xorist | 9d5cbfa2da9a2a98b99a08a0b97d4136656871af15a40dd13dacbd01380448d1

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
19-12-2024 05:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Size

13KB
MD5

fea4dabc25315edf52a540b1a7faf348
SHA1

86c9e97b498264f8a6f2c3647126f912df2a7eab
SHA256

9d5cbfa2da9a2a98b99a08a0b97d4136656871af15a40dd13dacbd01380448d1
SHA512

0ec8a60abdd22e3a966e091579289f2e5d36ec5535fd2704020e845a8a04e6cd4b74a25f59405aa574e192149e572ab25279a569f557a2c847dcc249fae81eaf
SSDEEP

384:abeRWGOUNBkIcfwiHgPBH+PZioY6UXRB:EyPOUNKIcfwic+PZio0

Score

10^/10

xorist discovery persistence ransomware spyware stealer upx

Malware Config

Signatures

Detected Xorist Ransomware 13 IoCs

resource	yara_rule
behavioral1/memory/2092-2784-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-2777-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-5617-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-7322-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8701-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8933-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8934-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8935-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8936-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8937-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8938-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8939-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist
behavioral1/memory/2092-8942-0x0000000000400000-0x0000000000513000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Xorist family
xorist
Renames multiple (2159) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6upleCBEeD12DgZ.exe"	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\mdmdsi.inf_amd64_neutral_e77f438012239042\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdminfot.inf_amd64_neutral_fc6bcd80e9e6a3c3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_format.ps1xml.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_prompts.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_join.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\HomePremiumN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\tr-TR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_If.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcommu.inf_amd64_neutral_83cc415156be45c8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmhzel.inf_amd64_neutral_1292ec506cfc26db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\wbem\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hdaudio.inf_amd64_neutral_ce7bc199c85ae0a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced_parameters.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\zh-CN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_prompts.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Speech\Engines\SR\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote_output.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_PSSnapins.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_parameters.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Return.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\com\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc00b.inf_amd64_neutral_3338d41663aad5fa\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\MUI\0411\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Line_Editing.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Parsing.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Signing.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\OEM\Starter\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\brmfcumd.inf_amd64_neutral_db43b26810939b3e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wialx005.inf_amd64_neutral_5304c93e2193f237\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremium\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\000e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\image.inf_amd64_neutral_4a983035eaabe2f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmusrgl.inf_amd64_neutral_d42522943de68905\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\fr-FR\Licenses\eval\StarterE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-OfflineFiles-Core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnky306.inf_amd64_ja-jp_97f0de39317f6837\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnrc302.inf_amd64_ja-jp_64ee91a0bf7b132c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiaca00b.inf_amd64_neutral_1aaa057d3d52ea43\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_regular_expressions.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmcom.inf_amd64_neutral_716a306ec3899e04\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr006.inf_amd64_neutral_0232ca4f23224d01\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\InstallShield\setupdir\001d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\npgnbfkodhmaejnb.bmp"	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

UPX packed file 14 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2092-2-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-2784-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-2777-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-5617-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-7322-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8701-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8933-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8934-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8935-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8936-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8937-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8938-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8939-0x0000000000400000-0x0000000000513000-memory.dmp	upx
behavioral1/memory/2092-8942-0x0000000000400000-0x0000000000513000-memory.dmp	upx

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kk.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\activity16v.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\settings.html	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Things\CAN.WAV	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Mozilla Firefox\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\clock.html	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\add_over.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\ink\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400001.PNG	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Mail\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21321_.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\locale\et\LC_MESSAGES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR2F.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pa-in.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\reveal_hov.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\drag.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\prev_down.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Chess\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Windows Photo Viewer\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR20F.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsTemplates\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RICEPAPR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\FreeCell\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341645.JPG	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01296_.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR37F.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\ARROW.WAV	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\settings.html	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0313896.JPG	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14539_.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR41F.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\THMBNAIL.PNG	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR9F.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files\PushAssert.xls	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\turnOffNotificationInAcrobat.gif	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_VelvetRose.gif	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_OFF.GIF	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..trics-adm.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2789aa40bea902c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..tion-core.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_26ec7b03413540ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-xpsifilter.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c450cbe376228591\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..e-defaultcasingfile_31bf3856ad364e35_6.1.7600.16385_none_da58f2b1dd9d0275\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.5\SQL\de\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_6a1946701e0df451\bg-dock.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..undthemes-landscape_31bf3856ad364e35_6.1.7600.16385_none_7a83a914edc3de49\Windows Error.wav	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-notepad.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1dbc2e35304db501\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\button_MCELogo_mouseover.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-themefile-aero_31bf3856ad364e35_6.1.7600.16385_none_d5e81742635a7176\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnms002.inf_31bf3856ad364e35_6.1.7601.17514_none_b06c6bd8d1615374\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..er-client.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_f33a25822fcee3ce\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-f..pe-malgungothicbold_31bf3856ad364e35_6.1.7600.16385_none_41783c072f347b6d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\31.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-i..on-vistacompat-data_31bf3856ad364e35_6.1.7600.16385_none_97f679f8e61134f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..e-results.resources_31bf3856ad364e35_6.1.7600.16385_es-es_bd6813e0c62e7896\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-netplwiz.resources_31bf3856ad364e35_6.1.7600.16385_it-it_17fe62c09f16de60\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\39.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-t..ventextservice-core_31bf3856ad364e35_6.1.7600.16385_none_242b2adec9a10287\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..extension.resources_31bf3856ad364e35_6.1.7600.16385_de-de_c410aef13d4ae94e\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..rformance.resources_31bf3856ad364e35_6.1.7600.16385_de-de_ecba0a69c28cf438\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-v..kprovider.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e43c7fcd4d6c36c2\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netfx-mscorsec_dll_b03f5f7f11d50a3a_6.1.7600.16385_none_9e8b6c6f9c9684f3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.qos.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dd1aabad47906e03\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..5linqcomp.resources_31bf3856ad364e35_6.1.7601.17514_de-de_6d6aee55bd035553\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_bw32.jpg	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-x..ollmentui.resources_31bf3856ad364e35_6.1.7600.16385_it-it_217c15967e287906\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..edtracing.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_ee28eef6b6779742\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_wildcards.help.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-memories_31bf3856ad364e35_6.1.7600.16385_none_51190840a935f980\btn-next-static.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..sc-style-rectangles_31bf3856ad364e35_6.1.7600.16385_none_258f1924c482b7a1\1047x576black.png	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-security-digest_31bf3856ad364e35_6.1.7600.16385_none_96c23cbe96661a70\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.jscript.resources_b03f5f7f11d50a3a_6.1.7600.16385_de-de_e465c8cfe443a6e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-duser_31bf3856ad364e35_6.1.7600.16385_none_b6699ff0162b88a0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..store-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_249fd51ff0cf466b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-lmhsvc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_870d8ab95fee92b8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\401-2.htm	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..age-codec.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_de26e3e44dd8c533\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-r..-detector.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_6e98baaa18d2381f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-stobject.resources_31bf3856ad364e35_6.1.7601.17514_es-es_f33dfbd86161179f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wpf-globalserifcf_31bf3856ad364e35_6.1.7600.16385_none_8f6eab2bb993c745\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ork-msutb.resources_31bf3856ad364e35_6.1.7600.16385_en-us_41eb30efb0d127bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\ehiExtens\6.1.0.0__31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..tshow-asf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8b6b9e9e1474fcb6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-efs-service.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3582c9c330ad84c1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Windows Critical Stop.wav	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-m..ents-mdac.resources_31bf3856ad364e35_6.1.7600.16385_en-us_380ef100709641ad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..-statusui.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f71c681aac9baed9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-s..nesweeper.resources_31bf3856ad364e35_6.1.7600.16385_es-es_eae468cce5c3400a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..ingwizard.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9bfc805bf0d8126f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..r-tlntsvr.resources_31bf3856ad364e35_6.1.7600.16385_it-it_3ae7d50c7beeefd1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnrc004.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b1922a3d439d9ff8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_wpdfs.inf_31bf3856ad364e35_6.1.7600.16385_none_81e1c728ec4cc8a8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-deviceux.resources_31bf3856ad364e35_6.1.7600.16385_it-it_581bce649102203a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-hotstart-adm_31bf3856ad364e35_6.1.7600.16385_none_8668a37605eed793\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_eb806fad92a5e1bd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_nb-no_9b8d0467f7e1805b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_microsoft.powershell.security_31bf3856ad364e35_6.1.7601.17514_none_798013fa5b3040fe\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-d2d.resources_31bf3856ad364e35_7.1.7601.16492_zh-hk_e8c8d75b1c4335e9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-w..edtracing.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_61db79a2ec2a9fe9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-scanprofiles.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6019eb4159fb757c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-t..torclient.resources_31bf3856ad364e35_6.1.7601.17514_it-it_296f911f1e250dc0\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC\shell	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC\shell\open	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6upleCBEeD12DgZ.exe"	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC\ = "CRYPTED!"	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC\DefaultIcon	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC\shell\open\command	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\6upleCBEeD12DgZ.exe,0"	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "FDMHTZNXCAMUKCC"	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\FDMHTZNXCAMUKCC	fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\fea4dabc25315edf52a540b1a7faf348_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
290B

MD5
07f4907502245876a12a787726b39b58

SHA1
f962a9780137a022a30b222b0ea5a1e076cce079

SHA256
0d04e135b6277280162040bf054717c2c76b14f41607c5d8ea7d6a47cb9fc095

SHA512
3c91c0ef23153ad3e02b0be60a2534c3dbdf911c47ba8a07c961acf97a45e1fa391f558fd7f9baef299e542bf1b3db1b267bc21f9247c9ad6d87c4591adcc142

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
c5a35de8ee6b76f90ab0cb02482d5441

SHA1
146b3ae988f9cff799187b396941b610bbb2f1a3

SHA256
58328eeb179547569a0cd87fe6b40b42e1b90f99c422a1931265bbf90796d732

SHA512
74862e59aa2f3af2101afbe0dd704fefbfea86515064fa37c1536b0f51e1e0e50324847b55dd10fedd9b4c5868a97876ae57c89558de1813365fec25190f23f7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
186d9f70fbd2aa995cc89c60d55aa59c

SHA1
fe4488da712b8d66f563b7ada317de633561d97d

SHA256
2f8cdf8fc0078a5e809ddc21a3332544988f9d4320ed1211e562777b3850265e

SHA512
0361a9bc8283bb8052062dd8528b5f7fd078223a10b6f59ef530c64656ff5ab28a33398083d03ed1ed1a3507a36deca4cd14698d298afc867a0bc72ce91c355a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
f366ce03cd0f7caa9d003121b78b5d1b

SHA1
b51c6a19ece0529a7c9e8eafcc2fe3ed28967ec6

SHA256
12b20323b3839b28934a77631b575905abc10ee31a67638a3b008192a9145c39

SHA512
a55646a11a01e0523bc7b23533d690a886e71cccc169b8c3db5e31f64aca9d5a9e0aa1a038fb5695d29f2f05654f65e3174b6c269bee236d6289a1b6240e62ab

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
92db78d1b56635ab64b856586f38c644

SHA1
0e954df0bd1dd17a8991982c5b3ba6ff68216851

SHA256
e0ca2808e5558f8ac8bc048857a677b63c37a9aaf665d5fcf9b4609ae281100b

SHA512
18920c997b547120db6efe3d4f420ad6e828b77c9676af15cc23792419a16cfd05a5c7230cd7655a5cf37245f7ff7286e757f413300dcee2650a46db9a14e003

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
f3e8afb7c718140485515c8c27289b70

SHA1
4c5ccf13315f65ed7081ac03ba6b86614dd40d82

SHA256
17055d03597f341b11f917a7cef6693a228ab19ab4a4d53014e3d8b9a54f3b4f

SHA512
9fdd150a571ef7093517a161df531697ceb5493ef7b6ae7af56a63140f9e15cbe32d261809918f16a7c9d397a36b66fcefd168c091d3bd58d6ca0b15f30ac86c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
9b182f499eb99226e036dfbc08fc368d

SHA1
3e91a2527624b8854d8251e37f9c07d260053f63

SHA256
5c2bd8d236ec4a66d0d00f7b6adf9e1e960d096affa522cd6dfbaa0d6d3becd5

SHA512
c4efb5cebd8f2f1b1fb3208e04912083c6ae44376702d5a81fe21d67d1b1d97e4cb347413f6516f45d114ecac3e04c9c92197005abb84882cab9644151b70d5c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
6dcbc86a9e66b80da293b31eb89cedc2

SHA1
878c0e6ff71d2da0197ed68d9420826f9c4fa553

SHA256
3d447311f0a692d6f09c4158904fe0d4c102dd7eef3363c1922252eaecd40606

SHA512
25e392173cee89a03734cabe99eb811683212cec01a894fe46b77bf49987259ad94c943e38bb13d6af47f913d77a33617a23430647bb566f4d73972bde401465

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
f54e7d85b195c96302df324945ba7b22

SHA1
b39e1d9b07138825911e2cade2e288593ee79434

SHA256
3219063b868e2e161b1d7ef26c15b293e74a552d3ad8f7c1fd3043118ffc2434

SHA512
4edd2d45c983e8a6756702ee5ccb4ca0b0d782635c83cd27691b4ee00dfb5ce1aeb1f685742010dae9e7f51e6c92273320af33a651c68cfebb3d7db94c3a4d0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
3365ce4baadee8af9553bb012dcdd052

SHA1
0503bb18ea162f9de3dc7adeb6a1780a46a604d6

SHA256
81c34fd2e2bfb41552cebbd5f61eec015795a5aab7f625cb8b69a2818e16d595

SHA512
1022158ee3134dfe8ba92468241a7160f3a284edceaecc3d74c89fa9ecccb79fe820a268be7c6d86f99202b1f97ab3933fe8a5b531611f678b1f251b601e6c54

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
8f3cdf8aa7cb4574c559a808c2e7dfbd

SHA1
54d7d99b539ac8ae6e6d898fdc2ef2599f068311

SHA256
d5af3e054509423c9260d04943bb159156a5d56abc7a75313968df63bb91d8b9

SHA512
f885e2c15734eaca033408ffdd3e582bd0b6e2c2e11124de89d2c848158bf37f906fb7b44da74a8d4ba09a5c2bcd8ef3ae52e30af3d2104f2a521eed3ebbada7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
6735db107b9c7b60d931df3b118e4d0b

SHA1
03ab2517ddb232a462d4e946c2f9614baebd844c

SHA256
02ee61b3060ad799a12c28d5a6ea6c820ceb1ece459bd9ca68077f1a2b006529

SHA512
2a5182c0ec05c4fb82a055d4741b3f4af01196ec889f80dae7ec606435e92e8d0d568f000327501bf8629851f9111930fb7f895ef51f7ab35c2f22bef8225134

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
37293ce5933014188f2c4405e1de9e39

SHA1
53c6f268f008d1d4192e1b6a3f2b2aa5c23eb318

SHA256
97f545e8a7bc638628a31f9eddeddb5b6fc44dda482af47d7dae3352b9d4faaf

SHA512
ba65bcd31065983f6dcceee7b12b2a3d1caebc38a301f1c447117efb7dc92ba564f039194168dbd75d576f811e0e83f047c99d7d24b64521bc79e10ca9927356

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
a0041d0aac821e259472d1548c75b5e8

SHA1
e959e38303ea0ee8796ea15e3d438f8a44004997

SHA256
8791319e99d73c6ca2dd79c05fc6848f954f063b1c0507a863c43d4af87f8b5d

SHA512
9cfe5fcc41630ce18f19b68b7f2d2610f5040da894876b4985f0a271260132122fd8b5849c73d5d98f20a05ed22c609587e056bb1dbb2f9d580939dacd12c674

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
24b77dbb844f01b2639b0c5c029f22a6

SHA1
46232674f6f8d5941f664e211caf2add45d1495f

SHA256
83fa6cf2937aea6c3918b6ab0b05ec2dad4d8c1afc005f3cd9a8e04000801017

SHA512
054c91ff45d6f271b8b8470c2ee39eb6f16344118c0244a186837e4ae60216596c529a85617df2777dfe3255cd9e97ffbf50a4ad0a2ca6e330f8c3bac4bd3e7f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
5d11e6e0e91abb788122d47bc03dc5ed

SHA1
d5327805ae2d391a450ee84b3860fd4c45ab91dd

SHA256
0a80f9053f70139be6f02fbd41a8bc4bde05a8440440056b6b7f3decb5124957

SHA512
e4e1d35259debd4b81876ab2769fa19b08b4e6726a3b76b2768be73f2f0678645fa2eda6302c2dd0746732999493ff222d6a11cf2a9966a10f3c097e7720e588

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
f94c7495a9cee61186e83dd85a7e851c

SHA1
5adc015a617acd567bd2f5adcec12680dedd7b4b

SHA256
536644acba618d32266bebe403af9902d0317851b43babf60e9dbca9f456f4f3

SHA512
6d46ea0e56e186711f101969beb4a692119db6efe406de8034d2e95a8e90bdb8826d704993365bb00ab0fc3937e1730a5a4333fc2f2690cdd166c5d643a49f8b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
a64b6c4ac09b01c93a08b57dbdbf9f7c

SHA1
d675fd7e13d8bdef12d4830da368df13dc10951f

SHA256
fc77ebd492d849f7bd7dc44c81d60980a166b076d7660665aba573a58d5ce941

SHA512
0683e820de6b16e61d0f4da90bab768eb8dad23804f7f56de002862f3159c89a8a21832f8f5fbfab74c5d7fc6fc24da7eefa84e5cfa772d5b596464b23b9ea5f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
8962c2dbf7b1c0951d105238e027bc51

SHA1
f314ab5a644a8853e21493c9360a8e5d617f7c70

SHA256
c560174244ab28e9d17ce9624186bfa54954a1b0366752ecf147930296daf888

SHA512
09d0cefd4b6b986722ad191304a1623af0beacb57dd04a9933c90aa16cde8324b4f5ca18b7c24c7c10fa213e6d4e34577a653a2ab47870413123ee7464146ec4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
529055fb0ddcf690ff6125d1d3e3577d

SHA1
3c78555242a2a209c0fcd768b37bd255bbb9fb4c

SHA256
93b91103235a8678fc8e33fa5e1d8c1b9bef293f93d86e99096d5f0c5ecea77f

SHA512
b9d1654d030a86934fee3ce6c94f0a08d4b8cf3dbd5ea872e7ceb88757be94cceb9ffbe20cb6d23cf9ec95b7c16722532483a96ba01cf55d86ce578a0f7d92d4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
eb1dc6c3b089d59c46b3747a09ad8d64

SHA1
1c8958e1a7a875924470092fb683835f0f5a2356

SHA256
0f5cf86b2904f83dda1001a1386961cf43626e5fc4e33b9c901d342942814354

SHA512
2074c0baf36dc36199ec7c554953061fb008069c6114a8b5249253cc2870767dbb60d446846ce25e66247031d86b9f934716ec294b23da4112e62d340065cd08

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
f9bdd52ab6e890159a64d1e2f14334ce

SHA1
ec3537743fae37ce8878d254d83819e553c3cda5

SHA256
7900ae65baf8786ae348f019a8ba739eee015586c3f792a738d34d75b87406b3

SHA512
7185b82e33d5dea3743174271ecff9ca7454323da26e8567c2594ed2bb552878af84dc507713d2a5c8f8678a9c661d13602adec3483958f9ca10835f39c47125

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
63240b811cfbf87f06e1edb30c42ca61

SHA1
159ed19a805de5eed07c4d7e3028ffb9a6508d81

SHA256
962f9e512641a3fe60c2b813eca37818d9e169ba95d83aa6e9cefd68366c109a

SHA512
31c96e614c9c4990588ced8264f5afe61ea787c92b751c1b9ca6eacff3555894bb8a82594a06439a186ad3701a046972478c11d6e33633263edf028c3fe74075

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
1ab5d5ef3dd4d6b85a66d59ce9ab8831

SHA1
807e5c5090c0bd44095283905ba628d85d4506f7

SHA256
98cc960d3e9bc5f84ed72742dc806069337f9f581c54f666be92e831011683b7

SHA512
ba47f12570a409e7ecde5312ff31d2ee90646a5cb9505ea444d24576150db0d41ba07d6a760b279faee2f1eb60204b23e935218b371e416be2e2ea6646d7facf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
64ccd6e54d6a92556fbcd15f9bce5799

SHA1
79ee3ea9ec52b16e867fb4a80cc62d43fed5e254

SHA256
a7af601e498dfd74b57c4f3a23c2416eb379751aa6fdec3b6aa224aa5d2303c0

SHA512
11704e640877938a30949bb0dd80aa0ac7122ee1c5d46c0b76a74236fdd2d5d1ab630452c7efc1afd2278fbd01c45260274c3fbbe829395be6f841a53aa21266

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
8af4a8b58f1e4d8b15cb296c4a236b28

SHA1
179e1d542bf324679a777bac7681cdc8d6f5c84e

SHA256
7a0eed585fe97b88767d0a8467830bde79593576b5371fe8bd26d8eb537cd9ee

SHA512
a5d2c47447e9c747fa4ea31e8225b254c2dc8532e9adecf093c9b106e3948fd2c3597f3cb9ea2a4ef8167da9035b53d5e922175fd6d95d6d203de09c6b6522d2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
299d7528b34aeedd58c497685ac01aa1

SHA1
30171bf6b018e82fc73a67e3e091621e73f99b22

SHA256
c7dee522b461087234c0ccc3e8f3de4dba1ebb454d0dbaabbf5ca0243eafafc4

SHA512
d0e0b3111b547c01dc4259476b66bc5fa990c5c828fa60acd6e9661435f8a25167dae3ea07edcafb4f4e5234880c510250a546253691344aaf3c69d2dc77b61f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
0460fae4129f46d8a443800b98b41621

SHA1
7ab1178befe18b4536c8c6f27c715d3bfcbfa346

SHA256
4f2f40703196d35bf94692ea80b432c9888431ee176e6a5e58f07fa906f6b4b1

SHA512
ae637d36cc91df0912ac68420fb82f7aec844496bd0ef331b8291fbb3898db0f62836e50fe128f1dadde830fa985d8231aaf91f0223c1545bc5eba5ef6882656

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
c980afa65a3b87eb0bd906800387ae73

SHA1
1a764b0b521f7f519e4b0c4a8787e88720668191

SHA256
bde5d6c03479ea73c5267a8a2207bf49adcc7d18c5faaedfe19bf06ef1eabed2

SHA512
377f4a997d286898560d7c1f150c1e630694a97036d699263f6722b5d8685152785d4498046481eb6d4c28e0c0149eb54011577567ce0670f30cbdbd8a7fefd7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
999219aaaa80c859fd68566058081581

SHA1
08fe2fb0a6d6eb7ce896f4a8e754d1880d6fd40f

SHA256
db487b811bf0b9faaf4e340416a06b3cef029cbbf321a787d801b4d03f766ebf

SHA512
1588b450152c394d84cb7b72eb9c9db2d63b6cf9dcbf52cccb88c9880672b0dea7e07bacce9a7f0309ccbd1fb04a60386eab0f429566cb474ff52fc575039134

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
f420395692e110625a8e8dd6bd4de753

SHA1
6d4b9f50ea00951253e8b2cc948c726e4360c7ff

SHA256
c3c6257c56971ab870dd15db8e54579475a86ffe4185b5a13c4e0b0bc318b1b4

SHA512
fc700bdbee8e4d4ace594a22b787a2243e4424959656e27920aa1bce18847ce1fffafd9ada096bf3d4f2ecf852d17a2b0cf385bd4c68842459317de36a2157a8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
02fe69670bc0c092722a91b9943e57f2

SHA1
b71b321a25f09c0e5d24fe37adebaab9dec529fa

SHA256
2b2c34e11c91ba4529a4b03550926696d5a475c0619f2d25cd7c414443e9610e

SHA512
bdc487a0478a6e8ebc1357cde5164a3cb0fbed8d166ddc89128f70911864b70697afc7a499e387bc093081fcc72300c01b425c0a09dcec3c68a1a87cfe97b715

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
f09918731f4427cd609733f7cf135e5b

SHA1
20dc876ee8f253533b778deab8e68a8c354f3342

SHA256
6ce96d48872747348ca18f1a5dbb85c12d45d1799dabdb706c56c02cf3d2e5e1

SHA512
c038a2041d18b17ca402b86c27919ed58b5c6433dded7e3370ca0d387a4d94a2177c06ba0185498c93f4502d0cb2b035fb8f72d11117fe514adb94c62441bd07

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
4c5b7a9020c4973f421f26f150d090ee

SHA1
19f2ca78912a45f28a2801777e06e8e5f727df80

SHA256
b0cec1f5e023de96fefe86d3af4d181cdd6178a8bd90561a756fa11c4b6a39e6

SHA512
7bd56fc1d97b7163a60aa68e7d0d7dacac300252ba6342aec8f2b7fecc95343a713135a2314c2dca70df0bdd40f226a3b02056b8fafac0eda338637b41bd0108

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
ce235eee74e616e6d3cbb72491e3d5cb

SHA1
4e261997d610baf1cb10451816139829d7efddc8

SHA256
3d4d4249e138160b08f533926b360a94ddce88eb2b8125fa9c426af5a82d5bf7

SHA512
f6f4e028fec6216cde9cac2fd4c1481ad71f63f2ac7020c2f0d78bddef9c24e1bbdeca0bf0718e46ff2fb5542f6dc01c0791b1913d7d42b087344962b46fb0ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
fdc1bfab247396edd6dec844595aca96

SHA1
e7e7d7434e0956104af68425f288d6e030f5f76a

SHA256
44c35dabd64cf830401f7ae66c3d835042099292d566857791662063c38e1615

SHA512
01be776ecc2a43240a2253de844d01a31b30ffb99683c01716b395c4354dbf91f6cc98e4ff18b2bb9c4e61901503c8dddb7c4837a8a38e2ab10ae7bdf46e680b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
6a782cc96c73f0f8c1bb8deb413d189a

SHA1
c1bb548456aabf8c217af4ac5877c2d38b33875c

SHA256
ff7be2f962bc1a77330dbdf76681e05762fc870b0f053b53547d04c85b1a07c4

SHA512
0c4acdd623c7e0bd936f1147d6ac824a45cca3fe213aeb004cbfad9c7b178d774e4f8d6e8d0a9cd2182fb970d40503dc83e9bc032162c12efebee50da527c652

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
6799c3c48b91b7c6bd065eb5b9cf158d

SHA1
60c120601f14558e6bf51e454ae3b97d85ed18d6

SHA256
8fe0830d13684e8cbd3b45197e889e521c39e95b28aa1fcef76b573ba18e49d6

SHA512
5141a42ca23002ecc77a8876e61f79d561589bb0a05407cbd773f21064fc6cc09f520abab70e6986c3c428b85513a81fe3ea6f7c417e4a89b8f79ea577dd6f17

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
745ca7c9dded3cc5567cb7c52a7e0b74

SHA1
3c17b2bfea36418af73d59f6dd4d9bb0f96d5005

SHA256
5019781f3d58c188e98ba9b3e2f075b242e02cacfc8d264b0be54a83de7951d8

SHA512
72bb296ab4472aba5f21d22f09d514eeda0112190f2991998eb1bdb7ac4e20be9500e8a06e93eb8d24c8dad944846edef79674ba6cc01a0a861da5b1776e492a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
b0a8f0f13468de2e820fe8e9c4abe5f8

SHA1
13e58ebe78e7e56f9346358d1752356eb61ecd00

SHA256
298316be910ef8ff8d291581ab2e6c165c44e6aa5175cf2e71c31c59a9743f7c

SHA512
193c6e95b62dae2c9cab4a337f66e32e5a2225f111eaa6b7de7dc7d83d0b92c439785efee438bb92c7441057a6a644fee6f2d19bca02a5379b367330fe297aed

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
b5b2792a7659502790a1ccec39e10544

SHA1
c137ce4fa5c2f324eeed232ac39fb5d666d0ed29

SHA256
40a52947d2cdd0850937aa1b8f14a70454a14358a142e157b2b14c1727a60e20

SHA512
0fdcb33ee01e9b98b080f953407e682e3f865ee8fa6c7128c99f494bd5bfa5d21ab2c3ad3abca58b179db9f33df3d3ddd0b5e04f30eb94015ee34cadf56678e1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
596acb32ede0c002b9a020f6156718dc

SHA1
6cdddce8ab8728e08d744f68659e516493c1f0f6

SHA256
a338ee368f14dac08370ac4f88ffff85c1d1b9e523835198fd0c47cd16a00dcb

SHA512
4dd46369e5588065717e23d2c248f1ca36b190159ae60ab2e6136008aa012ad8e8c65358d5c8ef2ade6fc3bc727207a0b2a1f2191b09b9b2d2a2d85098f61e15

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
fc4baeecce8bf867c6cb33704fb53200

SHA1
9d0231813697f2181e1e14d865ec97eb123db424

SHA256
60947e3084d040c86b8759a4262e0fbe485ded346d29d65c93dc591b38168276

SHA512
3e0c773fdfda308650241a19c4f93fa907ec3e7ecbd5360b0be8430ec48cefe21dcfb5d450464a2112fdf96c876fcc08ea210ab409d7345a345975c5d22a9431

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
fc6adf1853dcd546357153d5194a4e6a

SHA1
07ffb9c1a54a4f9deacffec9cd14328eb93e8b5e

SHA256
795376d5f1e886af89416b3a732d9ecbe634cf0dc4659e105527e2b067eaadbc

SHA512
9822a153992c0209e537fb5769d2a1d654d5c08c166086cecb8a77f9a5e54fb05d1f6756976a87ecb0d8e45c8be3168074486adde882f98aa5466164d08c6906

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
8a7b361226e7de59de4a462d8eefd18f

SHA1
46b8acb56786d895f589c0596e130b4dd13029ab

SHA256
49113c0b95bbc33d8c093fe8941d365533694e8a87fea4f340d7c091a8c8f261

SHA512
ef547d917a2d332f65a2e94b05c7409c178789ad5d4127715a32eb79e33e3445bb2ce976ad46706ef72637c0e1c08bb88312dbeea02e522cfd81b759b4337343

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
cdc799223085c0fe2282593897ecad19

SHA1
1bc33d66ad0f4b937ea3ff7963a248ea2727c188

SHA256
a77fc02f6964d6343638fe09f8d79bb3f6618331d9b915c209d325a4eac39d9a

SHA512
f2539dff3b654345bf40ef392de2293b9bc56403de0c39260d78147ec1b0818abdebfef783b75057cd137420d20d4b53f039df106fba7a21bbbda46a0527c3c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
e5519910e8aba780b53d5224c6b0d976

SHA1
a6ae131dba02f4ba2c0aea382211bd557aa8b40a

SHA256
79459b806d6a38f2d4faac6b715ecbb6afcb1a992f738ddf7572bbc898ff23aa

SHA512
de195d18f775b4fee1e10a736f48bde3af9989377f82b98d9a1d1aa4bab12ef096f29f2c363f08ea0ce38f920f4704b8f475551fca5992556a233224acfaffce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
5b870ff70af017609de5b2ae389192a3

SHA1
ba71ce9f0d412bce0fb41b505246fd554871ced9

SHA256
f2ff106b54d93eb2efd0ddd6798090cb7c6bd1360f4d9a23297b1a514e95353e

SHA512
aef4e263ee43302e53b548d0719f92df39663edb7c9803423959703b9fb5530ffca8fc622d6515d7a94f2f1eada5a37726cd58915d0e1b27ea13181069312357

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
12f7451dd655d8efd3088cbbdfa993b5

SHA1
3faef4a7921880050a9feed53da79b7a7aa3862b

SHA256
bfe586134401edd716216e485072eaabe4df615e99a38999679533bd4b1c8559

SHA512
e9217d488ab1e87e9702bb1b21c4bb6a709393818cc734343588768a830059c1f584036573ff7e7b898f40fe48bb20339464dc80b782821f965f8675ad00b37e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
e30ad5f2e6eaab73036d48623843d406

SHA1
0f1d134b8e35ef725a37c6bf22a94117a7665a7c

SHA256
f884b64ab1becc338d58ffa0708109206bba42f87bbc8b09230c3dcf2ab120ab

SHA512
2eaeaf4121309d43ed0090ab4c1f2e8fce8ce77649f08f04ed6a16cdfeb6b30afb988b8e94ea06e1cd0ad14035cb2ad7dcf0ed887733000b61503100d6b9d64d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
030a13f2f392af80affa45da67a7119d

SHA1
9fa356ecf41dfc8b79e29a14b99834a543b2e1eb

SHA256
b5edae610ba0f0cb14a93546ef69317408df7c34d74e554b5dfbd32557ff3d7e

SHA512
3de9c257454b967000a331492b84f0c9b73d9529fe47dfe4b334dbdb1d262dbd0eee38c1da791850455096746860c99ce553c823f36e65090b0806a5fb747371

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
c7ca8f3211cd2c143e12ba3f1717178e

SHA1
59bf58985d787dd4f7a29b05ebe44a3b4eb540bb

SHA256
dedaf5a6ee3489445975d0e60f9d4ce519fcb2897c44029d191b14c600af26b1

SHA512
369e19e3637d64fa1f93dce9a1db0a4c788b557bc83f61c0b435907466bd2a25a9effaaf136125c9269d342b11f0cb847dc6b3d83ec31a0784a4dcda2475f8b1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
cd9ef56d88b2d0820e496cac01115d80

SHA1
5d74e14fc2aa8ed7b29c2d9842ebf36e04e45dfa

SHA256
5256e48edf82b35ea8e65ac5606a0f022fac858673a9ace213d063ea7fc05ea8

SHA512
0d5922080d8d980ce0bedd5c5d07c7a44a229e0ea577fbb7b820dcab9103d171a611d91b9149c40c6bc1f101269b6f006f0e72a237a1ebdc3d6290e14c0e56c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
1a710a420e859d3728e0c76c6b40d793

SHA1
e431226d25cf33e31b6a00a93a2568d4e9651525

SHA256
238de7abca27fbf6967b2c69767e4ab8a7edd24351ad72cd2c3afa5ea5de8a0f

SHA512
3bd3d52239856b324a73d77211020f1f47037bc1d7cf74e808af0f05c2d81037c15fb03b0d80aebd744b62cc70f8affa12c513ecdac6be89c065a2131525c09e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
a452d5bf964dcc0deb2ca90a8f0f8c0f

SHA1
989e8207c3dfc6d8541364b5a5bcdb2de0e59fab

SHA256
11290040731ff6c7b6fbfa047a04fbde63c1f266f3d3ab6645b0bb3c011dcda1

SHA512
4160cbf9958c84764d74ea6e789bbffc467f1d3c3ea084588c3c62b80545214660944863121d096f218056c8aa53cb10e805156b58e1154503de3566d636451d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
194d3a376d0cc8ee9e92f912fd64e6e9

SHA1
a63924768b22ebe4cae2e9ed098c44f3ad7342f3

SHA256
49183bba5f1d001b7a576c2694ad99eccd2596e07e0f0335b1edd7449d97a8fa

SHA512
a392e69dc1bf57aa489cc4f3f49917fb873b718b52f62f64c3ee6d3259b0353f00338c0b660e62993d13ae74a9db82caac04cb20dac5d2a203d0c5b27994370d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
e9a311d2abfe89496c84f1b0beb8975e

SHA1
f1a08f2e1ae00f4a95fe5bef1933288592d16a77

SHA256
b01dceb737e2e01ff59981dce23fd4656f0b45fe612dff710cae204937255cc0

SHA512
d481126cc83afd154983d3d0954a5fb3c89e3f5e51739817c56fc1f968baba4b26c66e9971cea9613b645f2a0a068e24962bfc981727f3d9883a8b959f0ab020

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
6ec98d26626dbe2e02d28b7713fd2c6c

SHA1
592cdbc602c86ec3981d17a0f809d7fef59465a3

SHA256
625205480fcab64b6f6835c8293447b0b6ae44e416c63a0a664a035a37a90d33

SHA512
1bd5c26d31bbbf24cac5d79d4f3c42e71b207bdfc3f4e858919d56efa794171c4ce345ac6c5d096511c4098d40ed5802c908d6088c8f3007c31f45a5a2400b8d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
0fb9e127e4fd33454b635badae766765

SHA1
2febe922e97bc7f73018653df7a5f253be529380

SHA256
a6f86d8e6925dcc47d02605c0b4d722eda3897b5736ed9cdb7e65ecc00ec042b

SHA512
4f9db585c2abb4b8b3dbacbbfb630280a27e94a3bc2d14011087229da58833544fb474ec63a44f10bcc7be304e1dc4dd8b866566858d61f944a45c2cf7059f68

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
9bd7c9eb6e0b8ada62934513fbd695bb

SHA1
bbf8ddc8cb7404c4094a4716b597c88b3a695b6f

SHA256
9406cb9325b762c13aea5274c98ccd00af576aa70501386fafb9844dc84218c6

SHA512
bf70ac96807be11bddaa8044987d36ab077f8b719160ee47727c2034ce9c4b34e5dbdf073ea81d7a9ebf92515721977f5f4eaf6efb897c26dfa04a1969486e7f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
d57c5ba4418c3fe24b00b504ec146a90

SHA1
c404bd9b269afa25d89170fdc9d1d4a3fbde4d1c

SHA256
fcd4b4a44f520445f26e0f93bb2655f077425e56e44b062a83d3d2952bba27b7

SHA512
23a1c9b59553d436b986414bf7d64d8c7098467215482c9e03a331c6536230bafc7fd0fe42f6e49892e4eea60aba0d1e8e8f37717a04da94fb22a0d9cba8f5b6

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
e08d8b17c9fd46c11ed5b2b49972fce3

SHA1
cf2017e40103899f87e9d6b72a36b6113cf64453

SHA256
16f06c88e7d04bccdcc08b6ac926ad3f3e67cdeda9aaa60cd61df5a6b2be17f5

SHA512
914815ebb0e841294d2bbb5fd6aa5f0ed0480d79c2be065cf92b4160f160c5c7fba59801cbd2f338908678fb6915a84a0f0c76db59a9e3c457ef969bb23a608a

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
737bc5c597d9ef32ca2ca36cf30946bb

SHA1
ca39a0cf1575cf6c4e25fe9a1684f8b26b1ebd0b

SHA256
ae508f5f60f2acf941b545c88cbc799758f657ca348a2c21867734d72184407b

SHA512
af6b8aff8280bfc119842711692db8349fb3b9627274bc3ff8ad015fcbd76c9242ad0f5560815d387f9b7e963b10d6bde71d720fc0bb666be9b1c85999a1c4a9

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
e7b73abdcf43aeba37f1c12ab574566e

SHA1
1f6c057132ee8099249a18fd3ad9f099c8c71574

SHA256
822a1213b4dc8204d40a452451c48d993108b9aaed63741e2478a8c7f94dbe92

SHA512
736a07a156e7708d8ebc4f0825e2d8e553154b274857b4e44b7bce814505553224d2b50583e991b6409be15f6b5b637b1408e3515b58a7ab81203b147acb9f88

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
45433ad06457554f332856fc5ef2417e

SHA1
240b4975124b29b5be6af744f873f32cdf9ae53a

SHA256
5331b1965aa71b4bedd82c1774f20e9277468f1648635bae755d3784be88541a

SHA512
7ed93956868793cf67482463d693ac12aaf98ec385923c9e04229fbe3fbacc94ebd7f61425b20954219df0fa59acfccd1cc4b618f3595cfe95e1b8422d27a7da

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
83aca83c3068a712167b2cf8a361f20f

SHA1
6d524d6d687d12d7558b15aba9b3af277bfb8fe6

SHA256
b09a8003e964bfc95b7ad2976ff39df2f1c5eab7d7139778e951e9890a0df67e

SHA512
39fc399eb4296dc9962271a4863752215a2b050797ef741455f1d1303d3237468577779d7bf1c95dff3e777769ac5e3ab713acba4b757657f9461c0421b6d337

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
4d092dc08a3331e45926653c5cb08af0

SHA1
777edaba89c4bdf540a6d2c58909a857553421cc

SHA256
1d275fe53ea6cdef397f671f91ce53f333549768ab06f44b224d047a727179e0

SHA512
c5b2af9f06f0278ccbd61038e9bbc08d1bd98769e2ce2533e94e8799da402bcf8bf5d04bfbefbb283eb2b5f65c59b42d4edf56d8ff8d97a46b4afef0495e32fc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
4d88fe3582672ac433daae5e540d3105

SHA1
da046db02e8bce0117900e9f353b0a83e8944a77

SHA256
ba8a525bb906879fbe693735a745d8dbbdfba11d8569fa44e3e1c389fb267008

SHA512
47be81a0b230527119b84b61d84c473399a701fb071568bd3677baad3243417d0dcca4eb0c575b79cea7925025847622e60d3e20420247755edb4736c145c40e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
c9944f03e526859576dac63006705be3

SHA1
eef54c0a81fd564c3543e7fe80149dd9aea4896d

SHA256
1764f6ec727f1c07953ec708fba65b4c3d10249cfc536e30e14a27239e34f0d2

SHA512
0d372d11728290c755875b6b10d2deb7cb997601ec8f9f223e1616ab59b243a02edb0b8ba4dd7ed7da6b875db92fdce41065070015e9070e46ef0f301933d280

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
69853d9cf29c76d8d5b51d20b425bbf1

SHA1
a3d238ea8dead7f9201d166f906fc177bf8801b4

SHA256
462e4bb55831395f2cbf8a9bed33e7660f2886614c9e8cc6a8e7438bffc881d3

SHA512
1611fca7f25398beef98566071c2f59accdb93a96a9c0fce664fb7342dfa9bf5227f768f948850eeb7e154b01e4aed127680c59f445ba92ab579a1250e1388a1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
10238e6cec736b9c254ad0d35188798a

SHA1
cb4945435f3af01821bbfdddffdf9b7034953b45

SHA256
5fcf065fc54a826c3fef789f94dff915dc230544ef440c53c54a4c746f17f001

SHA512
fffc3c0eebfc0bca3312490fde89335567353c531a6f53db35f8310aedc416acb11f9b0b9a6acc4b37bdbd196c778d4690328d2a080d37bf72763f5e165467ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
0b698f5de0e38d0b445aa98490f8a7b2

SHA1
5963777f6558448dbf6268032f804a4b079cdaec

SHA256
1017b9f68a9bc8edec3f3f789f3a9e5a737fcfd9c374a6950386dfaf06da058e

SHA512
9a44b670e2a136a26647f8b16cfd8d565fe2450434d60f5d58c7011377cf96b2debe7237b3ad09c502fafaa917c1b18d24cc656f374396d0d8a75e5dbc70d121

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
13fdbc11a635f54ce3c9e8411e55d64a

SHA1
2fa6a5f5a5bb31a8d63d0cafcca13d6f433b665f

SHA256
1f74b8cb7a23fcf4633be4156d1bb7407d4bc218b84dc0324592a12c929bbb28

SHA512
b92c54f323e4af02c5b48f74439785693bc7b4db6cae46080f8c53cf8c0ada619790967a3bf73909585404a560f1e186a06cbf4494c8a0b0b7f2f8ff5bc0e0b6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
4d6b64dad687ee475e5c3cdbf2607bfc

SHA1
9e5eefd52ac081ddb95ef6040d189c5798528da8

SHA256
89177d10c4c695ea9469af9862bd3d0b073ecc0d1c223fa350423f12519eef1c

SHA512
9da08b50ad77866e1e346e9b99ce552d28e43afb1423f93f7e1f42672f461f4781dedca414de3eb1b632942ae01cd2b6a8fb0521f61189d5095c82572b838a1a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
7228165942846583f309fabdc1e3147e

SHA1
f8f84d0fe46d66453d7debbf426d8157ee84378d

SHA256
ca6037c94a7103161a667ef7d64516f1f5cf5ccc0d05387a5ebb7ecf10fecfea

SHA512
7e7fd48103898129350ff438df3b7cfdc56babdea33d6a5c91693f89af51756a8db532713037657cbcca93000e7ad60ba92d6424c32c9cf6eb39cd72eb036b85

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
d02b7220ce90d7c8e3ae38ae149598a4

SHA1
df318bf256425ce3bda38b10def747d53191efca

SHA256
6cb21335331e38eec2b27103ac334247dfec496ef6558453ba3e0369aafa8781

SHA512
7f6240b48497867909c118770621739c30ebc4f0d55b644c42e4d92816516ca0821abaa727adb5b183fda05bbc3ed71201f049970016ffb1763083f072a85e4c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
dc0894253abdfe41d9fedf6d37fbc835

SHA1
50c55e1316be91c1abcdd9cd7ca116672aadd0e5

SHA256
c643e0d6a79c6609d59c117418614a42af50308c04ee6a5d84814f5e93187539

SHA512
9ee84c304f5ac74215f1edbac6e9e9c0c41c09400f089ab41ec0f4fbd1a3fdd59bdd7f6e7e9b5b5d84a68dc17e12fce6a98725b52106e227e2706c6d13766b9b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
3a69f0c1d367cdcfae8724aaa9d22857

SHA1
1baf6a157d4a0882f0978f443f314ae18b435157

SHA256
887941fef0d0687bf9bf9d77869652bce9b56f70d46e595aeb30e7817f615028

SHA512
c4e1bceb372cfbf1702dbf29c042ff0f650a7eac63b0c1abfb341d7036e094c014bcd58c1b8b26534bf76c0567bcfc4e1a397b517ac3b1fe3b60b18ae5fb18dc

Download Submit
memory/2092-8701-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8934-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-5617-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-7322-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-2784-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-2-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8933-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-2777-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8935-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8936-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8937-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8938-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8939-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download
memory/2092-8942-0x0000000000400000-0x0000000000513000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads