2758eccb212725fe3c7b3e2eed68d48045d4506fb1020c34f379d5d5e87e056c42c0b2618fe490529c3c53

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
94e4d7c06fcec083560f1718fc868143

SHA1
a24a940b8e497a3332c14c22465557f4176685f6

SHA256
574ffdd9362c73b627d5e7456c159311a9ebd04bd44b3ffff32ecf2f97a5dbcc

SHA512
9f094c50791cc792b93f69ae7390e815c271de205f7d10fb7f927b9c149c6dfa5f556815d5f3d7747e7ca50f210a473f3b12049135b9da44c66c445c7275909e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
ef7d5e91c3d32ad3e0fdd9cb1d433e5d

SHA1
9f8845c6acd6cee3183fe76899ad15e942c3c10b

SHA256
edd4dec2cba34c38c38a36b3c40a4716e31e7de0617b40e6a2f6f3bc25ade65f

SHA512
f55c1528816644d5654f63518c263b1c6fb5d68d4257bac5ac8a4e3c650b007a20a51c28bfceb1599b24d615b283de5f005b49debff1f8b2ea30ac55b0d07f84

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
227c2229dc7483e7612478575a805f49

SHA1
8d95fd45295d4e978388c7ba3b69944f2ff5f9e4

SHA256
5a36d7190b2e524e24d27147ab2b784a5a7ddbb99ed79f8fba21dbf32b4beef1

SHA512
084b97be262ee21b0743fdee3e602d1c4aba7fc4e70c1c0bcea905f354fffe603d4c04a444cf851db80fbfaaad34ad2ce779ced46aff26a3b08057462c3ce139

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
c7b6abb2d634897e1f29480dc09f7cad

SHA1
3d8d41cac5736ab9c4f752723f4bba0a4e134df2

SHA256
8fa05595869df6323b8565c406f5fc682719753e5d28704b25a0cbc1d6061454

SHA512
d21c24ccc762759c2d0a22cfbd9252940a739a6e7f1337701349b331cef50c8d40df9dbd1d9492454c191813c85df86c1d7e90e79dbc4a71f7486179b870f7cc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
e120527abd7245e6b6f144af8970ecf6

SHA1
e0f2a1f138fd406146b713a799e703520921fa71

SHA256
d5c64c2962fbbed1afd4839a39b9b8c02e695d4d1819a995e53e1fd96f6c26fd

SHA512
0dc821514481c79ae00ab73f06e410159dee2e242f8087fd23c90b510fc06a15af5e4e373bef971e4a6e9c71d7fbdce3c0f10e785d5f714d28604fa9215ef655

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
2dfe1d8fe35c1f6967f570999039b4f1

SHA1
a0087fd5ec2b888376317c3299114a4839db4c78

SHA256
b92a973353ceb50abd54cc323c09a7c6280b7d340ed2df13195c148bda2e0635

SHA512
af55a607bc648da6fad67af4623785867d7cab57a7437624547b6e5a1306d7e4f9585e6f3e1db45644d3edb4d7155e4d5451b64a522be3ac8f87fa85e1c27f2e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
da2f4889fcccc2131b36f27e262d8bb9

SHA1
2c5d011caabb0492b41bc117c7f368ee0d108435

SHA256
72999631cac8fcb49a87449d33b85907bc000f0184ac2ff485baf523916e4cb4

SHA512
e3b3d76e05220eafc485c87fa20b383ca0abaaf1e2cd8a9189f16164ae9d1bdc5b684dd698ca1fd7ffd0a601e80d0b9b42195d5c0839eb7ee7bdfb8696cea861

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
e48994d89d13269f68cdf810c2e295be

SHA1
3d869a9303f2c5208f167dbc2dc234f75e3ba957

SHA256
ad58d302e9683b81ce4000eb3c29719292ab658200d4e0737717a940d37dab4c

SHA512
ce32908fbd7ff72a69fe8fa0ffbd31573a53c07dc6ae8a6f4aaa4c22f732ad4d76fcf9bf6c011c71602f8f9b82b0571d88de19be683da69365b6c224f22e4c3c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
a985c3e4cbe8e10c70d00a50de5bfcf4

SHA1
f5bf5b40b5d5dbde3a76859f89a8a63b565fae8a

SHA256
f41a9f2a2ec0fe7029f7f09b1fcc65c8f8842b787edc99a0c06f54d85ad0a943

SHA512
3304e2865300b74d1952af0b7b0fe33a9ac562cf30d57f9f078e3ac0a2a9a4bd19adfc27bbb5f6c16da18995eae54d2e1fb0d11a90bc8972d805aad513ecee18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
32e0444e30f3cf0f4ea22e84d7502d3c

SHA1
0233aaa0be12679ec5faf78b669b642df6562beb

SHA256
2ec9c528e47122a91cb1c219696f8ffb2434ba2dde1fd15e0e6366c1499510d5

SHA512
9b119c427f543de55cb4a2520ba05ba58ee47676a4ade5f3ab645c02eede0f474953b9312fcb42ed84a352a3736e6d1e0249b76b59c0cb3bbc4cd6db445469ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
8a256d4529cb6e4fa760b2e7ef3c2220

