31bb6623135868e94dd21d8850f79a132cba87ffd70434d4ec06359276f1bddd

Analysis

max time kernel
118s
max time network
119s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-12-2024 22:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Size

12KB
MD5

ba5fb50a27e431b58ef992b9404b729d
SHA1

45d432252434907d380b406e11381a019b4a064b
SHA256

31bb6623135868e94dd21d8850f79a132cba87ffd70434d4ec06359276f1bddd
SHA512

dd82d49acd3cff170e5297b4ece59e4631946d5208b5680a0b52a7253f27bc7fc4d3df52f5e3fa02bd8c7ad2f004ea887047122bf758fdbcae9f47296677309e
SSDEEP

192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMCsy:eebFNw4Pk1itKkpAjjI2YpdmCP

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2208) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Switch.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Language_Keywords.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Switch.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_pssession_details.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Ref.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\ClickDownExpanded.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_functions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_transactions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_type_operators.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Break.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_scopes.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_job_details.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote_requirements.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Line_Editing.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_do.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_environment_variables.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Return.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_join.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_troubleshooting.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\it-IT\about_BITS_Cmdlets.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Redirection.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Assignment_Operators.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\AppInstalled.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_prompts.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_WMI_Cmdlets.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_WS-Management_Cmdlets.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Parsing.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_transactions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_functions_advanced_methods.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pssession_details.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Variables.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_escape_characters.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_functions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_transactions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Comment_Based_Help.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_remote_output.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_regular_expressions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_output.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_types.ps1xml.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Foreach.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_While.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_hash_tables.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_join.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\default.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Command_Syntax.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\ja-JP\erofflps.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_format.ps1xml.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Line_Editing.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Reserved_Words.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_prompts.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_types.ps1xml.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_wildcards.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_modules.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_profiles.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_environment_variables.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Session_Configurations.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_For.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_remote_FAQ.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_Special_Characters.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Special_Characters.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_preference_variables.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground_PAL.wmv	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\OrangeCircles.jpg	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0337280.JPG	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384888.JPG	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143752.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\White_Chocolate.jpg	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jre7\lib\deploy\splash.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\de-DE\clock.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\system_h.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH00601G.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\BabyBlue\TAB_ON.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\navBack.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\2.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waxing-gibbous_partly-cloudy.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\forms_distributed.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01748_.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR3F.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\DRUMROLL.WAV	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\it-IT\RSSFeeds.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\120DPI\(120DPI)notConnectedStateIcon.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR39F.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\whiteband.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_Loading.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01746_.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DigitalInk.jpg	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\SAVE.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\NavigationUp_SelectionSubpicture.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Waitcursor.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_bottom_left.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099201.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR1B.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataListIconImagesMask.bmp	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-last-quarter.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Updater6\AdobeUpdate.cer	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-border.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\6.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\de-DE\slideShow.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00780L.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsBlankPage.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\COIN.WAV	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous_partly-cloudy.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\TaskbarIconImages256Colors.bmp	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\graph_over.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\SlideShow.Gadget\ja-JP\slideShow.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\selection_subpicture.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115844.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR39F.GIF	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Windows Ding.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_de-de_59f90b40a942117e\erofflps.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-ZA\Wallpaper\ZA-wp1.jpg	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-8.htm	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-garden_31bf3856ad364e35_6.1.7600.16385_none_f7a4bf1e15863e21\Windows Logon Sound.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_functions_advanced_methods.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..edsgadget.resources_31bf3856ad364e35_6.1.7600.16385_de-de_de44258d81747ce2\settings.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_pssessions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_hash_tables.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-wmpnss-service_31bf3856ad364e35_6.1.7601.17514_none_61acd141e5332baf\wmpnss_color48.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Raga\Windows Hardware Fail.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-19.htm	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_pssessions.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_script_blocks.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-m..onwizardapplication_31bf3856ad364e35_6.1.7601.17514_none_22f5c6aadf559287\WindowsPhotoGallery.bmp	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Sonata\Windows Feed Discovered.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\add_over.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\btn_search_over_BIDI.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Windows Ding.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_remote_requirements.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_d7244b05e242e449\trad.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_679a6ba79b07a3c0\icon.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\11.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_blue_sun.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..soundthemes-savanna_31bf3856ad364e35_6.1.7600.16385_none_8501e89d0b011992\Windows Default.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_try_catch_finally.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Delta\Windows Balloon.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\item_hover_floating.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\hint_over.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\graph_up.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Arithmetic_Operators.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Festival\Windows Feed Discovered.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-e..ebargadgetresources_31bf3856ad364e35_6.1.7600.16385_none_88767a95b8bbf001\button_MCELogo_mousedown.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_b4a6b77ab9aa530d\about_operators.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\docked_black_few-showers.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-13.htm	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_preference_variables.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..picturepuzzlegadget_31bf3856ad364e35_6.1.7600.16385_none_ce76f352fa54bd75\settings_left_rest.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\docked_gray_foggy.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b87da52fa7e9b700\403-14.htm	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-style-shatter_31bf3856ad364e35_6.1.7600.16385_none_0cd72f8900478c68\NavigationRight_ButtonGraphic.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_Special_Characters.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_locations.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Characters\Windows Pop-up Blocked.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Sonata\Windows User Account Control.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_1d72a0e2bb459532\about_try_catch_finally.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_command_precedence.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_de-de_8dcb8bb83ef0bc47\settings.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Raga\Windows Feed Discovered.wav	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget-insidebar_31bf3856ad364e35_6.1.7600.16385_none_04ef2896fc362397\slideshow_glass_frame.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_gray_foggy.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-ca-component_31bf3856ad364e35_6.1.7601.17514_none_fae061a2e0ae5019\CA-wp6.jpg	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Windows_PowerShell_2.0.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_c3b9072b536514f6\graph_down.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-5.htm	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Redirection.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\28.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-g..s-weather.resources_31bf3856ad364e35_6.1.7600.16385_en-us_36bc61b12dcec80c\weather.html	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-full_31bf3856ad364e35_6.1.7600.16385_none_ce3a164d3f0fa152\NavigationUp_ButtonGraphic.png	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_1da743febb1ea38d\about_profiles.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_functions_advanced_methods.help.txt	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ringtonesamples_31bf3856ad364e35_6.1.7600.16385_none_135e536ebbe59c28\Ringtone 05.wma	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\ = "CRYPTED!"	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\DefaultIcon	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell\open	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XLYPOgkwnmeI0m1.exe"	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\XLYPOgkwnmeI0m1.exe,0"	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell\open\command	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PLWFFSKOJSYWZYV\shell	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "PLWFFSKOJSYWZYV"	ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\ba5fb50a27e431b58ef992b9404b729d_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
3973e13831cec4ba689a9c550a450b03

SHA1
fb359e109f3fea5dfe3a2d47de22da7057bc7b86

SHA256
43a64f1b0b02c86874851eafe1682f22ec1ffa801e22c558074ef0fc072404d2

SHA512
e6f29762c487dfc5ce94a780ead98328aeee5d70c4499d7d0bf86e9fbf73d6c93595fd198070744df885d5ebdee1de5763e4c75a4f5c1771a2ada313b1d5e46c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
8aea000ffa12c63de9b6dbf8e44b4ebf

SHA1
2eb4adc73fa1e91b41b4cdf50e85ca69f1df80af

SHA256
72558ade1e803fe24057c20a98df5fc18787ef309aa36a22e97ecd82bdd69c48

SHA512
98cad45da8367c2112c3dd8b050c25f6e005c120de082df8ed1bb58ccce03aa8d83f1db8e4dea3e48786c9335a27d2515e24a093020154c39583247b96b110e6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
8ce69f1e669d418a7d41d78e34a075d3

SHA1
3c619d3771921ff3f043edba8630ba845458c557

SHA256
5e432cdcbb3acea7fba5e5a0c07dd5fc0cc39fbfafac8f2e33c8a30f91755e9b

SHA512
10635eec5975bb1f729546030241e7c706f118cfcd412aeac77b0aa8a06956d16d1ab9a367110927fc1950780c0567579ee4b38942a164cdb2e244f85dae786d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
8c8e1506b9aa296cb053cb928870edd2

SHA1
9d82bc6cf53e9aafcf92ceeee5066c0617c4944c

SHA256
6fbee37cc1a0b3fed74804a1f3349095a9f298f804bea2073ed6ca2d67cbad3e

SHA512
c056cf375e4f10e028c05afe1cd3552c6eac76102f6ad3489f037c221f2cc44c312d935b27efab3698689faa7b2cfa64b8ac3bde97e559973bc72cf2e976a867

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
93645fb370e515538e2a3598b64b8d04

SHA1
a8245dd03811d4e3e904db7b06b33b2aeb68eb2e

SHA256
8d2720e68ef8de77c6c53d483439597eda5ffa6632b6424849e287707f72970b

SHA512
3ae4bb66204f5cd5759736f0480b535fd21275135e34c27a1951d7c42390f7388432e6030e2a7900a461b83893ccfd30e219c5f10971b76fb915d72299c2c07a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
e9041eff0dc5ed5271ddca431508d905

SHA1
b1390c1eb89c910a51cb6f5c6b4ce5db1aa14ef5

SHA256
f0315e9a646c4c319780ba3367f49290f76c4d10816aa821b8e3c68d58a47e38

SHA512
f4e3cdeb771ce4bae7b3174b460db55c675fcb532ba4e576ad77104d413adb9cae1b6cb4a34b12c500651f07b3405223f5e34c03f5577ea82bd830f68d3ebbc5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
7574a82ecfcad2b45e43215cb6fcc10b

SHA1
b7177e3f9484d1917366994dc59e2c3b35626df1

SHA256
9fe541b13bb17a0e199ce27791285042c79d1a05ac33b83c3bf70836a06be65e

SHA512
8e4814e1e3b720ee0f9e63840f44e3668c9b460e48ff0400f2fa44eb25898610800e21ec0c4139417ba78538c855a297ab06e1bd7d07a7339d466a8b0ac63642

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
951f32b0616e945a6b030e0b40bef010

SHA1
77ee72c1f9a2995281dcfc61e5b034ae7726d483

SHA256
c943704ccb8ccb0d969ef97a51288443b923c36bb1d9742c1c501d5fe8ad4833

SHA512
88418daa7c9a11c4c24805c4e0d28e60498c510c2245a22ace48f81704635a30d3e463d2d17f75fadc7e321121002a5d577393ba97ba8fae9af8774a69ca788a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
18cace66d22c30739676a32b043c68c9

SHA1
ef80c7ce65a966c164dd88e15cf4d5b52cf22185

SHA256
018ad838c8c93579087dca38edf8b0c2c758262fb941da240f18ebcfaeaee7c7

SHA512
e0e87d909d67be657f0f70a7bc303fdb78d46df4fe92d53bc2b62a7add102fd86b3a573d07996674c405465b83252e667825aefa35b70b4a2988ea6e4d2f2a48

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
71d00fdfdb0c9908e4766f373e9282d5

SHA1
e8dcf46c038269f641a1cfc2afe51f261f873b9b

SHA256
542cf94548d9adf38a7b4fd66f371388e68714f0f2d76239462c726515820635

SHA512
f3fc504ebb0cc5f6781f9ed2074bb131dc2200be227baca90c5072e20b05d120a6fe3d84878ba4c22a343a836c58db665a5ad2cd7a779c873777052dbfd79a04

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
ed68d141ba3c8c668da6cece217fd0ec

SHA1
3ffe798c7b07f9b86f083016351b77fbea446119

SHA256
5e6f4b34bd0e6179d2b6770a2659928ee162e4ea756ea8e1307c0b8a3cc93536

SHA512
cbe772f20571b9a7423f53a88b33ab3f0f5d01faaf607a5a3086cb6f9626f5a92744a6aa59c0005affd8140fbe5c6f150d4158f463174092c014eded4fe909e8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
fde51d87d84642de018c9aaf71c05e8e

SHA1
06d79fd2d6d8d4eaa7eb2b33bb93c3740f3c8d05

SHA256
af4de768106cdfcf32fe84562d8216c6f0177c22aab790ea7266721b9d1467cb

SHA512
77f93c37d7c8b039fcb3bc0aeb72072c1c4b486e9372065778fe83a498bfec0bd9016fc1723dff60937af518ee7b3b66ea79a88ebccccd3d0e38ffd419e97c2e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
f03cdb78c259031867a63042d18ddeba

SHA1
fb0e4c79002ae0827745e9f4c62d3a8724440d7e

SHA256
a7ad66e6484980c3b0f7039538fbaea033e665079017f8a64c6667599e5728c4

SHA512
d750d3131196e2edb8ccac9cdfe31a35394818a5c776cd6a8ecb3032fde62a580368cc861d9e8d5f1f340098d6280968d0e82fff84382f9dc19e09c4df2d4d81

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
6b8db187fdbcf656cf1c4670e99f4b3f

SHA1
e7697bf1d5cc2097ff75732edf37496273c7cb12

SHA256
e37ac19dce48d8f374549f5272d4d24b624eea044b2bbcf5a61b55f55232ba8a

SHA512
8f5322249a361714d63ad343b28cc108b7edb3a5c8bfd810294aa5fee6e55299fa9ee1ee3d38d84e1249de1cd4fd53cba82f6893a6a10d778bdaf64b5c6085be

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
87b5461b280343cf64ac9ae0901b1f96

SHA1
ee3d7cfe48556bfe057964bd11a1ebde202e8a3b

SHA256
354e786af5e5826da949d330bc7f70f10a4ecfd3f084f4ffe37f723ddb295220

SHA512
53a4e0b8418b04c6e3afe267d3a8e08f5dfbab32fe8bd16035a69b1643fd816640498724feb1486b6f1fe311340a1df3de909c9e2dced75fc5ec24c610a6ecbb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
72a19d6f59802326532d2d411621fb54

SHA1
1076659a94b3b19a3986beb8a843c800e5f41047

SHA256
0f021770c58bc8e7cfd2a383d81364196862bf847f3d736e69010ff04f75630d

SHA512
8a8012056e5b143b28cde03df1e927b07811eb3a21f2c974f48a5ea411e73d2a742b64ca0ebff61b453052820dc83ba67b3a73bf8d07470c9deb17fb1aa59482

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
682a8eaee497e75a25385507974d6ce7

SHA1
7c4acc6c268fcedb83c86551a937ca7913e1879b

SHA256
e1e19e69be626d4e74c11bcb947ef04151fa04aea8d12e55b70819e18d53dbf7

SHA512
11dda2d71f7b2b0abbbc901fef18dc398a7b3945da13592ea736348d9ae8f049cb669599fb21b4b38d6a180546b8dbedd654a7a509f27f4d0dcd888422f465a5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
21b3549605c87e9b7145b3bf4a1bd0f1

SHA1
bb545e78f2fc4e6069729f49cf84aaaa0c8636cb

SHA256
f7fe710a08747028f2f23b1ab8742cc96972b63f8eae9a7f11b4d1a650d13971

SHA512
8331344164de338a8d23c688c547e4c7fb7568a233e1bd0ca742cb87de33fd87a693df9bc20e22720b94f6e1d359b5b3bc270bced9743a5ce0730ce87cb5a050

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
f2bb1a1b01ab3245b31b638d50c55f75

SHA1
175d4897881d2b7327a990a509abaa702cb47ce6

SHA256
7fc6c54e5c72de9f29a1ea69a8d4322930f377d9d78d0f363d85b5b320500cdf

SHA512
c8c02673c3407c67f4b9883f492aa2dce87e60f33475031e5874f961c8352ce1e32489ef9f550439855fed5025526c47a8d9b743942f1ae9adde98236eb44fd2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
4929acf371cde7759fbeea7d3d4918f1

SHA1
356845d3e9ef997573eb15c80ba3bdbe81d620ba

SHA256
6708ddfd9b68d33d70359a18915f2afeee3d29aca41ab0ffc3c6735833f64a0f

SHA512
fc123d5a2ec4af134d4c97b62450ca6a1b402af11732b7b0d0b1f79b15323f023154c86213b3f8157efe2ca8aa69204c364f0a4d559e78139049d98686ae4ab9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
9d06fc72652016bbdf78a1dbf59c2961

SHA1
061a2037cd0d884a7fa6e682c392190262619030

SHA256
ce268ba647f24714616dac3708b4da887c2ebdc752afc51fd9804a869fae6262

SHA512
47b0d823304700b7866dd2ce0ecc7275bbf68d35d65b71793d3ab4fdf65401821d669a5f1b7f058e222e3e5b9f2930d499a2c5f5b753217dbe4a47b22d353844

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
1837a0455ffad6400311db11c0ea8dfe

SHA1
d709125e522ec4c0a347fa8cdb810166ca8b7133

SHA256
2e7a7d3b4c09d5dfcc6505792927202bf296c0574d2a990975175297a6dd9954

SHA512
8c93b79a6a931dc7a166540bcc47c4c0672b7b6b70a96c5ab7aa5a9ac16d4d7e17cd69de30237bba258a28025619208c162eb74547e218180b0ca99c8b083e30

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
ec627771147a0c2186dc77d35e1ab067

SHA1
32b9bb4e6a983efb48c8e9178b8b8efcd9f34efc

SHA256
39c13a8fe07d4c361543f250697a715271b5441f8b8917d39889010a4fde300c

SHA512
5889e4fedefe7ec2cdbdd107f71f2e738894648e0b640f04d599811c1f90e9fff3d322be12a9a10cbf4c57fe52e4a3979eae2cb22e7a535ac5a2c2833ce59e64

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
80747cdff907ecd66d80acbc99759a8b

SHA1
d88e594509e60fcc723bc299a59b20a035434352

SHA256
17254949ef765c70ec8651a1cc219042fb697beb6a5bbd0bcf7bb5a14fea2c9d

SHA512
a1502319a7821184c67db87aff32b4f7d89f124b4996d82ac7d5ac62fafb72d82d1b3f0ec4f64b0df852c6cae6ea7f7f19eca2a73cc7cff92516119425118efd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
be5ee5e41754cea9d00556911765e4d0

SHA1
2ea9b3b1268398161ef87e2fbb3eec84f174eb04

SHA256
4e42377a0d96b03af239b0055aae3123931d2f713bc24585243f7781f8278a60

SHA512
e1d6c34d5760bb960ea73a29c318637f62a1e5b873ac836e2c8859a456ab78cdf68c209815d03492eec596465d9f5655963ebbcb751451b4f102b5114ec66290

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
cea05d9454e9a5e3b2f3629008b7745a

SHA1
13d77b4f5ea7ea6a21c87a69eccc012fdcc909c9

SHA256
e8c79c12106b8c62974d1d36a0328f32d5b188859d2083db4a53a95f24274b76

SHA512
496d4dfdf84b22500aa8d6c9a94fa0427eac4d2f6e650d597f82a0e7397785078c455e005fb41ec117139d4d63011c4d3a25345b1f47d6ef532abc5da91287dd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
8250b747d62fef55d971141018210bfa

SHA1
43bb36ca5f3f19a5e7f002f907672b333cd08da1

SHA256
1e3ec2236a66654397d4bddb652c0cdf389c9866e7eb92fee904102433d3e1f3

SHA512
790996d83e5efd63a59e54adef5480fa57ee3763e6d3b9c59e4916011fc7ab6a74631397086db5d15539d6d2534910049062e7484016024353f056e6e85f57d3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
0d73b0c28dba940928f24c838a736044

SHA1
451371ccb25bbfa849bebd61a7375df727a5aabd

SHA256
3a4a5ea2c95ba78ba958bb495a7a99b8b3153a59ad3cd347b27522d10d18a787

SHA512
adbe11f947479c275aefd3c46279372f043086d77cc139e5646431e506f12cfff0fc5bd9b646ff3b665246f301d89a8a8a92caa1b526466c79d72ff1f8b20047

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
30156e1db957a15e0070f7178e9cdf67

SHA1
a4da74ab081d56f81430a3b7b546d9d4340e3fc1

SHA256
99eb561705c3712d8fcf73f66054f5d68e837338fae501f9aa0ba3b7c914b69b

SHA512
d0995c2e6381581fc2caa4f65b9f785dcfccba0f2000f4ec60f920c3e61b2069c6e645766e3dcdab36dcbbbd0b607983a725ed2068d002ff5b524c1e62e57459

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
9e5eded59a0371b76e42f75f45715bc6

SHA1
55e3859b498d8747d8a041aa5ef1880c40a298ee

SHA256
2153e754506a6c84c54f0de46a4773e90b62ff0f037a4b3c342bb2314135379d

SHA512
a5f53187c733df05fa95788e652acc2bbf3f835a8071d8c2abd51f6b8c7c9b18f23580cf6eb9280471bc147001990a0f6afe74481d07862dd04cc8914bc175e2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
954a52532ce7629920276ff1aaf664cd

SHA1
ca311280ac5bc9f70481506f8f25b665aaae3aa3

SHA256
eb4ec0f4ebe815b6454223d46c92178df32a250344611716e94330d9da4ee0aa

SHA512
9d0cee90669d29d13106ca6b7626b75609deab6cc8a21bd877603a0a4a11742ace67867b5791a2f8da64ff9073577ad52a45b528836c00fabdaffd13115a89a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
f150ec16bf94209de12e53085a93391d

SHA1
b04b6f70a6fe6b404821c027d89f11111aff703a

SHA256
2419faa0e5c7f57f62d4aebd03819b511f40c8818b3cd9c187bf1395150e36d0

SHA512
eba7b6f99d9dc4acf093509fcceda548b30e21316d4b16687b0fe6581ff3f34679593e9df70adc8535a4851d867acbacc708f6bf6251f5e74c6a3be4935d53a5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
f73c66c2b37a8cb4e49e8ab6532da26c

SHA1
130a85a5ede430c83516757c957227df7dd952f6

SHA256
0cf1714059bd5d69a0324b8a54aa8ba217a4d096497503df41e622d5901f3505

SHA512
60b449815aa396444e8b382f203201236a164bd3a472bbff76280ccdae76c594c7f6efbd3c981b0afd38e9d29497c59b2ab516f0817a8644e3acd63c8467009a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
f9f2b5112b44fc840bfed7a335c6d8b1

SHA1
ad7717f595425364c3d2a8227eb3d2873d853158

SHA256
2b506e4800d1295457b0a160034a932949252b8f37aac296f78b5d3c61eb9c5e

SHA512
13d18a882b11e1a7d494dd41d7a808e3864efbcec50756454526caa59006af15c5cf4ca8f2ab6dc13d6afcba3fa6573a7e039d498afa97c719497b9dc616a2ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
d0d8a3d91802c545774439e5a060e24b

SHA1
e487c7eadc08f4dfbd80bdb6cd1f05776392d1cb

SHA256
544b47c78ff60870d25eb684ff451d7a848520561b984304fc3a1c1aa7c92acf

SHA512
8e90250584c2b36ac3db30ba73cf126faac36729e384fe02124fbea27707de2ec4ca56e9b5ce04755f68fba220289bbbd31eeb1d710871e9fadc45fac346724b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
cb13731c4e2fab5f9c7eef614298129b

SHA1
bb14aa19ed01c8e2424410b8773a4ffbb72acf8b

SHA256
20ea0bda516f8870ed9af071f450b14e6b766a23ee068788c4a481634e9a5901

SHA512
a865cc40bcbb166bd0f72b6254f305a75206a126e7476e13dbc38da3938e520b8c91ab3ac18a84d05072777b1dd2517b17376a7298bcce5b39051ccadd066b58

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
554a8a38af1d9808f7216d9dcf5e2396

SHA1
af8def40e8f65fca6be4f9df4735bce5293a58ac

SHA256
ab9bd62c07f3a196a875e89477debbf73638b550d1f15a27d9e69ec460350011

SHA512
789977ab7b8b38cb07a5361e5cb4b4af06ef3d6c966e2ece79c1f0ea647399a500754dc24df8f1b8dac31ac38d34787a4f932025c93089f8f099edd231dae862

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
ff37b845cbb5e44cf5875c5a2af9ed05

SHA1
a70f64cadef3202eea277cc5e69ad25896181e8f

SHA256
94edae4accffe42aa68560f3e449b68c0810f8432c6cb5fd5021a370c993437e

SHA512
11e31125b647e7506fd5cb14df809b6f4ca7d4b8c5f162a74c9eb3d4a61e7ef2ce2b896c03ab59d79aeba3a54c8cae1842cdb006f1917b0bdadbab4299978fc1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
74bdcb543e49b437d432059e9474004b

SHA1
bc23a7cfd8d5ef373000fe818f0603a9cfe80fd2

SHA256
e2cf5032726b6068405da8465d785f874508ff3851ade1d73c2695121917f8ec

SHA512
9e912f2afd2dfa37ddfd81666590a6c2996d2f1eb6427b4831746f7909fbe94417db4adaa4b5eb410f5926f5b3b9d7e43b8b9d31b0c8a3616fa4084de5aa04eb

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
1dfbff0e453784f005fb40b4c066e3b6

SHA1
b4ebd7081d20b70cd8ffa9eb364379771fd15027

SHA256
53eaf14c271b4c98bdb609c761bce241c0884cc0d101e2525102b16861492459

SHA512
21ed3fd9d98d1ace47eacd986e0981b46e2912e2f100076487a0f85c4e5923031db243f6c1a2dc7b3664f4e2b023c5738d16a306d08568756ce05d5401c0cf5f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
256bbec366689647eb13a46f36773ff2

SHA1
604c682432a0cec18d06476b1f07ccbff6e7a0fc

SHA256
ba4aadde8ec8c9d4acc42edf7f51486de729a62a7e26437acfd7c39604440cc4

SHA512
c1e29398c5800513af2fdb80ec09c00b2bcc2a2957448ab712e9a97d4fbea9aede6ff527fa90b16a448bd491a0199c8b0b0692b37afff14b100b57bdf10be972

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
729ac0a0b366eb2bdd0d21a701df6d3e

SHA1
deb852afc138c1d9bef39140fb26fc202d9ab9b2

SHA256
e843ad5f663f6cd288656cbadff68b487e5b5a222389b8c37ca524e02bbb342a

SHA512
b6f4d46484f1af896916f0f17f4bdb4b782eeb70ff595e1cbd2edefe60ba94dcbcf3f6c045f38fc7f3e3849ba845c6a202fe735f2d397919e2b14508d818677e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
de026ede7e46774692a24743cd767526

SHA1
d55a51ca0922ae4f66911f8b861a32df85a86293

SHA256
98aba5845b7afde5b4bd2307addafb274238c42b1d52a7cff62ebdc9de51bf88

SHA512
ab70a046fb4ef869ec14fecc655ad3e8b98fe75075e35c75b53c031789033d6b9c73a08594241f7a8d584576c819ee4ad77854113b8fba7ded2bc5bc8b5fcf66

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
ffdecba025c15bcb9910d952b5f21b32

SHA1
d6bd1b56267e5d2be66fc2119a293df85b56e8a6

SHA256
d6a5691456e76fd34fd3637f7c75d4d83d2476f0758a488d247d27288d7d4f65

SHA512
07d88d33d057b1fdddfc64a6846c6a821f6b3a2a1fb58b8953868d85d74a68bf0d39dbbe1e92b1029aab5fdbed6b7e0408fa170401a328932ed80187ce46c731

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
883701a3227e66137a27aca31a173aa4

SHA1
d2918192fa5154cd11aba415915e245b5cb8fb74

SHA256
5e0a12b57a84faf01c5a49caa79a6deded532bfac07accd52b2cd9d6e5c292ac

SHA512
d1febc658c2c912ae3b84402ce9b9c0f49b1373f44b5f8e9afb8fe1928ac9ef2b14a9b15507629e4139316d8bd3599c70f0f75c37b4ba80d00475e1cc69209e3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
682407f3e2d9f7569a9a910c4dfc2cf5

SHA1
25dbe0b9d8838b57484f3318f78a5eab789971ab

SHA256
de2bcb7e52f34d82da0c730f798a54012fc474754f5e630084a46198e414f31a

SHA512
9a0b70c3a0ea11b905140b306e32d3c04fe5a4a8619055075fde11880c42bb6470c4543dbc4435dd7e89752c3d24d0c6e5b6c2c4caced1c24b285c4902425f3c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
e975641e36f88fdfd5f496e9910abbec

SHA1
39d9074755ffe78a26ff3561683cbaed62c39b9a

SHA256
2509fa6f5ba18b664b24a96a35e797aa6c40e616423116bc1222108aa59f2e86

SHA512
4edcc2d0a4d20821ffad81062a8e1692b71d206da83aacfa892b4afb0a5ec046acd768a74487c48749e8a527953e47b9fa32cffb054519609f7c235480066a96

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
a141aec1f6e7974e231f6550804d5f3f

SHA1
2fce1ce32119e7dedb5f1c9d4eb28c87b5984042

SHA256
37b1ead64e554d67ce1cfeebac0e82f8ffe880b4c48acaf9cdcc5dbaf86f8880

SHA512
f88838cd5cb36370ecf9971061ddc72336635a1622f9414b663a62a2019c8edaf6a1db2cdf845d2fc8248da8043f4276c71fc6683f24a63a8ddac4904975ce32

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
49a16075c89c92e6da2f64b24352087d

SHA1
111592cf4c627e0c8b6553676ff15e3e6736b61b

SHA256
b4ba1fe406c2d3ff379b584793702a26258f43a338cf76a0bd3ebb0efdb6b85c

SHA512
e239faadd2e8a85a74f751c24ae4fb4ab21bd0fda739afebb1a9b236c2eab861c55155112b3d4fc91af72a0c432140906ada0a2504d9314a332ded68c9dcf5cf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
9bf59b15b9c173f03ac4d4a27c7c3ad4

SHA1
ddd490783a4d36dc85c3b8fd4a70d8b11a24ac31

SHA256
526fedbd60b63148ffba2634c9b376509112f0e3ef6dcfc136ab66c84c1ea077

SHA512
ac98591508832ad33032d3c97cb3af5427f624cad3eb56c37051909db9bd43c3d1b9929ba0cca51fe7d674ab7d755c6ebbfbfc691855c99e42da7a9af88d1b13

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
f0d93d8f91f1807b9157500df19855d8

SHA1
c09764e312a3a1ac8a7f93611f1ac66676157cea

SHA256
beb83fa663776101d413aa74f2ec8ac43c13f7f2cd4d9d8f493cccbd6b6c0844

SHA512
9f5ec0e1c28d74a8ac6e156df3df82a21038b10da569fd69389fc3fd875344c32f16e996521252c329eb0e4e4cd6cdb229a3370f9684c9ceae0a84c347bbac7f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
d03cf9e4ad8334fd93cf7ac11b940570

SHA1
0881ac14309c4a0c30a63b17caa5b025fd058979

SHA256
57a2b0086916abb463d5d203a34b11bdab1f67ee7279b6cc38a5254650dca6e0

SHA512
fef848988f4fdef81b494dafd611da51ca4fd7fdd9cb7d071212f10cf0da90eb9dc9e0b3e06c17bfc5d41622acc75f24d74b3ed1c8765194d81de5e150f978b4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
42b84a8ab97a21302829f4851f6558d4

SHA1
bb91d4d8e2fa4d0c72c38b3172a38be6fb242366

SHA256
ecc71450cbbcc097ee075dc5a3c861f9d11f7828683b694eeaa6ce13d8ddf4f3

SHA512
2fda74825edb7fc89767f4144d09f529e8c4e602c7f510ed31c7c058b6cadcae4a3552bc5b458b54bcaac28f5f327c99cc72f93d07b370d083d7b7a4d345d033

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
6cd64562529845122ac933248bf2f85d

SHA1
91e4307517df5054cf30f554bf0953a82327a01f

SHA256
cfd61884127f2758d6bd020db45e0f8306c73ed1882316973d106b5a762453f8

SHA512
c9e20dcb74615af3c0dfefdb4b3d40d54ae3546351c15ec874fbb1d93ef91d720cbc8d8bbaae02d80ce6d1f39f1ae592f8d9331b228284abe07601ddc8ea0918

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
13bedebc18e769eaaa20ef8667035aea

SHA1
ff56f922c7cb166ad12de06aa1a55f3c740d95a8

SHA256
72e9032a9451e06117d9303154de2ba0f46c5844df5676479350414f42b5cb71

SHA512
95de4ffa9b2032760393b919127b74cdedec8419d175156c441b52941095d1d635433f5e00f6ceb740766e15ce231437e734a44796ec42a841efa0f9e017a898

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
16cc244c8d679a9fb2032369b704feca

SHA1
b7c57b9cc50317805c5a25a98823048c9101f96e

SHA256
bb2055f99d85b67c0b2c7c66038f2e9c9ffc6b8c10fa49779019fbfff5a9014a

SHA512
fa469e14c3b0d56b7899f6df277b3332f08de659f84f0307786af37580089eb8ef49ddb386608f93a5c95f9ea078489d8c5b2ef81a5ca02153cf1c25e216588e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
3ec6098a2914f1460c8bbde344303211

SHA1
bb07af5799e622f39e5380ae4005822fcdaa3644

SHA256
c3fc52eafa93cb308584ab47e3364c992c7e140943788ebe00f4ae02f84271b4

SHA512
bfbe621523499db9039d2e40044c26db76e49edefdfa06afb3b5367f2f3adaffacb553741a0bbc36b94f68127667f4c59a78cd0ab4f99ffba51ba7abf3ef3e2b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
7daf8b9bace08f979d43a062ad493550

SHA1
0babf2eab16bed14c50f075430dc6e60de0515ba

SHA256
ce196cdb240425d74f1a359aa25f5be0cbe3d08cd312b9b0f59c4e8983114170

SHA512
e19523a70beefa212d22edc3f5fcafeb242fbb170674c02f4c7990504764b826ddf7d5a88cf06f32e028f1af2e7e98442cd9b407f3fc1de2acc95900d5cfc065

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
a6d5f24e69f91d9f3e4c3efed189c94e

SHA1
ee51780a545203ed5ccfffbcd6c222426afc5962

SHA256
25a82c9d5b8c79afa9d1d9b1b898a3f954d235d4a26e3052a8ae9aa0572ddc14

SHA512
d9f1677954903efc9921c3097aaa16a255d140dfb7e0a8cc158471a2f2da95820e01e079987c593e5e706d830302b64aa0c555648e992a5ee654ba77d83e328a

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
bfde56200d70c7c58a956336caa2fbfe

SHA1
933120101d74baeb5f7658a63510f494076b0e5b

SHA256
0142d401b47e49a580ebe1839fa2d1346ab1158b541c6e765d8c0071dad231a1

SHA512
47066c69e259ccbd5e7feb0f8d579d9859adad8e556c34510918bf1c5e44ffe017ab2e37e6169b447545b1fbde93e33b0e9e0de739ef620d623b72419261ea3f

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
11564d5b5c181bdcf8ebde05c7ebecb6

SHA1
0676fcd682d44fa17a6ddc5c037a21bb554cdd3e

SHA256
bcb73305b2620e5c9a16de92264a6e983e83668c6d6330642e13f1f0bdf1af10

SHA512
cad77136f7d7adb4097be7eb722b41dbb85672f652b4df93d6c541ce0782acff670cb7040b3de70fc353263179f91f378ef37e10328945dc17b0d730446cfcb5

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
7d7c14cbc0655abeb2149a853cb7c848

SHA1
df82d89a9a21493b21fca15738d000056271f44c

SHA256
271496c032b714c984f7fac695ff521e2ff9f6be9e80b9055e1a0f8d976f5361

SHA512
9c9ba7034ea5d0462e3b25f6ecb998bbf16a851e31574bb61a5c0e1905834bf19fae3f4bfa7d0b733fea9fa755895d54244bf32dd54d8da12ba422231338cdbe

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
e8276ec7c6c87ef144cf6dea70b2d310

SHA1
1904a9ca8d4e181c665ee94665e635a1d81aba46

SHA256
5802297dfcb8113414a5b9674377dd47458e48affc79b29cb4cf8d9573bfdc08

SHA512
1cc908abb6f0723c47b70c16042480f14ce55dbc46423693d82f8366ecc097837899868622188059e52630cbcee7209036ca67c518e8eca41936c2f30790d174

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
fc7b6d1c976e2223f187a34c94317799

SHA1
4161b28657510a28133219c280f905dccd76d105

SHA256
cd197e8e018960c589bc6e4dd73b5fd5c5d6a490bcc377edfaf724c5d61a1f40

SHA512
b8f4a912f9f56a8b11e113b2f49a5607f62accf318b0faf000d51e52afda07a25927a8ba823ebbbf44b745fe1b4feacc11e95d7d3537f5e3534898aef4a83cd0

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
6160e582f11312e31f9e41964109d92a

SHA1
a1d724a871a8c8eb625cfff965579739a7b30d67

SHA256
ffd06444a30ab245a1f86c93c1c74826e41b6778c33a9f13dba479819ca878bd

SHA512
9a5681631c01246f68479639fcef43a322bab3067d0c975b1e21ea8786380648f9e211b58233b7c6d37f67fd59126559ebf29cc9b056f007e4e8e174d9018694

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif

Filesize
49B

MD5
2fb408fa4e066829075e6dfb2619464f

SHA1
70c0f86d13275c907454c37bac1299f3034d7bd0

SHA256
18d2e0ca13e6b8d7ba690d203b3cd2fce231301b59388de6da59cf697c331450

SHA512
e95a3ba73a2a432e51364dd4dbac30f568ce8b39022c120012ae7fefb94e0a922a39897c8b7861b8cd5ebcb5274ddfaeb1d18ad9c67b7eed8721b28417388a04

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
dc0977f93841e4032c18f270772a4cf9

SHA1
33ebda87f601c53ffc68baf8d6ba18bcd7ddbf2e

SHA256
46beaadc7206812a6a536eec5a7b51cc32198109f41cedacee01b3a1c8821f69

SHA512
7ca83096d3109ace1733557274319be1bb71588bc2099c74c2a6ff3a8041b2df2f5013a02dbdf885c9cfb2bfe431d6e9f282de334368391e21a8f75137d38166

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
321ffc71262914aa6a1fb088b5a53745

SHA1
346a4adc27af5953aa8d5e7dcb03e2c8f003df3f

SHA256
7fdfc0e567d70b1528f4028f02fc20730fc9a3340ec25b319c3e5f44f4ecf672

SHA512
3f811fc2feae7241906b718c3af7d26979f030b4d73eb4482b6b083fb17d9ce290c4370a0f4bece9a1a2a91cae6cd5ddc9ad7a2a719d7a628970a45ea32a051e

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
bd680b0b05a6689ad181ef060134efad

SHA1
af4db4f7953f3dc54770b0840b7e9b26c6c9f6cc

SHA256
d71cb316ba7c728aee612bf6254b4f6b57d984383737082993a7626898048edb

SHA512
e6b14f9b2febeefd024aa8dc196147e1a46a234469816c0edc2be302de6f237b8bd835f9316f2981001bac2cfbfee9376720d9b230d60e3ee17245d1f9ad7a96

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
8726395d225de45017ce3ef8ded4d556

SHA1
9c6c99b1694ced8bd066ec7b8a85273b8d546d2f

SHA256
df3465807a7d0f6b8d66d37d0dee9f35cfe41f4cf26b5dcb666316101353593d

SHA512
687342fb233f030ab3f1438b02858692150996e27d5819997601ab733b9944214c3b29fe646a71103b7d485e179a829df225f352fda17d89b365565892679bdb

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
a922d97d3f5268ece65d8e9dae52edc2

SHA1
b5de818ffb37c56271cb3a801ed583a8f78f5e13

SHA256
82d32978fb6f1304a104514d1173e12a303906deac5c6d6c6ec2fed62a2801aa

SHA512
759738d6e99f0edc2e96e38cd594dfd6cddafc823e8109e9e6e7bc065fea896c5c8c3826db1b393a6c2c6739ddef308cfa6ec6f7be5fd9bc3efccb1ee8024c0a

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
80db7ffd6770acdd8e105b28ccde6ea3

SHA1
175ca19948ac4ea3784f28d9b6c27265104a2136

SHA256
be0ac9b32e31d818f97554eee02931c67e098864677293b5ecd6eafbf2ec8423

SHA512
bf8b1f259f56ef5af05eb1760774b362966e65491ed98874cc1aadbe40c5ce384d59aa3f8e40df65799f403ada7357bfba067839cbf9c2bf252dc7e1915c5e12

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
3136ba3729d85a279fc8bac78dcbdaee

SHA1
bdb2cead9db03737eabf4739012e385d784790da

SHA256
a57f0e9f387dd7c4286860a68f7074d5040057cb10d92ca06aefc3eeb3a4beb5

SHA512
92b23a249e78681861af97ab4be386b1a3cb3c3f65542356d949b455915826314fc5120949741f1f39f1ccc1ba1fa30ad1a8db269c6ea64ca9c5a90819ba9fa6

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
b73109c001bd4a8654ec61084ccd609f

SHA1
c0ee3a4367151af70b92db1e8cb372ec0ce0b7ae

SHA256
0d766f7a1ed604ad8d82721beeee001d1e644b279adf204098dd09fdfeec2502

SHA512
417e8c38fa5243b7facb4127aef7325101c5f56b5bac033cdb2cc9e0c6385f479d8032c173f020edd7b23d2bfc8bc1b97882e02e062bc363cf0237a31f75d5d4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
ba5baa818a6ac49574bde1078efb77ef

SHA1
4eaaef8a9c55bbcc06de3c9ecea9dce30a449268

SHA256
34cd5140f21735ccc28e111a5d87f82c49d7b258668008e6db42ce25cc76f8b7

SHA512
e0e33727a1dc639f4963d87690355903eaef6a9c8ecdac6a9feed8838d040a85086928d2f30fbae48553516be55de03a9acd7738aeb74293106e7bf62ac3e779

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
507f33795f876683efd2b79fed05401c

SHA1
c47b83c85da56cd5df3d5ed60a3104f98fa30d91

SHA256
6c721210f12ad015ad82418acbd2e0facc3f332840c795b4e83e8038204e33fd

SHA512
c219544af1cfded170511df26577ec57da2a17e3787230c58c12131de105ed6a890d6f8716881b5cb38b547195b4c6540b8ee99f31a8b6fb70dae03357906de3

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
851c808a087e68885b19c38f6e18eaee

SHA1
2ea62e80daecf15d7b59564023c1cdc544e02395

SHA256
e80accfd0994d3ac33f46c267cf1e2ba631b40eb529888d315a18685e87ae9f9

SHA512
40e92019648183a5203dacd879917e183435041a8a78f65138da41b9118bdfb4ba4b0679138f9d0ed97c36e12e6c109a09ab916a43412faa05faa9a279bf1403

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
710b4493be29ee061967285f9910f358

SHA1
1033102ba510d19b054f3019dbfc46b1a6cc8479

SHA256
e81bfdcbfc615160e9c54cb8a7733398a40c26fa904ab105ef5a393a04be63dc

SHA512
48e9d2481b5b66f5aa6b7ebf3ea624453ac0452b06da2f462da7e307783f699d8b1ab80ecd6d44dfb2817b050b200bd5c7e75fa7e7ae7daa2de5244320a81153

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
51c4426ed1576c1042d6899d87c2ea11

SHA1
1a9d464d7d7e450bd6744847ea846638e3c433aa

SHA256
2636f0499dba8afa0ce7c3112e71fa6c4aac58aa863aeebd409c4bb9769a7591

SHA512
3b1a9c2dd26e881f67b2f98ccbc747372f590eb986724333818d043d757cd653d3a4396bd25ec64364935c369979468108b9ea049dd121d7b918c6cb3226e838

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
88fc6c84135e1d23ec6bde4d79425105

SHA1
a3ecfc8d5c5d8cb58700f56a0a8b7d9c462514c1

SHA256
7d0af975f6e0c5680aa01d60978ccd377f515736c0c31d46f9ea26cf09c5bf1b

SHA512
91e267964914bcab9a3f9f8275d32c4b011750dea72c14c460db1e9dfcad88b43764f83cbb654751b3a975abed2e07f230ebf814fbb18c7a96dd00bd0a656faf

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
d3b253f8bdb780d99ebb64aa3486dee0

SHA1
dea7fa7273c3c88bda2f75dbd5ec229e2ed639d3

SHA256
5feb70eaa08c0b0a2cac17598ef996ce02a043b888831c5ef42e79671cac6b29

SHA512
754ac7a11ffb61e047b42f14511d354bc1672879e9409fb687175d7d9c4cda2ed209bd49e4cf7406c3d90992a0be0ef19c2641ea6a1fcca6435ceea2601f8b4b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
dcceff16183f8183df0ea74427dacf47

SHA1
4f9f430ec5617cf5a290fe3ae0871f67e17eb2b7

SHA256
b3af675a9e4e34e46cef80ada7485c91d88dadbe8c3a7b2ab9f357a646fe894b

SHA512
859e24764e85dc4bf9011e8e3fa09743c31402ca6a4986d307fb86e14c65531295647e1fc94c761160c9a90cc833ebfe93cf6ffb2fd5ee1f57e0803973c2fe42

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
b054349d66989c151032de8e5f8d465a

SHA1
3a8fb9beaf12910d2720c46c8df13a5f0aecd785

SHA256
110e60dbb8f12bcf2bfb4665a1f0673e3e5ca955508d8c15eaa5d3dd55ee9b48

SHA512
301def1e4ffb153e4b5408647ce6c1b13c68467277defecbe799b769241f8fb869fef9885b8caa36c5660b50c52def767f410e354134a0a6131c3a3ff8edff0d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
b8786c863b30cf6253292377919a6fd4

SHA1
e321e40d797bd0181261b66040dffb678f939ae5

SHA256
4c41bc1c76c5abec6f89ad9ee9752f7b0efde3a638f311e734eb8457422b21cd

SHA512
9f8d63bf03d751e4bd0c69e1e0a1d21677d7da3bad3c5e6fbde0169f89b9fb10eac7bcf0c6f9b1c0af365642f8beaabc386b8ef44c935e264be449628a15fde7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
717baeaef12377a0c109faf899d61fde

SHA1
0381a6c59fb08d9dcaf2c6c6a4b27601f926c073

SHA256
03632f2150e7bb0d283e7f941daa75e0a6f79c849a2846c7996bc8f5f2194550

SHA512
b19e8019ae74a8f60fe8dbf6d0ce342c1190de7dacbd14f977bdf6142e21d62d75a2aa940f8ad4a65ffaa74bf899254956bb924eb77f6550b6e0015a5dd4d5b1

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
bca8dcbc2f808c34dac98567ec294991

SHA1
87d80d54aae31b062f4bf7fad9052359265d6809

SHA256
23937ceb8c00d10ed53f14b0907d4308d1d2ab126b313f3732c87b068aa05719

SHA512
e265d42794086acabbc9d8aaf8e2c91abc3f844902b90bc834bf80481eb8dd9b7bea286f89894dc7336d79a6c79534f97c33cc089994883d8530248ee3039467

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
351ce121839ebc20d6780bcd499cfaa3

SHA1
153e1ead29c32e62968ad21f5ada33aa3bbda098

SHA256
5ec3cf1fdd514fcdbff9fe44e1b44372d66c176c07d65a93cbc68848aed0bdd7

SHA512
390216dcdbe09c59fce1606985c41bbf8b94531ba8731468fa543a0f0143395afd15a041d0e3560b7bbdea0716fe27804961e13b9040e085682b57607e502902

Download Submit