57b5154145d8c804ecf3adced8ef78549ded43b567c795aa1690a714a5b55cd6

Analysis

max time kernel
132s
max time network
19s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 08:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Size

12KB
MD5

69a4edafa563fbca38e1a73190b63718
SHA1

95c3cd4c13120015dcc0574b7f546524c2cb90e5
SHA256

57b5154145d8c804ecf3adced8ef78549ded43b567c795aa1690a714a5b55cd6
SHA512

f5406e0a97bcd68eb9a3f3a4828243d2d29705064bc2d4c84f111f0d1b991f54a995ce204b3a2886b8d39bfc72c320bd60c02d0f81303ee9401dd9aa4a2a232c
SSDEEP

192:J/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjaGpsHcxUw4h+lfPtRMSgiIDh031O:JebFNw4Pk1itKkpAjjJs6B40WSgrDKk

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2284) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 8 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\es-ES\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\drivers\de-DE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

description	ioc	Process
File created	C:\Windows\System32\DriverStore\FileRepository\netl1e64.inf_amd64_neutral_22118b1072f57433\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgl009.inf_amd64_neutral_bed6224f27f5c478\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr004.inf_amd64_neutral_a78e168d6944619a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmsupra.inf_amd64_neutral_c4fe81ea47c6df87\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\_Default\HomePremiumE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnle003.inf_amd64_neutral_c61883abf66ddb39\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\StarterN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdma_usb.inf_amd64_neutral_7bb325bca8ea1218\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnnr003.inf_amd64_neutral_c07c33bfb5764bdb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wiabr00a.inf_amd64_neutral_6033065925bcc882\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_command_precedence.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_types.ps1xml.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmlasno.inf_amd64_neutral_c86d5b5e5fa8b48a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\dot4prt.inf_amd64_neutral_e7d3f62d0d4411db\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\Ultimate\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\microsoft-international-core\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\_Default\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_jobs.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_jobs.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Comment_Based_Help.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmelsa.inf_amd64_neutral_374f9d31af832d6b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\replacementmanifests\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\hidirkbd.inf_amd64_neutral_2b561a02e977e2e3\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\Enterprise\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_script_blocks.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\smartcrd.inf_amd64_neutral_6fb75ea318f84fe5\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\ph3xibc7.inf_amd64_neutral_348f512722c79525\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\wdmvsc.inf_amd64_neutral_a2cf745000e2ea92\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migration\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-PerformanceCounterInfrastructure-DL\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_FAQ.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmgatew.inf_amd64_neutral_84eee4cc19fd00dc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00c.inf_amd64_neutral_510c36849918ce92\Amd64\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_requirements.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmmoto1.inf_amd64_neutral_bf4b404852955eb4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_If.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_PSSnapins.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmcm28.inf_amd64_neutral_d3fa0f62d3d7cea1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\mdmnttp2.inf_amd64_neutral_d218c42ac8635704\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\tpm.inf_amd64_neutral_d5bb6575cf91cd73\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ja-JP\Licenses\OEM\HomeBasic\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions_cmdletbindingattribute.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_arrays.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\ar-SA\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\EnterpriseN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_operators.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalE\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Arithmetic_Operators.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\Dism\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Core_Commands.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnca00b.inf_amd64_neutral_4412894f52d39895\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\System32\DriverStore\FileRepository\prnle004.inf_amd64_neutral_beb9bf23b7202bff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\en-US\Licenses\_Default\Professional\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\it-IT\Licenses\OEM\UltimateN\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\Microsoft Games\Purble Place\en-US\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\ja-JP\settings.html	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\de-DE\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationLeft_SelectionSubpicture.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR16F.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1036\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\it-IT\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-left.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Common Files\System\ado\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01236U.BMP	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\button_mid_disable.gif	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\TAB_ON.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_double_bkg.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_settings.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\fr-FR\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\es-ES\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\fr-FR\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\delete_down.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02746G.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115844.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_floating.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Psychedelic.jpg	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115875.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Stationery\1033\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\PINELUMB.HTM	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\css\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\VideoLAN\VLC\plugins\lua\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR11F.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\THMBNAIL.PNG	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21314_.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21421_.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BrightOrange\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ViewHeaderPreview.jpg	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_ButtonGraphic.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\PreviousMenuButtonIcon.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\DVD Maker\Shared\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02752G.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR23F.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\images\play_down.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\ja-JP\js\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR50F.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\rings-dock.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\42.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\btn_search_over.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21294_.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\OutofSyncIconImagesMask.bmp	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\SPACER.GIF	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\ja-JP\flyout.html	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\vi.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0227419.JPG	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02897J.JPG	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..an-plugin.resources_31bf3856ad364e35_6.1.7600.16385_es-es_6ad86268b7ec6407\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-profsvc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c27c626d1e4bdd06\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..cquisition-wiawow64_31bf3856ad364e35_6.1.7600.16385_none_2874ea220a5507fd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-xwizards-registration_31bf3856ad364e35_6.1.7600.16385_none_18ef242849f41a23\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_kscaptur.inf.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8f39606a8ff8080c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\flower.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Orange Circles.htm	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp1.jpg	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..cache-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_a850c996e2a1a3d1\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wininit-adm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_16e37a1876d8cafc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..ystem-web.resources_31bf3856ad364e35_6.1.7600.16385_en-us_17007fb616afbdf9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility.Resources\1.0.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.PowerPoint\14.0.0.0__71e9bce111e9429c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.wmicontrol.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1f7d465985b0e792\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\system_m.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\assembly\GAC_MSIL\napsnap.resources\6.1.0.0_ja_31bf3856ad364e35\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework\v2.0.50727\ASP.NETWebAdminFiles\Security\Roles\App_LocalResources\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-fontext.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1522e77f75d45bad\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnbr008.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_c6a711bd504b47fb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_server-help-chm.applocker_help.resources_31bf3856ad364e35_6.1.7600.16385_es-es_95973428e56f1b97\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-i..l-keyboard-00000446_31bf3856ad364e35_6.1.7600.16385_none_4fc3090ab0dcff53\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.188dd00b#\3221164d1505204d3c0586c81505c2cc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-c..panel-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b907ad5b3c3abfe9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-enhancedstorage-api_31bf3856ad364e35_6.1.7601.17514_none_3354d4592666036f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_815d27dbb889ba17\play_rest.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-n..lperclass.resources_31bf3856ad364e35_6.1.7600.16385_it-it_7c298b7501cfc015\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ction-adm.resources_31bf3856ad364e35_6.1.7600.16385_es-es_495753eb7606934c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\msil_system.web.dynamicdata.design_31bf3856ad364e35_6.1.7601.17514_none_0f747869dd9333c9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-i..nternetcontrolpanel_31bf3856ad364e35_8.0.7601.17514_none_abfb5733271ca1ff\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_6ecb9474884d886d\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-h..ctivation.resources_31bf3856ad364e35_6.1.7600.16385_en-us_581f4464e637a2c6\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-pnpsysprep.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2cde09294fddea9b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft.windows.s..rt_driver.resources_31bf3856ad364e35_6.1.7600.16385_de-de_040354651b707cc9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-e..gine-isam.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f85aad48a0aa756a\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-s..line-user-interface_31bf3856ad364e35_6.1.7600.16385_none_dcbdc8e83e2b98be\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-vssapi.resources_31bf3856ad364e35_6.1.7600.16385_it-it_721134edfeb2f999\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_tr-tr_6ee9aab7a6ef961c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\item_hover_flyout.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\Microsoft.Security.#\de71165622f703a515b6b18175eb7996\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\Microsoft.Security.#\33f2c8336e497fc65c9d414c2a7061d8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-w..t-snapins.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c1807d712cdfaa49\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netfx35linq-microsoft.build.framework_31bf3856ad364e35_3.5.7600.16385_none_9a6606b55758aabd\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-p..orkclient.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_5be63c830afcc60b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_windowssearchengine-structuredquery_31bf3856ad364e35_7.0.7601.17514_none_d22dc8d4b889ee67\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v2.0.50727\UninstallSqlState.sql	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-cmitrustinfoinstallers_1122334455667788_6.1.7600.16385_none_edf9e9f8d0b878f4\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-msdt.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_c523b554dc91a8e8\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-wmpdmc-ux_31bf3856ad364e35_6.1.7601.17514_none_4c8976380e00631f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_netl160a.inf_31bf3856ad364e35_6.1.7600.16385_none_acf1ae130af9b0ab\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-credui.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c040cad9b8e1500c\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17514_none_72d18a4386696c80\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-a..on-logger.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_98100d6634e2f74b\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-b..trics-cpl.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f3d16ecd99d69bdc\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-cpu_31bf3856ad364e35_6.1.7600.16385_none_a79a90daaf5bbeef\glass_lrg.png	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-p..ng-spooler-splwow64_31bf3856ad364e35_6.1.7601.17514_none_25d05769a8973724\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-rasmprddm.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e831bc7e0f4e9617\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_prnca00i.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_57aa1e4b3d187155\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\AppConfig\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_input.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_0a3f6df2a091ff6f\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2c9e036eab1341cb\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\wow64_microsoft-windows-p..ntalcontrolsservice_31bf3856ad364e35_6.1.7600.16385_none_1e962912f04def16\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\x86_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_535b78c76c233768\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_For.help.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
File created	C:\Windows\winsxs\amd64_microsoft-windows-smss.resources_31bf3856ad364e35_6.1.7600.16385_it-it_cd09f3344310f0b9\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN\ = "CRYPTED!"	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN\DefaultIcon	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN\shell\open\command	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gR1Du2FK52JpPx7.exe"	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.BlackRom	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.BlackRom\ = "QDALZBCHJGTVIBN"	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gR1Du2FK52JpPx7.exe,0"	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN\shell	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\QDALZBCHJGTVIBN\shell\open	69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\69a4edafa563fbca38e1a73190b63718_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops startup file
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\ÊÀÊ ÐÀÑØÈÔÐÎÂÀÒÜ ÔÀÉËÛ.txt

Filesize
633B

MD5
e913624ee150c0894d6b42c9f1b363b9

SHA1
69836370f2e7489564c1fb8a3f87e7d1c7003911

SHA256
cb9ca5237f9ed9a02bdf97b20cb6a3385a4fda8f25ca931e99857f650990e6e0

SHA512
19572e9df9eee03a493f32682925f0a6d3a22d7322cf80c14f2aaca979b2dc6f66a0208290e0231a572ed2f1a9e24f26718ba83887a36e05ccaa01197e9c5df4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
75e87636554bc7cbaeffcaede9f08970

SHA1
891ac254c010328f6e5c3a1998c2e009ba570ecb

SHA256
18dcbf45c4493bc7d1363a06cf96094353da3629dcf8ed5ce5da3ab8696c2932

SHA512
c3a019b5be9c238e035e73d1f754968cab3bcafbfc7fe4729a1f484563666fb33cd607b159198eafafb09a7e699bd8972f1b53d057605b1d7531495b020a5661

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
cf7695b8b84162ff14cfa97b0bb3d35f

SHA1
cf74d5f335afaad9394d31672a8b28d7d4f5f114

SHA256
9d78bbd7577464f40ab7941b0a62f8dd0d225933594bd8d9802740d403ac3296

SHA512
4a4106df4b16eef467bd0417a7e5f436e46f8f2632cb40a82c536f2dd686e39479fd0c5f67d5cdb775b179beeb173cf3e3f104d073d29a22fcdbb2b635c80675

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
0b19d56f670393aab8686380d513f9a2

SHA1
31237b59b8b114ffd1f0e9883ce95a7a8d9ad0d1

SHA256
976487be7aede784e48fab8ea86532b93e95a5a89df389804ba98fa51b95b29e

SHA512
5062c6026abbde42ac42b50c29d1c1f8120283397df0992812dac53047289ade2d94ea0b7803bac3520d72a34a5718e12f8888f1eb425ad48bb98850d4f8f50d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
17f92f625125d60f82003f5f58c6a25e

SHA1
5b92818a92dcc31752648e8ea07fddf32604cbdc

SHA256
6af54d9ab624e462c0b1cdaf2a998c58851da8831febe67caeb8036bc9bcd7b5

SHA512
f299ca837d4787eb39d2450f4ddd8795c8f16c6bade1c9f6110b4518866164f4db045d928aeaa01fa69e112bd93d7a01ae26c5662207f0ff27c95f51f4e1efbc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
41248faf1feb780eb1694c5372e3b3ff

SHA1
64a08da629ae6eb09fb1c532c1b34fff42ba8707

SHA256
5a99c3aa385803d97fef465cb8da425752d1a297e0437bf3d437007a2654d702

SHA512
0aee2d6b35215c26d9b0f424be0ede29a8c2f77bb570f29c0b1172c4a45c3184b656fa38e6a0caa8abc9c96f815778df2f82cbe3fdba3d8eadab98341547e7db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
58558e6db784a4357b6401a3d68dca7e

SHA1
f23c02708f13db38f111e432ab5f14bca83a6191

SHA256
c0a8067b1211eeb0db2f54f72ef0af9c18a7cd88f18a339a305c3ce4305394fe

SHA512
8de597582d6c41e6796725f21c024fa6ba60adb4fd20e7513b57ba9ee9c7f575d57876410270e389e760df4bb08253261b50b9f9edf2ed1cab90ade3179cb4e2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
aff08a7e2c7ad3118ff08b6c9d868791

SHA1
c8c37f0bcc1ffe14821f6d6f8a93da0cdfee0a3e

SHA256
2dcfc394e9f2a5ce5dfdfea2f7abca6468cdc443314564e0b0a848af9123effa

SHA512
2b5c9063462dc005de1d48abe97b8a1db82e66bffffd429d7e81c8b82dcffcf4de295454014b176463acaf66a9c6bc265de81694f8388418548a84687fdde15f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
3874d29aa23865a26d39ae5a2d4c46e0

SHA1
15ca788f2cafdf0f07945dc5bad05f40cd03f891

SHA256
45b4c03da0ef3f308eae69025bb021e2dcf0e72c71e0c120572d3042f94548c2

SHA512
983f21ac2eabc4b49601b7a5bf88b2b4ef2621fe1d8aaf206b6e2b07fcf8ea4f04d04328bd32a57cf164d5471b3fcc18a9725c615b4d5105747a64ba497f0f66

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
fd4e7a5d38d7513886cb33ec01aed857

SHA1
db30af985b6d255d6367c1d6813475278e53a6a2

SHA256
1ab86603b81b63c54351a25381fcdcbb619a1f6664310b5b89db67476c8b7a0a

SHA512
2fa73e3a599bfecfeee1af397447d05445666f9e5875c9618cad8ca5efeed6205c2b22855f3c0a0b1746845d0e38a2acba28c350598a95a7ae3eaeb054dab43b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
2f70ee4d007ab128d447e01f393b2cc3

SHA1
679b83499b002a5aef166572dcd980a14e625229

SHA256
a4574d3e57effcc2374b8f85f8266078480ce995d47cd7a6c7c86a92294a465a

SHA512
1c570b4b66930da4408ab609064bdde8cb8ad0e00ffaf7eb9810b9d1aeb1b3b8279f07aec76cadea27cf679eebaee30fc24572cffcbbced15a8775f15409f34d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
d969ba0d6c170b6dc2a9dcb4b9df2eb2

SHA1
e9a4f20ea61720b254ee57ebee20ea21809233a0

SHA256
e6a8ea34fefe2d2d6026f7374dd08df681326c8403bb52d8db146190bde015cb

SHA512
96f353646781006cc7e25ebce84239ed8b5ea707afd3d84bd0e87ad1fd2f91f7a52ba3b14a519dfe53ffe783892eb29beb8872b7fd786fbc2ce338f305ca71ad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
5117f9429541a2b0597bed0b779737ff

SHA1
150af766a1082943f99bc8af1b9213bc17e6bb94

SHA256
9c6c9962829f929d85bb7a9f6b7dd6fa0033f447b7ad26e7ace198c7392bee33

SHA512
c0a30e9fa13f4741fbbc53b7d868655f3f8bbc399c4e9a21131608178fadcafe7481d8e658d0229c93f5e5ad29fc6e2a71d1f230c5f2e2ec4e4ec7428c3d05e6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
7b522d5508d93a71b36e789ce018aeb3

SHA1
7f01fc860d53a50190ef21b17a328a4dec2cd0ad

SHA256
0fe1486df00329e2ada4285d85af2ea852ee71eaccd1f0a5db89cfca61dd4305

SHA512
d52692c410edd609fbd73861b204328a0a76de53b4f744291cf905a0eee63021ac641cbbaab9bfe8b63ead914f8daa2e9044e36e8c3ea903ef28d0e3440f323a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
d85a1258445684d2bda9574ec8a721a3

SHA1
2d5c9036be7b436685b66abcb885582836271736

SHA256
81d50c84aeeb9a8d747d3fafd085796756b8fc2a689341eeebc8155781a9520b

SHA512
d6f6154330a8ffbef7cfde4f5336f52016cd3ec7c623421d0fa0545d6a8533c9f955a63b942b384dde78eaa73aa7733279169411a50ea42cd65c3dd1137485c6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
b28e3ea44edad849ef1397eb38c1836c

SHA1
8a3e6a3157a9c59346cfaacf7c25c0235e88b5a0

SHA256
0505a07d99c3115fefb0faf078fdd8faf55ef33a8fa341845ab6f929f2765449

SHA512
11433ecb5b3055c2a1dde400cd4676f88311d3f19e56f587516835f65ce083dfe6a7d5f1d2d056739f83c4e117b8f604a5c597aeef8b798abfe8fa03fcd62771

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
f34c93c49cc048c8c0216b8bfc6c194d

SHA1
0bdc4307844b449728f9b7b52e23e19fa4e13c35

SHA256
6d600fe9f70f0bc3bf237c28e8e1f02ff95059c1ed441d28be179e9f6a93fcba

SHA512
0a90d1bef841b55ee5e61b51e15d4549df1b8427f923ecf543fa9186aa6507d022841ae1516775f9f77d9685bdb129293ea1c753c74dfc5580d1f1c1558feaca

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
bbe55dcf6c3e87b205c87365c39a6455

SHA1
4a538d72f8ca767d42a6944ddb9523e5f3125c5b

SHA256
446d8a0989201efeed619143a8d0ae6b312151d137bd72aa95a33f922918903f

SHA512
31f16b0cb653d9f1df1587a5bc379b1cf9c9c4a2c3cd59a5177c4bcc85ca1a0e32714cd41046ee3d3edc3798604d44601b1ca002f64594335dd9625da3a3cdb5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
ed1fbe11cd526b39f074881c52b0df5a

SHA1
2295e1cf6b6c5a3ffeab3808aec2d56054f647dc

SHA256
012071670e4259517405cbe946b9c2e49ce0d1f7b704c687d58e649057546f91

SHA512
6ce223aa2e75f711f4ff15adc62dbfa2f0dfac4d8b6a216c8670245385a509e514122be669f1ba0f00ae2e1825ea455b5dc8ed7e32f2f0a35b1fd85fac692b18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
07c244b3df4dc083cc7f2472456f08f3

SHA1
60fc5960e4b57af4912b8d3f0d81cfd3011ba324

SHA256
34132252702ef3bce51e0808cbe21fa7e29afbb6a4ad82ed9b967ab7ffeb75c6

SHA512
de8b7e1f5b0c80e87d016bbb8ae59d474d7b44651931cd28b77ad0c930a8750a295c9f54a12769e14470e9176d5354a6bbc0ccb7b2136dbfcf6eafd36830fcad

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
bb6e69a76ddc6a7ae8df73c6d485f8ed

SHA1
2105bfb688fad8c3d37948c5cc825ddc39b4203f

SHA256
f40bbf9cd4d46ccf639a7d6bc029d1223cd16d112bf10fa3934f61d515df3c42

SHA512
a7c3681d34031500b8011573e24b23c948fa67d518a4bcd0e4c34be1ad2f34c0c310fd737301f243006c8fca2a7e83c3938d92f6846b797f7c0eb05671b7997c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
8ca886a08feec0f8bcf781afcbb0375f

SHA1
4358e4bd38e7ddaefb046752c7d39b769e0cf543

SHA256
d6c01da66fd443cf8dd830ee2ba52331bcdea6f5e2cc9de9818763cde40e846b

SHA512
51fc965e0d47f81e9824174f6965064cc6938f2b664709314711835ffde9a9591cc10a4174da26b5fb6971fd7ec14834d69c8bca83479ee296a1cdfb82666126

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
08096a7acf1ebaa38f039749761eb917

SHA1
0e6dc128fb264326556f0f92fd75c679af4ad956

SHA256
a3a2daa297e52ecfcb5cfd74d56f6d487978963acb4e45da5c8aff02598c8ea9

SHA512
e809e4f6efb11e3cd8d1d0db7201cf40908ab37043335ee4922ec86a52cca47679f24c5102fa6e2e5cb2eac129ea3623a4b8cf0149a2a8a8ce981982312d7fb9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
c3c8acb8d603adca26732700ef12b2fd

SHA1
8d7721c0f722078dfc6c12228a81938159ad46ef

SHA256
d4722ede1dde74c1e0b180628afba9eee5e5d628b9bc609183ec7d1631315e1f

SHA512
7449509454a82782a2ae3c02aa9ffed65b07a7cadffc342b4da7b09f4d2efb30ed36de650464cca375091bae95179a6215f7f5ebc9c00aaa4c0d7a26714a6241

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
aa0f3ecdbb9a2662fa3f5819e20581c8

SHA1
1f073dd073e92e2f11b3b6855aef40851e7d6e8f

SHA256
8c5204dd157fd25fe10fe1fda65b0684485ccbb44da95bdb8c85eb7b4ced060c

SHA512
aadf5129ba3202cb68d4bdb99be15e96bc024a2dc0d2ae8783eaade5459688a77dd9c73e42e3b48afcc02288916475c65c6d92fd8d315f32cf91d7bd0ae5ab10

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
7071302362230871af7069f6840c5630

SHA1
f3b10d19f07bf8c5b01cf4f919fdefcfa2f558b7

SHA256
e1f93feb8dddbf47008877c1799f89dbff4e610a2d971a3c76da5d33d066e774

SHA512
ba746b683efcfcc075685c0a90faca9c26fdfbe1c789cc54663f9ff1283bf2d16163c96565a9a93d44b059ae301d756b71a0df7a2ee2122e2909ae8fd3382e69

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
2c4feaae60869e0341b0628c355e392e

SHA1
51264f609f1341e06a2b58d94bcc12d67fda8424

SHA256
a201b9c4bb7f362b2885e85b6bf0c0019646ce049d8ca1da718e55c2e8509d83

SHA512
3cc7cd3d14c967d06ef37ecda3a1893a234242adec568497a7311378e04efc1b625351ef943b47c6247ddee6fbd05c3540c50faac3d6018078e0b3fb8eeb02bd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
a05b8c07adf22c543c66a76c8cc5c26a

SHA1
7a008cf8327a4a6e3b22b6d217e88c43ffb199d1

SHA256
910d9f92bdc29769c364f4a0c136d47995f0aec0d51a960e9d38399fed3bbd35

SHA512
c72e10991c5fd14193b2e3036bdbe228bb4936ef7e5fde2520451db7e51485a1b2d30f3fb5227fe36a8aa3c7327afee103522910f7dfd77e34793b7f96e97155

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
fc230988e507f2a683870c6818a739ff

SHA1
e14f4bd3947d58f34384a32a5b85688e7b70aa84

SHA256
df19906f5027865ba280cc1c3a4628fedeb449fe1a9f516217c664a14d8c6bc0

SHA512
65ba0d2ea47d356aa03e64945e2373b3368198f77ac31119e23dd3a3a20d1c0c92c45463b10f20350a20a62391f4f1c1b4cd61d370926d91eb15af94f4428f81

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
fbbf06cef7ec0d386eeed5f651922c2c

SHA1
63f5eb627eed1055b40606111b2fc5272d9b5405

SHA256
635b202c10c4e88ccb3ec4b3a15b719a01bc5468e90e5409c73ff8fe868ddb8c

SHA512
189a7cb16b2f6a1b4c34ce57ff46eee17617cf0ebb5c9cde5da8fe2b3344f042e221887da4265a70598ff54427719d22db266f9657efa43d121025058acd76a8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
39c04980a7e308b0d21c6aff0042272c

SHA1
be997d696a47ba2833fccab36cd7c1078731214d

SHA256
cbd1842a522aba7037b6b13463c0500216500d40e067cc31e25b489596330d4f

SHA512
f700413b877d5568629463b1313bd953d67fdb6041c575597c343c123c89a95e1f1a39fe52675c8d0cf1e0d53478c7cadd10907b4d82ef8a025504675dad0f1f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
9ff81dba398fa0932fd9851fe59fbe15

SHA1
fd596d1b3e04f579ffbf988fa19b009d438f4ece

SHA256
862f999fc6409730c7558bb5f0813aef2420b33ec1c849d724531d2f3f86fa12

SHA512
5efe74ce39299b71476a288273e6f46178d4fa6b55920de46406be18916ec77616fd76bbfb0ab5272b50b606e72ffb7cf48706a7f73afdabef27120c30f185c9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
0411d12212ee8bfae6860e99cb27f97e

SHA1
3a1e7997aa5be82489d80d1ce55d1e800172f648

SHA256
48abe60c383d727278aa708d90cab9bef2c6a101734b88696bdf56f75713e481

SHA512
c1e98e8906e34fde848b18c0bb44bcd94d117a34afe057567fc9c7a429e2220eb3abb7f01690a9de499d992ff08f494cb2d60999f3642ee3093f444d0009685e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
8c08f734ad13e0a08d94f6752bf2ca15

SHA1
69b73a1c8dd4547fb7213064558809f235ae3807

SHA256
3e4ca590106b2201549e385408c28338a1a617a7b4c6505192d737889f755f54

SHA512
1764aa1354274b5dc53d0bdfc9b2155dfae6a6756e8fec2d593001960dfc1702b6e6eadef7d2748860e894af924528a8fe3090f05c6471e3052adcc97ba44cf5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
3b6372af654aa4a60bd5bdc30aee1b57

SHA1
f285bcc70fd4d6f5a9a44a6f146d9e450cf8c3c0

SHA256
c5540ad2f36bc2f8ff2304e7e08feaac7a7f0dfa2da0d0de3c29badb40f4b9f7

SHA512
0a6b3cc43ecc7949114b682767addf785ec41fbcb270c13b9e429ffc235dbc2c9c7308e455aa7bef829d44f30a1133c910f533043fa3c8b6dab5d443f6e83c8a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
efb034cc23d4b33b1ae11dc028d9d20e

SHA1
38f8f8fa376f1222ae7f670b000b772e56a5b641

SHA256
4954a9cdf9bd5e96e261166fbe106505605a1309f64ad5d4320890cab65d1456

SHA512
7acc5aaf96ae86d3c24c35df01cdf3834dc7bb13979f42f168bbcb71f502a72848f490bbf2a60b803ba9c17248ca9451a2a68dce8609dc1bf458c11c9355a721

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
7e854c2869be05908fcfb24d9f54d737

SHA1
a67e30f72c1e0daac9d672eff9b01eed5ab6a060

SHA256
9e6a9fec919060123e5058ec60d2865acdca548e36249796ca4266415c66de15

SHA512
76faef993655d227cb8277d08be2112a0be5bbef13ba4d82c0e4910ed5d72a1ba98a9a759b10e30841820e53bb92d03138cff29e44417729de7cf03bc1a8712c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
b5784494ee777148411bebf88bfa90cf

SHA1
7b81785268f6e26fe751659da3d5c02ccd6f9d09

SHA256
ac09ad58903697a9e64e2394627efe1fe8eff3d77d0013834433568aad633ad4

SHA512
770912397a101c10907ca7093f7aa25a3be06f8774218bb31256242a3820b25a8ac427ba31dd2a905d100fe045b8c9ae744a1234173494656f7bc91aeb5ce265

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
1de0485dab7ae655bb65c71b53e90dd0

SHA1
6c176e3a36a7f3da8c8500d42da9669de47cef8a

SHA256
aee52b7182f3311a36f469c4585b09115f5800601d3577c75efe3a7e124b605c

SHA512
9d84a1a464aecb94ceab9f0688e3e7aab4c1b02a4b35adde53f3e98ceaeb32ab6d4344fb178a56e378bb112087b2aaa786c36dab3c22b206d7ddbf51124bb11e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
f55741e48e17b321c2994e96ceea0bba

SHA1
8751ed697779655b0937a3a784888e8d6648986c

SHA256
9644890e42204385505a5a828d80ed7e907ab43b90a7c3f04ff7441d7672e924

SHA512
ed37c72b70bbae18c5213c295a7ff0214da144ef7ef38b07625adfb9320b6372a91b0af3d8637499328ad666321cab8456e9a11b3803dabebc56fbff5bf3de88

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
c4b41ded759835d9e408196c0437dbb2

SHA1
eeb9fd5ae3111883e09bb84d60ee73c44c38a367

SHA256
f29fbb586eeb712d86b9255f2b73318b9de1f83af32d4c718ac1a35e54ac55bb

SHA512
a80cc3095820e1248ecec690e0fec98e06c8f2c26117b0d93c00bad3194c72df7cb5b832326d5cba94fd8100f3ee122d61280e99da9bd21f88c41dfb5acd7f58

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
c37f2f54452c5d7cf59fb2f32b0e2fcb

SHA1
033e9695445a32e0c11ee905c8f5e47bceb8d188

SHA256
954b69c055183ccf665d4f97d8c735ad9ecd2e845acad54234df7dce0e5311bd

SHA512
b3985107a35ba6967099d5e52c5bb827a3071122233592a0d09e1ffb9a855efe0d5e0004aa328e1b3a0839886d9863ef621f889c244cd308a62b070ce0f1145b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
415278831fa5c820c59d7859f20ff49a

SHA1
3806062ebf921cee41fbd17e1314d6b9effd62fb

SHA256
601040b00d6addd00d00c877251b2de776238aa28b894fe866bb706c94f6f4d3

SHA512
92a471600b30642f3a1e7a41f4a1d9701553bec215a1b03f3b80c4c760f47dd581cb89179a9a3116ad58732e34f40b2e6bda4610b180d4e047a576aee85b0720

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
d9428c896bccd3eb94a1cecef602d6c8

SHA1
48e88ceb16400764d0e747353920e33b03ac8c05

SHA256
3f2e18313dd65f3561a9568515228db4841939be09c4390e77a7ac26ceab14a2

SHA512
5813d4c87e57cac2f739192a9169288b5a7e1fff3b0fb5e2672c582f7d6297a166b4e9cb809bce31ac7d42c7c094b0b73e979c7f752e4824a5c3282b5b33f335

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
b83da95ea0e850971066303a6d989ab5

SHA1
c8b2a6b604ab6d1fe275bea6c7105056a90d0ca6

SHA256
2e1883082a506cf65fd07f12dd300ed41cbdf509f18af502ff191c399522e41e

SHA512
dffdda527c67e60fef0afe6d03fb731f9a5b81a2723a8e71176a41670954c9ebf0d5de759791d8d5c1640ec1b7f6a0d415801a0681c4da99dce5efbe43946923

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
a0a0ac1cbf63b71f0dd3745dfe7d6e97

SHA1
69643e78f5f4075f2c44c2f3ad216ff7e84d2a4c

SHA256
55f99d4c4ae2a80eb1b449e4b7cc4999da85d8d9f82ff6f359228366fc026abd

SHA512
ae7e0160121797b3284bc3dbb0c3152ba2a8fdaa92ce3f21594f6c71755293a898b026626e15e526832e96d0c514cf8c81c80ba92ddfeec589bd5665290f6e0b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
33f62afb5c26f0a55bbf526b54f41e4f

SHA1
9f5554901be8f61a8151876e404772d39416af6b

SHA256
b898523b78fca4e6000b820960c16518b42b1639ee762a815788b0f4ad3d27e7

SHA512
9ab04ef67b388a6578bdf4dba52ecaa02173a711be048d650ca80a364ec15a3dc5f780a6fde7a776216a986b6df3047386619d6aaae3e0ef6c04a3d67d536680

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
01c3f702c446fdcdc13f06e2b452cb94

SHA1
99f2fc727b0e26c0b6c87596069e51cfc47d5e91

SHA256
896971fc7570e1a8a1d6314f65ae842dbd7e7429d9fc30adad0e9eb5d47b98bf

SHA512
46792f25a84d6051ed1488d6611bb4b461e7825a66cfe1da667f3a51baa71872b500fc0587c8f1343286dd36e2428e2970e07eb9ee0bcbfb55737ff226ef06b3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
5e858da1a58fe81be8e02dea29980ca9

SHA1
f89f202e2b581b339e7e4f753e7de344c29b77ce

SHA256
1c46486dfb5dad329183a8581ef6922a89c81b63c5d888acc4c28d2629de0258

SHA512
30d65a345203624908e757cc0c7fd0b0571aa5ab1b6c840304be7e41ef65c99605009a9ae04d5228c4feafc1c30c564bcb015dd1df0058fa7645348084e7a151

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
2db78ae8073dac4ab6471ea102e655d0

SHA1
8c0646337b37b9499c41bae777dc2ce805749664

SHA256
400cb0db68d4ad648e53d669a613397845a6dcd2b896bb332d6704eecb7087d4

SHA512
1b3886a09fa428305f5a7f08df05a776b7cacff966658199aa7a1965c4a6afb57db723a8d6d6752b077657b948c8f67485fcda55c0d0771ebbf77eb21f00ce87

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
d8c62205ea578f2e736575b317d7de45

SHA1
14f359e83e097bba642a987c412ac356dd8ae206

SHA256
5b38b6681ed866fa8c063277418bc70160effb01dba211c3665779eaadca3469

SHA512
86ef7b85b6d35a17cb922b5ee2238767783d77c20ef601ba2c0d14aafc898010a2b6e891c2fb8a949af1aa8e2c9bdf790fd7b4db6bc19625e491379d0f3bd714

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
55a4dbe7b57136e58fbd4367a9eef5a6

SHA1
d616da722ce42074c2abd093e9c13548f7270163

SHA256
7bd87351cce06375c93c115de66f7fcb7b24fc218faeb81dd60124d9305d37d9

SHA512
feee3ece35ffe1e7bb575aaf83157c02c4ea6fd54ce8173cdc388192438be1fc03e154e51e20aad0f476f17839682865d96dd4fb74f0d93b928d4d1d6bc12c64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
cbd1fa9aa5a52f4438db56d567a499a9

SHA1
767a35b0c658c0cd84203e340f3a20e018357925

SHA256
05f2a9ba66f7b9e51eea13e6bc403023ec108959228e1501ebac27b8f04f325c

SHA512
9a123a632c5ab80f06cdd5ceb5fe9f238f96020ebddc6a0d93da4301a849e10d295189284600922c3252641ee3b30c1845a97fbbc95f44ca942ee2e0f91df96b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
3941ce668531abe16a2a56b297c3feb3

SHA1
f8ad776c0349fba999010d087f5460eb366f9715

SHA256
36a034e0d06f000b6ba0bc31379775a5fac131b57318c31abe02a362baa75ec7

SHA512
62056e763479c7ddf8b7042a51937126b55478a1b9738d3bfe814be51f1cefd65e895822f6abcb080c90685bc804f21b49dbd0bf53fb2ba1e142ec18a0c4d810

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
d38ebdeec440eb242dbc4be460ab6f6a

SHA1
e570c36df0bea44820122838b0ed67005b491591

SHA256
9cb09051159d00daf7cc37ae3cd42067704c35666272a21a6e8878daf669ca21

SHA512
a12aceecb1cb147dce74d6ba6a9cb1ec4f5f7b1e83c4ec0d8c993f78bbaf522881264e4c00baece4c99bc906e6aaff573df5319326c1140d067129a408084a69

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
ec144dcc02165e6d29b258a9595580ca

SHA1
327f80c31dfa00377e4fb9b878ab75ee523351b1

SHA256
520597e0412a2c27a0467840c5b77802acf04316a771ead9cf1870197ce11dd6

SHA512
57253c3d94e51b973747b0c7ae408a159bf0575388cf0e7019bd30338a76b09d66abebbedb4d10343bba8ef638574ca1e988839679532685b9bed39b79b93cf3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
24dc6ff4838c371d9d9d379f86af1780

SHA1
d56d58c02105cfae741bfb781949d597f7271d45

SHA256
1aff460c330164f856a3067742d218e5f4b30a33da75c0635f00b291b2056ebb

SHA512
dbfe8297a1abf3e6dfd7c2ae07b644e482662f8444bfe9434e0911275dd0f20f50ef32a59c088ade6b789571661cbd00534998c3faa10d61b8a436e718749fd6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
19ff9bab2396b1688b659e2219b8e074

SHA1
8656224c3eedc5caa54c5465c4bee86d2cb898df

SHA256
6fdee7ac7a456001b00e82162793cab54f6d78330267756cb63abe5632dbd5d4

SHA512
314937f05ac4e3581dc5315f3f77e54fb75425a40ba02597cf386ba3ec150a3e665ee83227521d2e0fc0f95c95f44ecad6aed147aaabde1c9dd394044af18393

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
7c431659946f20dac5f8c4713ab44bf6

SHA1
2ecb0d17f2250ac26c38630ac44156b5cd6b58fd

SHA256
58288373ec9eec30a69b109c596d1bbfb3dec40a3b1080b52c0e486df9700fed

SHA512
bb5a11d50d9817c5795419cb1cc4405b2d7449e80f1c53cca4d6857a3308182265a0ca01ede744fdb4d2f92af92e34102cc1046c4353b5a516889ec31a73de0d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
8db5bdaf51654fc325df34ec406e35b2

SHA1
832d7449e6307253ca84680c8a6c013351fb6af3

SHA256
cfb657a0caab534b47af7960a6d11dc475d6caf04423bf804080a8aeb30ba68a

SHA512
b4bd4fd025dff73c567812cac2480aaeb6f2e44516b1265ef9c0115a648cf527ae9e0457183335d1d143d8328011461f1f7059e3015a2d6d857daf217b265b19

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
db93bde1f3026c07d9cf80c9c60a6320

SHA1
9b43a30106b2a541ec6639d005c03815c51ef002

SHA256
273d8c6a0fe528228f93b067b924dacd379676a7f121cdc8bc3d49ad16511d65

SHA512
f31ecaf6beb1b777f626a9528728fd05bf7b61cca472e856df4b48187f0b293f0400adf7f4509470a9b9ca3663352b57397f12452cf37ce1bee970e49557d229

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
edabf4efacdf79c7a01a986775a84869

SHA1
ea7caca7ba48540b1140f03f001c4ad92ed56b04

SHA256
c06982ea8314c8bb36d1ef09c55aa624b6fbb91c6975af4549aa240212e064df

SHA512
bb6252211594bd9ebf43ea9a75cd38a43427799527d5fec25f2c50b14f651c41ffe0880cdb2412c33c8af21ac86edf9e70c04171a769e1a90c871fb3a6b0e5b4

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
f29c1b8e21a591431cafd6515d7d4e0f

SHA1
6f9eb7cfdcf35d117e6c26c8d625cc641b949d19

SHA256
b77e1642d4fd6067f7e5d5ee371e2353dfed2db8b29e7dfc35081a42784cdedb

SHA512
850e8de9e86d1c4c8a2f69a95253cf6fb00c2f15460f5f892d65f264fbd3c651792484800ce27546fe987277d34a248e87b7409a649cd68f52610cf3afc12a38

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
bd815b4977224a644fcce47f2914f330

SHA1
6ce65d2df9aef4d6097596dc247b01393506a58f

SHA256
b43285ec0dace0a14d93f18c564fb7d90f9b4958cb470c49292e71a2c6ba34d4

SHA512
b208cfd32cffe7d7270ca5f19e4312102723fa833dd82ad41800ac912ad8db6f9b7449aa0bc8389164f14834b0b6e7c6d1051bd078e45b9a79c898d470c12631

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
b935d6ccfc13f3eed1ef4a83cde185b3

SHA1
f63f9297914e7d2a37ae9d7c2ab0552d099bdb4d

SHA256
a6f261ad92500f45e087ec251a8eafdc23e4203a46b5c12dff0dc9b76880086f

SHA512
c7d2da46d7000f00b837d1c28f0b3ca38dd86ef6fb9f0553429753b4d6f936f060adaf41e7a0850365f6a59f9ecd501e6d7521688a7cd1c090baff63e2f05314

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
62e1d9eda8389f2bfb204d1df40e49e6

SHA1
5c2251d980122f1e243420e0b6a8d6afa3d6401e

SHA256
c4a1ce7e1946a5c53d21080ca74d33044ccf12342055167056ec483bbfce4fc3

SHA512
84703d0705c9929e8a49638b773c0c10d9e9d0859bd3a17ad1c68a84f611c606456bf2cbb988c5788b8498aceb21b25f23a0998d1df00825788953e372842427

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
49B

MD5
2fb408fa4e066829075e6dfb2619464f

SHA1
70c0f86d13275c907454c37bac1299f3034d7bd0

SHA256
18d2e0ca13e6b8d7ba690d203b3cd2fce231301b59388de6da59cf697c331450

SHA512
e95a3ba73a2a432e51364dd4dbac30f568ce8b39022c120012ae7fefb94e0a922a39897c8b7861b8cd5ebcb5274ddfaeb1d18ad9c67b7eed8721b28417388a04

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql

Filesize
24KB

MD5
767474ca69fb4a0afd40a442a87ccef4

SHA1
0f2fbc63efca967e1886ed979cd083251415380c

SHA256
98880ccbc87c8b371c1f39c6766cdf1aab724a6e5aab3e4afc165021e6949428

SHA512
7db76081e32c33fde3ed0f0f4ce3eed065e389574cc053e01fc0306e022f565281b76423cca7f0e69bcd2346761e75f900d06d7e33ac747862cd87ef2a069e53

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql

Filesize
54KB

MD5
3279be96262d922f6866b0591a50abc2

SHA1
a3121bd888c467b8394c4f6fa1d0ec42eb5d0238

SHA256
2715c0064d90cfbccffe80a72e5a703a1159f6894e5f3a863dfa238b688ab162

SHA512
cd1257517aae4091941f178f3e67ee76dfc42bfc8e7b97a9258786c54351ce865a21844a2f8c6d3cf1ba11fbfb2e332e087258e630f3cf8ba71348efc725db55

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql

Filesize
51KB

MD5
3cf302345be0b7c76bd3604a68215285

SHA1
5d601af01bed95062335d480a4d8c82651fd5fc5

SHA256
e257d9d42fa9d24d3d785b7d8ec02f4d04b8a8fcf855a69af27e9358cd48264a

SHA512
cfe1ded8d3adbe75796b211ce400c3fbb427b0b6cbcc10bfd97f99227a92f6ab196c6f30e6e503c3d3c3d972577f57d7b37da1ae09de8ecc658a465314deec61

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql

Filesize
34KB

MD5
463668d5138506396d6d9edbb0f1c2d6

SHA1
4a90c8db3f0f87ada7010f1d26960c366bdc90d3

SHA256
c4acb7448882c4bd286dde3e430aa063ee0adf68a0efbbc60b039f3888e117d5

SHA512
80d1eaa87352d6e703fb135f1b6acce248d52c8e8bf23e8dc1a334170a184b63dbb755d0b888028a69a20a5b97e82b5049f014617d26511d9cb2313145daafc0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL

Filesize
20KB

MD5
6d8666f8703ee2dcb59f7632ef861b8c

SHA1
1d57f05f20e94d4fab88ba62e63992e6ce181997

SHA256
edfeebcac865fab5fb90b0e238d523c3d7b1cd966b1be9779d649ada66a7e36a

SHA512
09a80872f05c8e4eff2ac7831d2fb8280cbfbed9bafe562c9facb158de86ed73dc45e31a1cc58a9346fa2fd8ddf2a125686f8eb02337966b69b204fe6e786391

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql

Filesize
33KB

MD5
056df48be510753e0c4550e063e795d1

SHA1
1cb0ad2e34709f061b37da4573825e86b4933312

SHA256
026e44b6022c966dcc5b28d8a1bab27b5dd14074b708986ccda5d06683cb26b3

SHA512
18dce28df0a1ccd36caa5d5ad3b9b293552a20c9267824bc171144b940564a02f605eab5793c32aef729c7d908794fc12ec38fc4fee14b38263e9c583ee853fc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql

Filesize
50KB

MD5
6f490793d70d6559d14ce9e077e770e7

SHA1
a9e77f9f2d4c350e29cf5a064327e125abf4d10a

SHA256
fdd7c1a48bae2dfe16a307d7c203ed5d2e93b8e55ec178ad85488b60f2f482dc

SHA512
d6705f913dcb5a0c6f444e0ddf33083015929e11607924565eb9108ee9c38db1ff3948c5aa1de169cc93921d38e30137b44f40194f0c6bf76188d88c1731dbe2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql

Filesize
52KB

MD5
e3efa507188e53d5d2f9bcca13d038bf

SHA1
e32da375592dc620e0b905ea795126b9ea3dd14d

SHA256
fa36a3dc135c07d6e323fa7fc7dd8946203658925058b44d9e00332b6bb06c4c

SHA512
fccae5c09f45238bee513d9303897c6803b5d134bc128be118008c8ce320ff4273642b7fe55032c4502abd2e3f7ee6e27c7c04756a7c767780ea3b5f9c129d2d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql

Filesize
6KB

MD5
e133c3bc15f80b6065f25cebaaa4cb6c

SHA1
bac48c5f0cd0aca1ff1cc242e3f8ecbe5e9d9d70

SHA256
2ad67b5c2bd4d0a3fc03b5106bc07511959e2076b8a2216c93507ba03feffd67

SHA512
6f88a8aa5056a8be703b9faff419aed5f45b934dc70b9866aa18eddbdd6261c73c8a4c57cd9ff3cc884859433ab1eb839710df19e7c02101dc79b6b1635cf828

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL

Filesize
4KB

MD5
adc771f213ae7d4368991125231d8006

SHA1
19120a5fbe80ffb60cbd6f4b0a91b7b7139e2fa7

SHA256
8166fc60897f82980d5857b56f2984177c0055749517f42d957bd60676c007d1

SHA512
d66cc443befebf9fd412a725583e311f893e2aea14fdff383b414ef03464b18e0ae22814b00d0e5a515a27e5b5ac3231b32944e06139a1aefd5c46b5819488cc

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql

Filesize
3KB

MD5
40780c124542aa20b4c1ddeedea24951

SHA1
13e67b71a8f0b6ef43453c2cf29d9a037d299d55

SHA256
67a63863534a3b20e809ad775c2c8280cedef0570c0bfe4d761fa216d3385206

SHA512
d529429b7c7d817f160f30a04ee65b5ebf0221fb513357eb45f721d313be86243de442a3e76cce5dc967a3eb8215ebc8023de17029a36770eca61bbbd288bec8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql

Filesize
6KB

MD5
c421c65e6a9680a8203c6caf605348a2

SHA1
f388167d0997b3d621f386cddd0c5b65ada3d0d1

SHA256
a0643d09926a726f07350e285e815ae89578bd6483d75ae21e45ad371fbd63a9

SHA512
16b516b4a342833e86e064a803ea2e9a3ba4e8c32a644da5480f2323b1308f478484237916ebaed3633df69e982cdb158388d5f43b2f6bef5eb1b76a5d2a1abd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql

Filesize
9KB

MD5
ff184cd6431f8d4df01a863c41fc270a

SHA1
0a0293cfe664757ede81852a9b46829962dbb02a

SHA256
b905f186918458c79c5191e4f74251557bf111752df775a1a141663a34408c50

SHA512
1b3fc6f1ea063911faa5039870ace12dfc3af7c5e7d995f597b2e9a2dbb4deafd84cd267351e87eb7ce0c01d54705d2cc658944a02d1b32f82d7640467d6711a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql

Filesize
7KB

MD5
9da2c531aaaf9518b5f9296b734339c7

SHA1
9534e04bfd26a7efdc6af31f1ed2e1895337aeef

SHA256
ffce6bda85b2e268690666c9e64bc1470782feef2c67fff202fdf102197df371

SHA512
fd1a82c34a6ffd8fe2a1ff8f77d41f377917f0e2862ba79a1d2513a08c5a9d97258d2adf88aba0a4610d385f7a74a09ac84a674122f54eaf4e59a4acf0a9ff31

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql

Filesize
5KB

MD5
8ad542f5eceafe799eb27e90b05d6598

SHA1
fa8c90965c161c868eaf48b6fa7f3d58e8e4e798

SHA256
176592160386a27730a792bf18c11b284334363833149d9e00a046665c863ac1

SHA512
edc3f2cd4aa7b34e295a38652b6542e124b73b146c94752ec0af39372370ffe78aa8518730b7a923f5871c3daedfb533ca1a0ac2430ad6efe0d3cdb9fa970754

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql

Filesize
9KB

MD5
ccd1f33aaeb57b1d3436c3d5a92ae307

SHA1
0c93755a1a76231709c084e7b1d272e2713a5f58

SHA256
06d7a0a4491217d4f2cc57c83e509decdc70edff73a0a028978dce4d22332250

SHA512
8eaf8fbbcbc8bab5443b1de56d713d63b350f1000b6e3ed589b5ac1ef71262389aa186981f35b9dc1f412d32f0987926ac83fb14a60b76c8818fa0255433dc88

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql

Filesize
11KB

MD5
096bb99b9bc341a467ad2a30289ab4bc

SHA1
02b7d8f8c57e3e14bd11db0631a8e8e6f031e7d3

SHA256
cc731bbb4f0bf805e46556f1ba3edb775aa8dfbde938a2410e364bcda77ce215

SHA512
b68a7f70fc7d982b9587efc2d28338c92513e1ba75fbd4b24f3259b91374b30d1c7077636f3de889d8f59059c7266b06ed1b4e6fdf952c2f39f83657994d6faa

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql

Filesize
2KB

MD5
6f1789eff8f360092aaa6ee2d903fd0a

SHA1
2a252738f23f4b346e97d9130192b02b55557a6a

SHA256
b44f4dacf3b8acba9c8c34f4b3722d2e5a692e393f9723b077eebeaa73323c54

SHA512
bbd27f61fba6710f256aed464be28709810f7183dc028cefeccd013d7e22e7e55cbdee2566e4a845fd687d48ea96964e59b702996bc6f20c606527cb0d672f12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
50e4d02594ea2408291da778f9b8b563

SHA1
adf8fc90f74c140e9ca81d176dc2db517331fb1a

SHA256
0d69880ab1c66245e3ecd3297b4b7e413e3ece2d274bded9dfcd382d30a94cca

SHA512
49dd529a535620669fd4e813a89b1dee4420c3d792199b5f69f83581cf9b95fe222e524f5e9953a3f887df6a2f1b6a94b2e529ef5f57ad8e60baa1ad3db92818

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
c1f89e5303588b445e8e54269bf9e964

SHA1
905fc38b167a5eb144398880e7b689148b29217d

SHA256
fcfcc79311790c752aba77f3c329e7f688b8f779ce9d8d11257217ecf2dba1c0

SHA512
04b0e65cb174ad20ddf17bffbfde3a8762b32295ae866dfc001716340504971f03a4c686556d19d902a46369cedf354a80018120026da6c6dd9ba7d9ff32dc88

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
8d54ddb1d9be171a7c5792d6228347d8

SHA1
f108e9d06ec75a8d433d2917e3053508a7a8e918

SHA256
f21b15d4b51a4cbe13f47809d23626dc9b8c3c3ab08a76acbd8eba5a7e894442

SHA512
b4bb7be5afbbf5a5b0237cd9b3f902e04c8081c26db01b8175ecf9617a373fd83c9c41fa88c7217aba1bd0461182582cc490abe06b5d789c076a14307f4103b0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
56eac332fa7829b7c6afc6f3f88db86e

SHA1
752ad69966357ad4d6d928625cfba21f8f692d49

SHA256
c06dbdc33dff6072feba4426daf3c60d5f928be1ec19354125e0a8228fdd25ef

SHA512
38959b8d201e38e5e75b97661700008b5341b06fcbf401008d653e2ac7bf7a4ffefd7e2d198e5af80aff1090e8754b0f04c4737b622fcd7f96469fde3e9d4953

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
d7bf9568fd67634191e4b5b83bb341b3

SHA1
294effa1e88166b1a8952caa948c83691236398a

SHA256
de31a5390bdf0586a538087207254e07736bc8a282b9d23dc4565d244d4adebb

SHA512
8b64d37fc13b91c718e617b3b3070bf1a96724056b63702f50decbff48c7d8698982861bb37716a5507a264ea8c4e1bc12cd847af2f23f55fde5723889700e19

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
2769fa25e7b6e8798a7b999ff4f57a16

SHA1
fe0c08c490b89329ea19fd7adf7ee16830f30b5f

SHA256
904102f1ffbb4d32f9c193906ada3b719726bfa4f43437a17c1cad18e87620c4

SHA512
4062c3cc33d115ba94da4d7d9b5f8ef2f766b9e7561e0a682dd2b9ca09b7ed13d5bfab337e051210dcbfaa64b4a1a35f156610a69881c02436404bc0e9310015

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
0aff3296a595953113554f32b20ebe59

SHA1
b8954acad8d32358883f436642638af9bc717b9b

SHA256
74a61ebf9267ba2dece04b81dc1a802cf9a9fbab5b350974d07b0c938a6ff23c

SHA512
d84e81c1abef3054b41c4abc785911348319c56a7afa0be4306624addf20c76859bc8fedf58d1b4fc142fe2065f6e62fbdec0fc2a684802476d928e7c24bafec

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
4b28045c62b1c19ddf70783ebb7fd0f5

SHA1
f3ceede30ddb2fdea581dc94352bbef17a2846e1

SHA256
8df8e1dfbb7ec9d42231dcc1e6308ee66e684f9789b857f8a59ddf21c4d5a8f2

SHA512
cbf6c57626376497d6550d40b8400df0a31cd4544ffd999d3aa20b4b3e00f25a63c01391cfc15e21b1cf6f27851bac5474860130654b7c2c15f7ab07dbe3eec4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
61e3160affd48c1bc930a9635d8b2882

SHA1
6fc8c8e5799f07305866cfee1411a43088dc02fc

SHA256
1f814bf22a9ae75c88e887c95f1de862e11774c20f861b96064a1c4a336c630c

SHA512
6c70bf76e33747c0d717f10c2dc1cfd89bf5b885dccdc5c3c7ba982c40d9d7c8d3efb940d82faef7a9d997a203d28433d4c1752b741c6ebe407d7d1e4d288722

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
9b485ede221b4b7379d476fb1bc806fc

SHA1
924b1e0d6f7c2f40483c9e5f10865b1e0f6fb423

SHA256
f81227a7c0a1aa4773f783a271e327411f30b972a8f95c2b86d2b504fc6e81ed

SHA512
d3cc0b2f477a5eeb2375a7935963f84f910c26caed9aeddc73c2bda3803ebfc43b6299956014edec551d3c1a652f872cf30838612a6a116222aceb300c8efb11

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
98d80140e3d67122d8236738aea72703

SHA1
086bd867cbaff2701945149181a89549bd46abe9

SHA256
e5892552e704411765d06ddc536955fc7d9a30291985bc2ceffbd010ba87cdfa

SHA512
77f41e298de521bdba79bef14d1efaee321f99f4d1d0c212af75c4ad467b7abf039b57f8a2b3e8e81961d5cd2368bb486fd45e53ce71452b6893855e088c3e26

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
f3312f9ffb92fef45dae7f8373e18b70

SHA1
30f0d056342399e2af9d61c01e295071a7a4b371

SHA256
fbb929c6bd8505f62e4b094a7786908adc072b99ca14efede534bf06cd52baa6

SHA512
d3b739fb0d27b1ce7f326f28e66e31ed8886563c7c864d9c1f7a385f400d0454eadd500e0a06141e96ce074788a2015adb937338f940ac0697c093d6552c4692

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
84144c780aa74934911c5efd20082d1c

SHA1
2981b58831710c092784777554b59c06051b8ddd

SHA256
44a4da346721ec5b4fc5a5c590a6214330ebb481ead0c461fd5d3bb9c4571bf9

SHA512
6e92af351f302ba73a9f83d1bf17da91165504c3602089cb0eadfd907d1ab438640718c6c0e35f78dd4b172e03055c681527112e09d0baa873422f55f8f19276

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
d96c6fe2a7f6adc628e26f8fb87744e9

SHA1
92b2c3798ff899eeb513684f3cf6c17b62b63878

SHA256
c6b665b1ec3b60c90f544bd188e53140ed993823fbed4e09b21039a76e61b7b2

SHA512
b674a8b237466faf5e0dd1fc735e98b683f88df11c659c957288477ba17b71520c090de798b4f7812037b542ffbf3fecc1fe08954ea51977f5d535d8a3a88ebd

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
2a7dc140383afed1fe4dfd2585863019

SHA1
583d889f0dccb56c5091960945814633b6a44649

SHA256
bf742d3e514085cc3330a355ff09d8fd04de34971608c63882e56b4d026af3ac

SHA512
3fa2f8a2b8f165bdeb32205ff230b8337e3073f71e39f363ac8132187e1d13948f77c3fe4a791acc3e24cbe31b36acf5428392b8a5f8673f5a07435d8b512334

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
4ed47691630dfdf845fa06926e9c456d

SHA1
630bdd2d902588d9ed3ad7353d8e2d97ebeaab8f

SHA256
95b0bc5f473b0fd9a1070385bad5df8effac28aafa9584482308df829f899b05

SHA512
02a79c67d643ec5cc3d1eb82cd905cdb3c6865de655f42b5ebabf7ed505fe20a8df864460cc9e5483df38f011db1beb712ebec666b9c377fc2f550058a35e1c3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
816f04d5b19ad95817f3eda4254ad31f

SHA1
9e4c900bd36748b227a0f44437bb9f8e54219389

SHA256
ca1e9fb2fd31dd187470360ec3ac6231423d6714286c97e5fed4b15af5c11ba7

SHA512
00a1d3b5252a8c37248b1cc5a150bb02de21430b71072f3fbcd7f2bead723d8ba57b59ce2f2810d5e3e86c42512bbb61401775394f7cee0368ec3d7c0bc057ac

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
1e2246cc67a06d675e889f8c43a694e2

SHA1
58b3ff08f3b254f0808c7dafc6bfc1c2af16d962

SHA256
2b1ae029583a4c248fcdbd0f9c0da7be601c4c2e0496acf37aa232b185d17258

SHA512
4d0e35c0632c80f8dfd08914febd2f00f70c8006058c8aae0176cfbff1cd7dd93c0e1669b8c3aa39237d0634b79a760200d315a819e09ba4040e319fd3d307f9

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
f46df929d6424a43c9e40673c9ad37f9

SHA1
b04d6e4b787e8a98fc67744a56f71c6876e47a02

SHA256
2587a7b9fda1a96ef113856bedf2bbf3daa03c3ff12997bb54207c9ba3412073

SHA512
66a77128926fc745ae6d7601cb364731f044d45d43a6803cace568c97c8226a9008d4f98153ff1e528a16f8fe2f5a5732937958cdf884ae845417fd99df4ca11

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
a2333f9a05a0cda8ec1fca873128651e

SHA1
d689fbecb6f2ef1e2905fed3f2ecc696290696c9

SHA256
2ec912e6a40c7ed48be28e1ed0ba35f4001e4db0d4b33fcddbff69fb60dd7b10

SHA512
778591769f1a777f162b328f6298b854fe4b03ce438616c96e274f0def2d2479003cbdcc8b3022b7a663d82e33a2a154952f06ac9c5669de382dfd74a428bbc2

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
16b95e2710d994b9c9514a3ef388a396

SHA1
3dd0af08c3557b40aa0dc4da4422466296861c68

SHA256
cc0c3ac7b27b0a542f93070ee076c542dc5a1427f1fbe1ffe888fcaca22d1136

SHA512
3a2ce4ea20a107f575a6129b37bccf5b6efe8811e8bfcc24cca0784809177bb412f86ece0238a1cf404316be5a28c60471b9978a0a264ad63c2fc5934bf5b8e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql

Filesize
23KB

MD5
5b1766b4402e19285a1aadc283b5302c

SHA1
663a9c7aba08353f11ba1eb9b1e2601c41503d43

SHA256
555ba55c87977d35ef4214f4fc83ef7924f18452a95ecbd70288a79f13e76a86

SHA512
0dd04566c5572d72b027c7a1c62c920ee4e4dca03d4974c589b210273e4b6a76741e38f4dbbd25b3d5c1089dec52fdac83eac7de7bf431a7880a8ae8b687597d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql

Filesize
4KB

MD5
a0b64890e04b002f2ef8df1524092d9e

SHA1
416d531958f5a9f14d5a9a35ac11695d8e514a0c

SHA256
1c81b5766da7fbfd9f687b3317a0949c6fe1f412a8c2d095527af26591e56423

SHA512
ea20581874f070199c46e2dd1763f781ef2d905d25448a0b2b77782488c81b943dad223fb5cfa3675b5bf05432547c029551a961ffced89824b3afe9ca600b98

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql

Filesize
372KB

MD5
2e541e0321a0fde825cb8bd7ef297541

SHA1
9122da3efd96b3bbf4f46b8c716f83a0b75fbc5f

SHA256
1e5495ba9a243aa88e819864afde235d69a628f3125eaf1b708fe9871b6fa101

SHA512
29e4bef5ddabe1825afc2b580ba9aaaaf0e232fed189b6bfd777d2dbca66dde1df89b0b01fb540912adfef2a2f4c67e9fc266b74b29f104d47998ceb1f71285c

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql

Filesize
49KB

MD5
122811dad852d1ba2379a6ce2f70768a

SHA1
4d84ec319f274d24de267e47e222e8f3f97b461f

SHA256
77f0f152884c11ce5015d1bd34bd2234c7cc61fb60b94e783fc2131d522e07b6

SHA512
f82bf07f081597a8c05ae9b339ec9f819777301908524647ac6f5f88edefdebd7335e48af83a1ec8d9267b54d2de7e5d46b765acf2448a92a53ca19a15fff565

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql

Filesize
2KB

MD5
979f27eb57e970efc87a45969d8b03b1

SHA1
9ef27d650ce81056d2e4a7993cbec343adc8e868

SHA256
81ce0463da923b1984f8fdb6866fe34756deae8a3490b4f621a508917bfac7b0

SHA512
2a87b79bdbb151011eecd2b647c298d6ccb5ee7fbd5aebcf4e7081747429a98560a1e4c09bdc1734ac7bab7ee571fdcbdf3bf5ec2cf15ede646fc7f3b5640c1f

Download Submit
C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql

Filesize
13KB

MD5
7a8844371aaf33721d44a9965fdd5bfc

SHA1
c22ae0a7d790b3f50ea07995b5d2bdd8dccaffab

SHA256
95d8f8e298c04256cbbb4fa1cf264092b6b452cd18e2fc7f7c0f8b9df27a9b18

SHA512
1c89caa6cb7d5693e1fb85b302a98917a3849f40d85596365f1b4125827bf1f634d994a15e06f74dcfabcdbe7ef3d7c62f2ade458df08984781a43d2f73443e7

Download Submit