SHA1
7e911947b7b24f570ef3dfcd985dcbec26b68936

SHA256
eaf3a89183e4e73da9686b6579d7d15395f13e4a82bfa4f8d9d32c71b4b51b1b

SHA512
8026e85d925140434042091519a075683c24fa93a143b6a7963dded0d279802ed2733ca3f9ef7500b0a1ea2fd80d538286f3c99a2dbaeeb7f3c479abc9b22ea3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
fe57432f9453e6bf134bfb251d92065f

SHA1
a041826c22de3fe4bdbcdc2eb16ac9b0d4d5ea9b

SHA256
bf4e212f68bb63c72b6f58334404004b3d2d0431cb1005af505f1118cd363b50

SHA512
a70fc9622e6b65510357ee9f3cf6a8b57324c2823e1e995c1f6369088c62ac6f97abb7db15dd3a88feea8cb931287a3d31e6a8a2c558ad34eef2c5e8cd0c26bf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
f2faffeb92cd73203e9c70f8c200ec25

SHA1
3a3cdc519105bcc0dcf47ace05209a5d05128e90

SHA256
8cef84c4b6aec791030fda671a7cafbfab67c9d3c60a009d7cf589e0225a36c1

SHA512
9ffd023b262d48309bf53d3ad3f37ef95363bc8decc10555edb07de6ec123cb2afebae5bb1698bbc31a681a9514bf956271926647226c255225ee5b8160e132a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
b9e25a0ac01f717c6a8b1bb7d97ee320

SHA1
8c536c0d234d7ab65c591f0b079dcf4d75eaf985

SHA256
4843d7a0216cddbb97a66e194ecb5e3906fbaa0d82754eb28759c8bec9330127

SHA512
f71a9ef21607c60559f4de987077c93f7233133d2fead3310b18cdc80173c5a7c3b905b6405bec392823b7c3a61bcb88a18fca8c7ffa7e784e47ba0516ce932d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
95f08c731f3b861adac7439bbd3e3a72

SHA1
7c09615b65bee608b7f6ac392b0eeeab11230a36

SHA256
802a4629f255f1ca732cdf6afde937655eae6ab2dffd8c6fc0756204576c9c6a

SHA512
86e4b8e216b046a536b8b04cabf4c0382aeeca8dcf11fbaa417a689b41da9f0577fea520cf03508f0701061051a1adff8c75cc3f4b2570ad6fbc9384b7525b9e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
233bd6b56329694ada533c5cb337a145

SHA1
6bbc37bcb87e42ffa23571f56b7d413b55334a0d

SHA256
6c8e04edcfed096df8689fab51b0362a19c0c9ee530aced9d60a212be58179d7

SHA512
16b91e57d0294d5227d57a0f75e6d05da278f5a2fc20a67110884823905aec54d451ff6160d7c7b81e6d943aa690329f60bf77b1fe698842d7be4bdf2fd7f571

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
b3db6a2704fca40b108092e8551f2dca

SHA1
6631ab33a375124262e538c6514e9f47aa8f3e3d

SHA256
6e9e8b83c0a760d0c5bf840f41310cadd54615aac21a8cdc0e6b2040a2c3b346

SHA512
968cfce4ce1ca62aa7eb9dfe4e4291af646eb6099bca98b9865ab12b4628fe1564cc89cfb410f281e08fe609823bcfb551d4fadf24766cb908e7569bd747f4d1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
87e0ca377cede9882f909b0fd70aa475

SHA1
e663030bd9f600ed884ea35234008b873cb57283

SHA256
ead26f5bc17bd3c200e353c939e16b27a6cba861a48f3beeb4825212206a1c43

SHA512
36a4a0b68d51a33772c49fa7ea151e9b9a6410001d039cdf15463d4c1bf418faba60b04611b378e419fbc7eda3b719461a791e871946bae782cebda5fe507326

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
b17b85a86e4dbd2c274fc3bb3e378915

SHA1
454055303dbea4d8df0caaf63d02b57b3351851e

SHA256
fe5f49bdaab54688b1d41bd8a87bd63835601cd49a2ffff2156dee2616ee62bf

SHA512
419fa0de20043fde447cb697e1e35ad593fc5072f9a8cadf67bf5f4ac9c228228fc08dbe3cdd26e94905ed40f08d54bec200edcb47aac78e22f807a48c2436d5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
4048a873d1100aba9e3dcdeddcc01d02

SHA1
d754403b2380d1d535b82a553e57e95e5ba173f6

SHA256
c7d0f5bb753ce9279144d98beab588e5ed81e0640fabf38616ca8c39bf611e9f

SHA512
9cd93ec7b1bfcb171565c77d62091ce947442aeee382b7e4983bd3852aa73eb24756297074baff8aad5373f77ccb31b759f39bf1876eb7b181ee037eda707142

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
0bf1ed56f8d1dc36c2345ede543762aa

SHA1
dbfcf86e2449aaf2357d2c18983a62d3059df2e8

SHA256
a1a3e8c2474133fbbf172b0c19dbd782c09661dba7b042d88be1ecbac9dab193

SHA512
02f902b6a1b41acd0f2f43ae44c0d60e08d564adb44e31ec7efcc82262f8b9996c6faf8ce5a5b4805973afc5ae002472191f66ced11d9825f89685aaee53a566

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
15c203324962c9618b0e806bdbb942a1

SHA1
5b0ef92a1ca0ee8e57f53c6da9446518f739eea0

SHA256
657ac19a4e4377e84ab182aee3d75aa28f1937ca06f2bf2640dd184d86f8716c

SHA512
a741d9be2e0435013c6d3f832c1fef3f451d3ab9c47b567b29dd75208dfd8b82b03a44a3502f4c24d5df42562147b4d8973bfa6fa9b56e3a6b58023f8e89e5fc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
c411a4871129d90c06a5ad5cd21a0c22

SHA1
5786ff181176f49f4d4506a3908230f1f1d6acd2

SHA256
0b17551143fdb2d651ed26a372508ef6d4fc2b06fb54638e0bfdba710167cf7a

SHA512
20d3fb68cff4d82b3dc77b7b282bcedd2f53a02501dd94a0186830de42eedb34835d802cb4ad71d0025dc71ffccb10a31f15fac3e5951d2e607e9628b9ad15d8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
727504bfe2932c148c8b4c906ff5d728

SHA1
598b78fd9a5ca061a89469f3399b6f44e2af7432

SHA256
06724b979870e92702d905afdf7c46089e78dd6b34f562046a63d581fceba250

SHA512
d2e5869fbbba283ea5e7ab93fc648f8cb7b72c67c51baf4c3e09266e971c6685893c46dd35a46ba536d2e021a6701d95afc910f749ddaad6888b7627ee9a9557

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
1c5d973fd4bf92be0077bc57097e9b48

SHA1
0ece3ba65c9acb363787fe48194696f7a7686ef7

SHA256
35f50141131de2bc225d41d5cd4165666df326d106b99245bbbcc89cda1fe625

SHA512
b142618b08b86cfe6bf82cee6eeb802a193abed740875d03ede8e01b36afa662e21457584e29896e1ef2970512d1b174ca15e8d0c21f8c9854b39795a8331e06

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
6e461f74b19c5a21d91c35f4b47b5791

SHA1
90cbde4906acf17f04f755eee999ba01a2b58e0f

SHA256
b757ea00c0a0189353fcaaa375b6c79d1fefa3c1c6ffaf6e90fbdabf2a6babfe

SHA512
c974e1e62c7e03a2954a077bdfcebb6dbffd5bd29dbe9a8ffc7c9ad480bfd848f5d00300e17bfe7a5741c2e856b938eb19290f331049057cdaba9cb05cb16918

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
13f5e1757d97cc0d0889a170489855d4

SHA1
5d602533ec9f280780fe802a90343c996a0b7fb4

SHA256
7c606dd15b62cce4a973e363c0fb6bc2d7d54248adcadbbad623ed4174580040

SHA512
6ca1d551491d80162ae155edacb039dce2e603ef6b1f6836786281ac5c3339daa51c7b118260e657c42176775638fb9e9feb2610cbb5a79986424c07fad7e15c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
575b5eef80265d518cc329d207e6f981

SHA1
2915a7f3150ed4d66eabfede58524f2e4be00c5a

SHA256
51a51fbf5dedfaaa6b9eb3935c3383d83d838aa90adbcb4a6af6d6d1739b9232

SHA512
affa76538d381eaef203f8b82322b0879603579e11b4249a2f8e8dc9e86698cf7bb88787d78bf6b7f5b577311c5ac4ad5afb5fdb80cfaca4aa1da6eb83d11768

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
7edefa64197967c29f3086cdd5c99a6c

SHA1
363ecf9e24b6f0c1820887894ab34567ddccb889

SHA256
922aa0b2920bf2697a43fc0ce576c0db159bfe1f624b951cb11a88568b52337c

SHA512
3214fb307d9e8fcbc242d912a26373ae0f838105e911dc499826c45a15240a55591d2aa963797ee10798296ec76f9fadc4091bea3db52a452344d63d77eb5194

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
1d51c3d0cb025e787e4fd57e3068240b

SHA1
0c9138a29dea2f92291fa2b72b7f90983c602dd9

SHA256
77abfd4fea794ad6a1e09c611ea90f492d7de889fff738a4bc63ea7b4958b437

SHA512
d6e3120fdee6286f26fe880d58201d0a25a07ff8320d58b413e7cd7c705fe66683a8f0131ff0b8c95ea1a05393d58f738e54753940e27f2d079009fffcf30c33

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
f74d4def1e20cd7d12e6ca0c92786eb5

SHA1
780af12dafc1f7466c98b75b55c393a59183a319

SHA256
d92e217ad77d478f1051a0f708574011f5a22e01225bb953305d5e2df8d4aa83

SHA512
ab2a845474ecf8201418bf985b0f3eff9e545c9dee5f2c70801e36b4fba8a96da1aac1f0fe08b1d13339230068e736321144ac15f5f4616e33b0fc7b9b615a6f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
648a24d7d62985c21601625d168f7482

SHA1
7da6e7afdf7324ce42dc0f2bc82589471bf74550

SHA256
3bdddac7e2a7657a7ea60e610ae5b58bf827dc7f4540667ca77bd5172f7c14ef

SHA512
dfd8b7a04d4d58b3ae5ac7d52520532d74f2f6e1e8c1217042086fe279980e856e14b65afac9783b7d86f265c7139a7d3c7df3021dc2a98ca24cde18b6c9a008

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
2ca0ebbabe0817ccb2bd357c7a7f302f

SHA1
fad25b33bfa0a5f72ff5aeea0428fc4c9019c245

SHA256
a63e19e5e14e846919ff4c86f2cd31ecaee1b4ee3991d167256f4ed566baa959

SHA512
6c71ba2f1ec8d13c4cfacad60085b1197f388bfbafc5b5d86ea37bd794643d57984ba96c6f83ed33232310c90f1209829251579070efc906eecc70fa9a4008b7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
97636dc0d1530aaaee6cdb7f2f63f99c

SHA1
9bf736d6c01176e696c088339f3f91bdb5867f5d

SHA256
cf2fdca60242fc1cd0d7829e621e7337858cd49b5c6766bf638738ca6c850d30

SHA512
fc2bed1d7fb6ccc444f72519fd286c868a3e99cea292279cd3e8cd187c1e91a8a1a15c8d678f530212f69410a0ccd2b434439991e0b7c791173863e0de94a17e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
55437bd14cdf843b496dc811d70e03dd

SHA1
4bd06636b92e6809c4fd469db3341010d7ac6616

SHA256
e07e591d3ca112eceb988ddf1e5ee97c29d228bfcb21b5bc6fdc61aa083afa36

SHA512
6ee7daeebb4bf8c018da145cfcfbb0076fd6f2a107f1e298da365e7f4017e3012ea81b23901bf2e1104815373d899e46f79c2d42218b4a5991160044801cf6aa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
f8ffe80c39a2cb17186ea19fb7d6a961

SHA1
3b227bb19a1742d91278ac2fb9049555811ca48c

SHA256
0a2969bcf194f7f4d7bb9e2ac3197ea47745df238bcce5adab9a83c8cb31c75f

SHA512
f2d233ef8e1dceaadb6f9942f8e2f0e7b54d1c99e7b93d30df8de267e0216691db7d5dc95671332efc8b954ecd4f965b9665b97dddb7468cd7a86121a1bd63e0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
1d980f2aac6c9490914f424a368c5365

SHA1
23447fbfdfcc2982ba5618aa947da5c1b69383e7

SHA256
5d17c95aa0655de5912f3a7f47ba11f9aeb7e40f360b96b0a28e7324bac25c3c

SHA512
c1fe8d69eb4d5586075a14313d35ece848e6dbcde836bef8d2f306472ef04ed77b25a44cee574b465aa918e7af94bbcb93ad4e5f502848d3d377200161a3954b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
deb84f56cef108266b7db89316138959

SHA1
484e3e9069b3cf8492d9628ac896fd924416c58d

SHA256
ba552ac5a175723942051e14c335088e994d9d6c8afe8e462f6f3e3535f93f2e

SHA512
38855c8b49da342d0e4cfb393e2e72004d9a6a2784026e8cbedf061c397fd98e98ab7c6bcdebdd51fda3f2810b01ec02eadefd7c428c62c8fd01cad655955779

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
1bccc4c216a9e0cb4a759c8886e98775

SHA1
d2e930058ddec81a99321f96e7b3732ad83b2e57

SHA256
9edbb2d705da796a596a5065b831c8f15648932d66dcd4502b1893b8491b4c33

SHA512
990fdaf46d55609e38a57c4b8a479a9ce61b7cd71d757ef036f1e1886334c725ae693f574379a44178427859442f3dcc2e72a1da277064086cce1cc0a4de49b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
e4a01775a3ac3727b3b01359bfadd2b2

SHA1
198e37faf64f34e287c980b47ae20cf4040cee88

SHA256
2f3c4fd091e3c973a1eb098eebba0100a8fe4aa1f6a9537513460746ddb82cf7

SHA512
09aa18c60f33f41f53142d31736c9ba86ea26ae8d775d86b50e0469cefd956d8a82668421c401b7aaf33cda022a7ef1e249de05d37d04cc59143579cdb2f83c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
166e34aaf66bea03f41e4dcdefc0a62e

SHA1
5290f6192678a53c9c52761fc79bfcfd8e52b7e7

SHA256
3913b7f29ac08324735ec0b252283fb75bccc818fed51ed84433eac48c4b496e

SHA512
06c335d2b2c1421b0484c7d3e3c0fbb18becb1d3421652d848b9cccf1ecc5ba23a14a4cdc27744befa2bf1fe9914293e2988ed67373891bf94e2e7b119f9f2e8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
e9b201a8da8e7fa133dbfc42e5e3cd12

SHA1
bc5dce7d9194168bc3624886b10d9bd5056d6929

SHA256
af3cdf7867b5db9dff0cd8d878c3ceac6e722a80ab701e76b998339da16c92e3

SHA512
e6817e322829096a77d2d51f38efe99d17fda90de4703a0b5403399499d661ca62253e167ef019e71d2a800bf41ceaf63194b44f82b34314671fbbf2e9046258

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
d70e2ca46377743b9fb839e4cf1e9e2e

SHA1
cc1adc5aef80e08a713339d838bffd0e1287eea4

SHA256
b1cbe9ff26c50c3f985367a0b587e213fa9b334409676d1a1ed2d09cac11f57c

SHA512
9cc51ecfaa051e9dd9852da49162118638392e981ac66d371028b1154e72e0b19abb06d3a754559745c505b8bc7e39544e39d46b888d9afad1c9e919a9b982a0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
65f072918bf7d90eb7dee2e0a208aec2

SHA1
c40bae5ea7c1077e4608273116512de44bde2a58

SHA256
70e8c8800f782368c6bb62b85ad25a2baa55cfd0f776f8593f040ff4c80b1f5f

SHA512
349c0acbe74f251c7858033c4e31b3807f71f16a4215c2410c41476359a96120fb9e8de98db39867a982131022c38beba79c35043d9e233582b3959f9097480b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
1f4b964ddef1742d45b40c407e9b63d4

SHA1
94804b87b9ba5ec87f5048f63157f0ad1fbb5d28

SHA256
e33c5ba7425ca7ff0deed190713e3b981a10f4f40e26e59a625bb54f5af78f59

SHA512
2f6f597908bfa782625560554179c8d0b7da703951757ccc2d8a06956c38dd4f32208916d83839a15b667fe8ed37bea62cc8b21157acff6ea3e6ec554b1e4ee7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
43cc60d85d7cb78f4208c428668b1512

SHA1
b38567e6c0ad9b4f6ad41e7333d99b72bb7af601

SHA256
8d05134dfaf948cc59346389195795b316d4285aba9da9dc221757762b9d333c

SHA512
a1b25ce8b089f809e064488db2f96ffcc860dd01d70dcdb816fe1c9c4cb6aa0ce902bf516855b515137a3febef990c17c0102c6a758eefbe6d108e6fcb6d8b54

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
30712e4f1740a42323c5d0d09e992ec9

SHA1
52332ee7b0b52ea368e87b05f68d4366a2f5d078

SHA256
63bdfb807824a0c55d00dcf2f4af801b4ec3655ce4645419b97165512f444728

SHA512
d3e162692856acc8a248d8a76821c440d719128e9c81d3d3364d43aceb58a325769edf666cf62aa9cd626b0b18c8c806edd070364f649677e348a2891be6d3af

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
d04d8959ac31f373fe057aa3732370d9

SHA1
157beddc39052bb2032669910267d2ba1ac4425f

SHA256
df791f63a536c985895729751183c07b32ab9f482cf414c159e659cbf8389cbd

SHA512
39ba2e7fb76adcf3e5287fcd3b851909ef1d1f39935185fc9e8115a0c83964316c2296abfecf1da915273036c30f35da64c79d478dce172cd1dee24bfca0062d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
59395893ddc2f29d5ada3bcce7f7975e

SHA1
f108c5cab2159edada56c3cf322b706ca07f7b71

SHA256
b29ed2f0d72d1ee91f9e44e8c8685849cf79563a50534fd43c68fa4d89fb8ed4

SHA512
ba2e40c0661ffc8b95d4beaea510a8665724ec0af4c9cfbdb61cc0a52ea6f5ec0af50e7a134657818c510daa673964aeff9585569721a01700c5623a0a5b9a2c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
a0e68c44a27d0b55945e2124d232cfc2

SHA1
4de8ab9814e0675c2c0bd0ffa3f5b10ca00cd360

SHA256
a069b5dee0c1605f83b25c3add277ca76fe1b81292da0618ef3f72e9db82c6d1

SHA512
c60149ec455c439d225532c18e5361fedf848c39dc1a1911f0b6c01a4f46d68dc90b01f78687afc6ac1ad7ffed0fab2e443079082e8dc5e269c35e0408206037

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
3031bb08811e15b2576c6d4592ca1d73

SHA1
bd9d07877b8758e413bdd6805a4c0ab8dcb49c5c

SHA256
fb4b5834488552338b41183c01334b1615c047ba3ade758e96d5f1ad82b1111f

SHA512
0747c0e62bb32bf563c9a1c00a336301094ffbc7fc2e7ca9143ca1ba3d45a7c15a6212a771c65d5ed469e651e9db9231a919f4364cbfdb3be69c79702ddaceac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
420b44313d65f66084c33ab7bdf5e0a7

SHA1
e9549c95a4040baa154f8fd44063ca1b99e44348

SHA256
e941c52385edbea496d37a5227346ec927eddde25719329111471f3b9dfc4889

SHA512
07201977adcf302d5cfba9333f9ac3b5f3c548f4b243ae15b6f7a942c6e62861dfde0f61c8a492d08d7d02d30d94fb3d43c8bf07ec7afcaa0f2b3ae44ae7ddf3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
c4eea2b9058a41fdc661bdfb0993b088

SHA1
7ef0b62265a3c8204bb40fd6a089379ddf629b13

SHA256
03e3457324f7564e3ba137ed0f54ef2eedb165a52e3205ee9f68731199633f94

SHA512
ba06d5dcdf6a53dcf9b9c5ef64fea6ec0c52028fb5892d70c846ee7f654f6f00d65b12f3a800919be5206a3586274b2eb87f5894c86f5a1d78b451fff6ee3d54

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
e18024545147a689ef68c06a394caa6a

SHA1
be4c396ddcd99faeb159c5c5f32296ed37e0f1b5

SHA256
c2e10c65052c5d54a73cf6261d813d9fe758c05b9210501551fcd6cd33ab3088

SHA512
3318c923601f23d439192c00b330035cb5caacc622b432d66cdd48ab86e0ba7d697b32adb43373be09844427e92ff9254414a504d1fc6a344b5ee681cdf248ec

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
dcc192e791dedf67ef4e3cca33680f73

SHA1
f680f1d16339b24298c017a9f303d08cbcce0f03

SHA256
7b2b2cf05c651a1545df38232f323b5030c8436ff731b4a33f0df781ad3bbe4d

SHA512
245848323ae505d3e74ba26f23eda8057b819e803586030f343d1191f2a85f57b0094754fceb32b065583b9983a8ab2ee9b8023bc48a5eab0b170cf63aaf5875

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
15366475eab3689569cb2382bea91644

SHA1
bb427d8690817f3ddfb48a17d26c548e11ba81de

SHA256
1fda18912bc467eab3d8d6bcd59424ee60dbd40431849b9c493618cb9f20ea19

SHA512
4b1526730cc2e2aae68da7d41216056e476f52ccb9e58b26a65b5d99334f6aafdc80e215b919858a8fb7b32214c1ac4dc282f626e5cd43b8ed97984fa7d95fa7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
530f05d209e9a6423bd99b80d572eb43

SHA1
243ab7c1ec565b0c17e74269693b199dee743b81

SHA256
aa5a6f3503fe0ca2c4f4635a5c0e094aadcf361bda961b49bbada8dcccdccdb5

SHA512
807f5b7d53ba2d03e1730cbf27cf3c02c2dc88e202f709bc0462852c75043a491a8be5a8db2d6d632beaa5f075ab628fb6070b79aa4d6d6c144ef4118ccbee12

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
e7fc709961b37ba2535290aa1854751a

SHA1
ee6ae844b717d821ac627744ee003879401928eb

SHA256
38fe0608c85f89d195b00b79b1ac817741e43a3d050ad7e6a5e81c77fe95c0e4

SHA512
9461df8f37c757603e423de27128454dbaf6075dfe19940ecf23c7502232d1f4fd1cbb7e54dccd223c891183478de05a266a851c2b65520bdba76a314019f4aa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
e370e31a55e64371774eeac4370901f1

SHA1
07d0d214711413340e4b0935246e7c19ad8be678

SHA256
2e3f10a92a08e4b0aa9676e659f75b2fe1e70eefd939ad8ca2221567f7c2065a

SHA512
6b0018bd4957cf15d9953bbc70ce049a23b5a5e31e5ddcf435bf84aa6cf1fa7dd50ac8d5e1f4bad8612f00ff51b13e571b13f2929f77b1e8dfd1666629225dac

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
df123a0bc1604a86938d87a0b4503eb9

SHA1
1f559632c88000043d0b47b7f0456f5a0fa0c68f

SHA256
f0ccf85ba59cd656c3fb9824edaf9b448995e08a172d693128ca3aa88d829841

SHA512
556d0eb637d9aac6d299a2c5d30ad41e4c677d96f61f11f0f7f745b355bc49f61093cdf4f0ff535d683fd4928266d5f86de77359f183bef180032195daa5a65e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
461567987b2e52a58002fe5ac8957cb8

SHA1
cf3f284c2a5e37b563224a9f9a4a340609599371

SHA256
fcfcc356e5a4509674c9bd38b33ac652ac31c11becea799a0acdebff63c5c479

SHA512
8bc50a05b1798608503ca9edc75109602f8c5af43490d2c4b5adce0b04cd251d6b4096396cde050154340d182405a8b3dcb0a1d5119855df0f00fd8bb797c841

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
ccd2addf31f5e403ba48b003899e2f45

SHA1
60fc97c9e340c3e015ada591d73ad1862361f7ed

SHA256
fa01b6d71ec37d1503f37dacce52d88b4d18db123b78922946c52411efcd2db5

SHA512
dae5119be0ecfddd678eb67f9018bb0c2a42d0ba1aaf44d862db18e16406ae7af4f98d12d822d38456619799bd7359815f31357fbc8ac36d4632cbe028fc739b

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
6f41529bcab246216a0eca47c362617e

SHA1
7b333068a89c5719d2b6140872c94be9db0acdc0

SHA256
b276e36d006f7405cae1e65f59cfb8c4f27279eb57d723b4d8886b411fe8d059

SHA512
04a3c9c012be24a45324cb830655852009d8a4a873b52e39cc4e9032d8797f83483545117109e2637af508a466acc6d30539fbec718290d4f574ce40d6a76e71

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
ed9240735e7a3fba3466790d8ccdf8f3

SHA1
4ab33f7dab656acfbbef702415c0cf545f9c8963

SHA256
68c1c780d03e5c261128530de3bad560092d231f2a1b0623774fdb2f4540e971

SHA512
bde0d8b475f112bd42a77d0869004d09a43518e12591dd6d068e2f71bab8f4a39ea4a713f4067145270c6bc600a0f982ddcffb32ab233eefd9aa839290ea7930

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
e486e9f186202d4d1f485a9f67703bc7

SHA1
fc7961252f0281e00011eee92a451686c9e1cf2f

SHA256
47f3d0529c3e24d02d2b8de78b178cfd6864fee5db5ea546d16a044f985a172d

SHA512
2978bbbdd4de5a4aa57e156d4909127ea128cd3308169602be9585db21cb813be8b90622c78024b09b2e843cad49f288bd9828fc2b58ddc9a6609d6d547064bc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
cd43f10f293437ed98b69feed71d30ef

SHA1
16c84001f49586daab1eb7042bf2c74755c77183

SHA256
9c41c70255e2eb65dd4f0f1d7452da3b621b856bd49aa56f6fe0b0a4ea80fe91

SHA512
fef0c266717c493c5132e97976d276b3b101000cc0e1a241045e833c5db1ae99fe4b03c3336873d28e18d378efe3c047c27b0d8ddbb9b536bf9725be4343d1e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
0bb6bc70fefb5d6ef27e28664b39b1dd

SHA1
511f31e41e564f6220b8a332654010bc96c4d5eb

SHA256
d244035662ba0c12d001fbf619bdf30ec4569c264b99e9804e02339942a13ebf

SHA512
25362f4a6a0fd36aaaa4e779c8fee68b2c114c96e593f2cf2657531de39362d63730c43678582be05cf3d41b0e6901fe6bb23fce52735f66655f0b1c84ce02df

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
c025159d1cfa66bd0f263645310d1c40

SHA1
65812dd7d16e8b3580d9c9cbcb136a4d532fae1f

SHA256
1113235ccff58baf0ffeb80113747549cc6216ccf77ede66e268fdd9b8f6059c

SHA512
4d660b55158736649132e67eb5a327d86e694758fd76250026881506656ea1fc3e7659c014d72d4d4ad604410bca097c0bfaeb0cc5f5ecba4beb84b983546d72

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
a59a6116b7e474b75e61178c7fa4d78c

SHA1
8e94b29be68a0dfbb0a2fddc519f2ffe6025a7de

SHA256
41590e4538b9e991c880a3345fb257ef7358a9428b8bbc66f468405b99c69620

SHA512
1e527ffc6c3b084640b3d37e69afac3061ed6a024cdf17a508d2f4a346b61b27e69ff8f5bac9ed72b297a8a7a92231a9c1627673439d46011770d530d56016ee

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
4a25326f91aeb76a96414e533b7b2254

SHA1
ce040bb3f8f1cb07fd84fc7446bc3580cff99b69

SHA256
f0a2a5dcf80529b07ff1ed28e85f90fdf00dc3688fe43671dea0d80e9949a0af

SHA512
a55cdf79ff62fc6f0366aadb5ac00f39628181227ebf9b7f8082762bcc4bb4047f3c6907db19df38d8afddb748e63f6fc8ad8c202ef664caeefc1abd5fa4673e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
e74e7718f15a99676157a315982b56e1

SHA1
f475cd45e6fb904856451d15108bcf78cabd1ca8

SHA256
4eced391273df13a0a0edb50c3838204ff7b7d15fc78c6f106e60026c9d3effc

SHA512
c56b1254105421af9576eacf311a32fd9619ed821ac335b8950796a695da97804f437772268fa0e87cced0a27eac1665a4739da17e1f8180c60b3b44a0f8d0e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
60729829e97f2d6d2b65a924c525d146

SHA1
6ba98106b4ed9c5082995dc2e74d52612f670a30

SHA256
25fca30ab4dce66135e9e39b4230c8707a881779579d2ec7d286e4c4c5bf2b80

SHA512
1051ed12354282137af1dcf9c711b5a005003b36fd5290dd57a27dcaa68009a987134873d8ec4e260e2d211346ba582eb69ea4098467508783409e368a20e436

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
91296dcf8aeab10a563b2d26e98e2ec8

SHA1
88d4663cc67c6beea84708240e902c69370e3a7c

SHA256
f3da7e7103a62f4ca717c23583c01531cba9da6921bed634d247f26932a9c963

SHA512
4b324aa779f90c0fa1229cb14950c9e2896ce4ffbaa701e96a2effe6d5feee852bc9c30f244368eb1bb6e83cca5ea5ae34df122ce4449f2b9e734d0883b7bfdd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
72046d9ce2b319185af8e439624582f6

SHA1
46fbb2926f66469ae85f39082fb46dc868dbedfb

SHA256
fb5859c33f7084e9209e94206f2a1354c4c466e56b9c8bdca668229b2fc713dd

SHA512
17724e6706666ff62dbe233e05b299e52e96ee83685934702204a80c582df11fd18857adb2621f6933104c791450348d358b77150ce739cdd3010f0a4017585d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
39115c4684e104955e2e3d9ed885be5c

SHA1
1d4bd85d48df944581a3c7256698aed2ed4c67ad

SHA256
b553e63669ceea59fbbdb1256c124f529284b1134ea968429d6949592f61fb96

SHA512
2ce9db8665cd2de12af175bd348ab59fd2c84ae89fa692f2d18f1136a536634e92df1829a1a44b22d1088745fa80236a81c55a00e8074011cee96d6f5f25d4ca

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
c6362c12dc03de73a5e7831207ef2a75

SHA1
40f031f521979a778b5bae0806b9b92398fbf12a

SHA256
95131a02d47d9b29c209486729ca3cfcccf55de8fb0709f4b63f3a6ff42e9668

SHA512
7b6ed8767f3377941165ed08e92f7e447420581c847c6c2d39f2a8efaa6f8914feb972d3cc0d477c20877cfcc5d95b353861fb909f36631e5d8fb31788893955

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
48b4013d03cbbe31513ade194586a957

SHA1
2bf75507237532e7f55d1b18329790d582cb4e57

SHA256
20b15ff2a213d1593fd1dfb363a016f7e5ca3ccf64b376c2591f101fe7a6ae9e

SHA512
db2971d26ca6be8865ffad0389fdf3d2ba9448f5a7d6f966f8e51b2fba6bf39107365a5700200d33c1b093d9b5e34fd3ff3848ce8b5e24f9de12529fb9a4a10d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
c7b73603d36ddbcdfb53229659e2d26a

SHA1
5e35bd21b5b2a610c9d60b5888b3c9f100ca5e6a

SHA256
2b98c05f610a373ddeceb6d687da742aec2a76e8392c3ec86462df47b8395eaf

SHA512
36dcf09cb6674a028e5bcb9d73f460fbd9dd613030ed74694d81a6d9ef19f8c0d8ba11829b7555283bb6a27bfb1c01cb3d1ae596c0ba965eacbb020f56a281da

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
724ecd5a2b40a8d03504b9169ca55376

SHA1
064ce2b5e85080d9ef69ef2259d2f4116571e7cc

SHA256
4d9fa55ec08b59d844d26c9f68278d84b16f3c0d907ac65fcb845ea41bdd7809

SHA512
a51cda05158067c8daee54663227a22a3e67b7a7c1593592bc49a5b065b25720eab933fa7dd9729affdd5656d030cfe14880a99cec551c734a636392a28e64f5

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
ba1e382de783b1ed6fefd49fac0ccbb2

SHA1
f6b3d671ef49b8972f1a01cfa449a5ad0d4c3393

SHA256
5457db32e748aa2aebb901a2a9433babe3a365732b2a581fee8c364e4e5ac5f2

SHA512
472b8900e9b70523f894c09c95cad3ba8b68abaaeb166cdc54dfc3292620684e716b34da214ba8d5870f02946db34689b2fd415f4c5ee97f905d64c720a3b298

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
05f3baf319c5096c1864562fa0c8daa9

SHA1
25b7429faee2da9c00fc7607527539eddf79eb0f

SHA256
fb289108d5032a8c3ca7e08d6d137a8496c0f336ba642ab22b7a83899676d1ec

SHA512
312c38dbd6be1194048362699c31a3f88e09013d927ffad899f6162851da28184120e861669dba14cd83b5359ab0ef9c25b96e196ddde224f5df5e6a15ba548c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
c2d5e96be90d8a85cd4c9a6995cc4a45

SHA1
2f6c59fc5c968a6b6b4250c4acaa76938ca52273

SHA256
87ec132f67ac61a59ddbf7aa6e4da52a6f79d23b34957ebcf08905a74ae8d801

SHA512
11cad8e9f3692c1f596fa9aa799a834a203f3d46c5205bcbaec84b929026599ee14ff86a4dab857933b2030a7c1ebf151f460a0d4ab0752171749f17d71fdb0e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
d2e13bbe4583242f4f96784094c49078

SHA1
b5f90588b2ff93fbe0130be85543a52f6b36574c

SHA256
7fd6dcb2a57077153feb1fc2d177787885f14ac2d16aad9404582e189bd4156a

SHA512
f6a7829e471e6df8d62b04eb7e0602eda52fe0c77062c5497a37e35293f91c13a5f7eeffbdfffe7c1d2e6f37a88d3f7bb0f14497602ea6498a3740477f5bd65e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
43b84a61e9ab844b536ad9eb94abf290

SHA1
f2876d609f58415bec216c04621d0834ae6044c8

SHA256
8dbdd4d92c10dad7d06201d31c2939378b5624f8f7f25af1c6e1e8702b668348

SHA512
67c41b8f6df85b1af6f5d2301b009ccb2080fe802c4d1d7c4b0e0dcb280c29b1b588479bc2a0f7098c33f46c80a6ac80f08758927bd998bac281343cc43c0b66

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe

Filesize
32KB

MD5
8b6d120f5d54e227ebcfae9e6cfc213a

SHA1
a4393d1ac325e27276cbef3052e2e20a61c9cbe1

SHA256
c364f1ab48301c5ffdd268743fdd863b7e228a984002b1bd4c7357de658e5bce

SHA512
d95d62b7f4db1e5f4d39f0bf5f51b20578581f32a3c51ef42ec571f7d1b0e1fcc5673dc1e31bff03a5ac0203fae7016ff8e08f95831a2e20b5c59b71bba1decb

Download Submit
memory/2412-2-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2412-3241-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2412-9744-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads