a0be3e6abffc484860a4ea261cfd5218b2fec9164fdff1318556b0665afcf6f3

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
13-12-2024 04:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Size

12KB
MD5

e9d71f80f9e44314a81f97542939b75b
SHA1

b7041704a6b9c4f62efb0e21013e0cf265eb54d2
SHA256

a0be3e6abffc484860a4ea261cfd5218b2fec9164fdff1318556b0665afcf6f3
SHA512

5643e2ff53f757f63780cec40e9ccea9bd4ecd5e8030059ebf28956cc1095ae3855cbb16a1f4af334f661cd3d6ffbac5c66eab0615fb548bcd3f64c9b496fb1a
SSDEEP

192:e/TrG62a6B10k3g4fXk1iTV3HGc7EkpAqEjvu2q9C/YpXnAITZfPtRMCT:eebFNw4Pk1itKkpAjjI2YpdmC

Score

9^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Renames multiple (2162) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\drivers\gmreadme.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_methods.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_do.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_pssessions.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_arrays.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_scripts.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions_advanced_parameters.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_remote.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_split.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Ref.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Throw.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Line_Editing.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_execution_policies.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_pipelines.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Break.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\migwiz\PostMigRes\Web\base_images\AppInstalled.gif	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_environment_variables.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_execution_policies.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_CommonParameters.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_providers.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Arithmetic_Operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_parameters.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Core_Commands.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_pipelines.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_wildcards.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_eventlogs.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Ref.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_type_operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_pssessions.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_scopes.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_functions.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Return.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_requires.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_profiles.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_split.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_arrays.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_preference_variables.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_transactions.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_Path_Syntax.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_wildcards.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_prompts.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_escape_characters.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_execution_policies.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_modules.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_remote_FAQ.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_jobs.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_remote.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\default.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\it-IT\erofflps.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_job_details.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_WS-Management_Cmdlets.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_debuggers.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_environment_variables.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_transactions.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_Ref.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_functions_advanced.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_preference_variables.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_WMI_Cmdlets.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_functions.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_trap.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_trap.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_CommonParameters.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_Assignment_Operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\it-IT\currency.html	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10297_.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\People\GIGGLE.WAV	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageAttachmentIconImages.jpg	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\13.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01294_.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\toc.gif	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BREEZE\THMBNAIL.PNG	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\QUAD\THMBNAIL.PNG	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\MessageBoxIconImagesMask.bmp	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsBlankPage.html	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21340_.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Slate\TAB_OFF.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\ReadMe.htm	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\es-ES\settings.html	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RMNSQUE\PREVIEW.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-cn.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\license.html	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\daisies.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_docked.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\34.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_OFF.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\ProjectTool\Project Report Type\Fancy\MINUS.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115834.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToNotesBackground.wmv	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\106.0.5249.119\VisualElements\LogoDev.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\Mac\TURKISH.TXT	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145879.JPG	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01740_.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\MessageHistoryIconImagesMask.bmp	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\calendar_single_orange.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\StopIconMask.bmp	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\OrangeCircles.jpg	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\28.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CAPSULES\THMBNAIL.PNG	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099202.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15155_.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR37F.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_s.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\win7TSFrame.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\17.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR00.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_h.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-middle.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-today.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\PREVIEW.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10307_.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\TABOFF.JPG	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31B.GIF	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Media\Delta\Windows Hardware Insert.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Delta\Windows Print complete.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\diner_h.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_Redirection.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_Language_Keywords.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_ab6782291b0ca7be\item_hover_docked.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Quirky\Windows Notify.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\403-17.htm	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-flippage_31bf3856ad364e35_6.1.7600.16385_none_0f19716417635239\203x8subpicture.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_locations.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\28.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\undocked_blue_partly-cloudy.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Windows Balloon.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_WS-Management_Cmdlets.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_pssession_details.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_07861dacd36a18f4\rss_headline_glow_docked.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-stacking_31bf3856ad364e35_6.1.7600.16385_none_d0d2b98d4629a41f\photograph.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-sonata_31bf3856ad364e35_6.1.7600.16385_none_201752c112c5078c\Windows Information Bar.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Characters\Windows Hardware Fail.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..style-layeredtitles_31bf3856ad364e35_6.1.7600.16385_none_4ad2978b8b3ac8b2\NavigationRight_ButtonGraphic.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Characters\img24.jpg	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\btn_close_over.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..adisc-style-shatter_31bf3856ad364e35_6.1.7600.16385_none_0cd72f8900478c68\NavigationRight_SelectionSubpicture.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_trap.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_remote_output.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\24.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-clock_31bf3856ad364e35_6.1.7600.16385_none_3342e6899aa0557f\cronometer_m.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ca7ec133e2786d8f\about_WS-Management_Cmdlets.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Landscapes\img11.jpg	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Web\Wallpaper\Nature\img3.jpg	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-ehome-epgtos.resources_31bf3856ad364e35_6.1.7600.16385_de-de_80c638890bc8607e\epgtos.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..disc-style-memories_31bf3856ad364e35_6.1.7600.16385_none_51190840a935f980\btn-back-static.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-au-component_31bf3856ad364e35_6.1.7601.17514_none_36a5754e72dd8aff\AU-wp1.jpg	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_debuggers.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-usertiles-client_31bf3856ad364e35_6.1.7600.16385_none_858ad50b329f70a7\user.bmp	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_remote.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_it-it_5646c597a746df57\settings.html	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\undocked_blue_sun.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b8490213a810a8a5\404-15.htm	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-currency_31bf3856ad364e35_6.1.7600.16385_none_679a6ba79b07a3c0\combo-hover-right.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_6a1946701e0df451\calendar_double_bkg.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_de-de_0f8ccf36b90bab3b\501.htm	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-o..ediadisc-style-pets_31bf3856ad364e35_6.1.7600.16385_none_d0d7ee773d711005\Pets_btn-back-over-select.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\x86_microsoft-windows-gadgets-calendar_31bf3856ad364e35_6.1.7600.16385_none_0dfaaaec65b0831b\rings-dock.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Characters\Windows Hardware Insert.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_74b66e05cc4097c8\about_data_sections.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_join.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_wildcards.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-g..howgadget.resources_31bf3856ad364e35_6.1.7600.16385_en-us_c99bfc6ddd1bf1d2\slideShow.html	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\Roses.htm	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_providers.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_it-it_aa520d2885499112\about_properties.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_logical_operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Media\Windows Ding.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_a9cf548d21b86a2f\(144DPI)notConnectedStateIcon.png	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-i..sbinaries.resources_31bf3856ad364e35_6.1.7600.16385_it-it_45286e597214a485\403-5.htm	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_4c778c357864a2ed\about_scripts.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_es-es_27c74b34efa6572d\about_Comment_Based_Help.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_56cc3687acc564e8\about_arrays.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\amd64_microsoft-windows-s..-soundthemes-quirky_31bf3856ad364e35_6.1.7600.16385_none_e55404efe49bb9cb\Windows Battery Critical.wav	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_Assignment_Operators.help.txt	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\GB-wp3.jpg	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT\shell	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT\shell\open	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.EnCiPhErEd\ = "DQSSLSFEDUADBWT"	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT\DefaultIcon	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT\shell\open\command	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT\ = "CRYPTED!"	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\scJwx53779yuaDe.exe,0"	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\DQSSLSFEDUADBWT\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\scJwx53779yuaDe.exe"	e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e9d71f80f9e44314a81f97542939b75b_JaffaCakes118.exe"
1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
ad65c6f7993185115948cc6fff071bb4

SHA1
d53cdc27397aae423d7604123ddc5a7ab1d39a4e

SHA256
c0daeab2db5b5ff0de79e26270c449edb6aaf6a67c178cac95d82d28c2498e0f

SHA512
2e2761391838872b7b4c60bf939669eb536573b06bbb9fffa028efe12c6b9dd80152671e8edf38a402f4fca7e081afe9ec4cab71bf6aec92f127dd0b9f267073

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
e342950ec7a7de915a8c36b359b55207

SHA1
c71c4cfbc27cc3a6f87089d2ad24bbece509d9e8

SHA256
ea970a169ee3bdf77164259f5463d3285e4e529daa54b7153e2e879d1afac2d8

SHA512
7f298d97628ad6419702828b993f51fc8fad259ed89c290f660f9273a8fb9e5490ccf0c983cc7fbf048987ba05b3e0c8388e326ab1ba8c197b8de3c427241e19

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
b7c0e8e944efb521f5d8496063356941

SHA1
e17dbdede339a91f798f6d82c663d3fbdef5a7a2

SHA256
1c77a02ebd13e23e4ca5b1baba7ba384455375d6edb1c2de8a1b0242185fad22

SHA512
4bf25fa366ea4dba56965c7a345d74bf03f1d9180f807ab5453675222d27d6060c4418590b49b14a383c8df0b0d7a1cffd6c1cff5b34c3731fdf03cc7e518412

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
b9a1f6a62956e3c9b7067a0412f82e39

SHA1
c5dd84bfe9d2642b454f13f5458d9da988339886

SHA256
e9545cf7f26866866141e6a8084eee13b82216c130d387cb7b33dd61f3e63e75

SHA512
3945dfae55c5d2ec1c98ff6476c28a637b2264e3695c3698706228783310344af521d7d59476763ae443f7b9f8cc6788f9c3d8f3c10b9536664849a688190ba2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
e0992ec4facf8b4584340a998a1279c7

SHA1
007a132d3b64eb952f55f56bc1b18bd92deef840

SHA256
5e1ab3636507f08dc3bc257300dafd33c1dabd61547a4584ccb44bf3cd0e6f6a

SHA512
6255084972efdefcd39625cae7afc641930fc11a3761a4f39fae70a996dff47c938ec70a1171e1e25304f5ff1866774ceb5094b18caf762d2517f4c1f08029b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
2e747416555698cbfb35618e4ff5d8fc

SHA1
057a09f521de42e18dc9936f732eee4c3f33ffab

SHA256
2cbb3fba4a7d3156de5f5a73e2e0e7b47243011b0a0e8d9fa491d8db29e356cf

SHA512
4caedee0b8fcec84cef1b9b421d5c5bb1ed9d7dd96f800a8ed49dc3fbbeff5b58911342ebae5d536ee484aaab1861a8f59f27ce451f772ebbcbca21a2619362f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif

Filesize
341B

MD5
34654a221c45c65bc85333a6d0b87062

SHA1
364ef8dadc5de26c8de8e661252240f7dfc2fcc6

SHA256
20d4b978a2f7252b64bac954f43c9d8e2c0b3f751e84d9f9b3f60842412efa81

SHA512
b61548d582e6b0e3dd6020d15637796a4b238e5e74698590a173f73aad8b2480b3c02076ac2891c0ff930b8a9e614ad61c50c43f6bbd5f167fb69f3fd657260e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif

Filesize
222B

MD5
83b81571c86eb367089627329ed2d8b1

SHA1
726d87cd2d9bfe40e43dacbd53679c26f48aa321

SHA256
2ea0a8ce6883005eac0ed95077165174508a871741d2607d0304681f47bca608

SHA512
182fbfb4340a857cd0a70d55475b6fc3b5c347563b66ca4e28427172a79ff0f99879212c6c54ed71410664946db3cb1cf0824245af8839ccecd56d2307021076

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
5b444856d2a2a43840b0a606788fd3fe

SHA1
a9cce61d7a88121381b71bac1651f48de72b8618

SHA256
5b51b26c33c938fba84cf1bd6c63178028fe6f686475c85e9e9993801de39485

SHA512
9c16537bf8c8932dd59b14e167c84495c225237dbf3f951647878305451c0b33d2bd29814c6297cb5d5db997556b833a28b21b58afe3b355e35d22636d8a5989

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
52755cac65471c4d3d151034b3884f42

SHA1
693f998b6811716ad598cf863de24e2234d31bd6

SHA256
d316c523f39637fb2034680178e98efe2e07cd7ef839aa12d62887aceb3d2874

SHA512
35d09839ba3ee9b7b427e3044566ab9fafe5f0249cfa74c18592af3e18d0a002c9e7547174ab98454d5d0b396df36b7c2232cf899bd336b1848e183cc480060e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
9ec6c1ee40ca8914067bd657bdc21f20

SHA1
083d5109509dee8d2f09d64322e096b94f4d85a5

SHA256
bf49714319de656a83be67dc1dcac5651b2d1938c60ef71a01bf60fd8022f706

SHA512
b7db03a7b49e30b139c273ca29e0fb9c5489e31bdf58510aa17e46b953d418170fb5887c875dfecea1a8d679e9b71985b19d3fc4334581d7b47c760caa596e66

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
156634ef7b7a4326ef69e72706980df0

SHA1
72d8ab6421c05dc5753859bae6349950f0392715

SHA256
173ca8d22736b48fa3152e06d75325030fb25a7d310b2257924751e1b2a05679

SHA512
e43ae3324d53cdf969816b4d4526ab7a8023c3ab536228e7f091753d14fa7178cb3aea3699888f63b960ff58bf79f84f310315f03911d357d686d332419ee64a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
106B

MD5
7f32266ff19317d2be72f3a90d755314

SHA1
cb1b3a4548478efd2cb351a121bd3476a7152695

SHA256
6f3121d139d5e8e198dbc825d386c204ecc55145f3cafe0c4adf96c5c74a0cea

SHA512
0095a4d492e67d79880e4119444a7e3283005ece8a70b2c61feeeb54058e3267e1f406e83255093a10d62aaefcf15b32d3829aa5187d69512198b24c542ce9b0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
6b9c2f7ea21e4cd87a8e6507af3dc9d1

SHA1
d38bfeaa1c37559c5cf3f94cf16418137187ea19

SHA256
a8fa6753e3d12cdc1e9f309f89e2c38f8b934d569687591743e0927ae809929f

SHA512
d03e3df786555ddc6d039b1dbe1041e5908937b5ad36b6d551c0502d76eb5d5fa27583b2f8a2ab0c6ee8792d87bf87d620032071f319275a9b0dee3e5a3e3ce9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
9ef68ce322e53f85585df285d0a2ced4

SHA1
7779154d7c847ebfdc4ef3e130ef6cc454baa324

SHA256
9209551873bd04403779a2985bff7108b49889fb2e169ffc8efc48efc58619b6

SHA512
70f1710350403c3a10703506d119be9b92a2b88ab0145842ab304bd1b8665a505adf80a377789d819db247430710a592aa6f02a9affeb40d4639145dd3415031

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
d5d5ff20b60a2eab51c6210e92f85568

SHA1
34cedc93aaf540bc171dd71733e1112074fc83dd

SHA256
6a52f6b0c10c58636e56b46557208dcc9081a5188b33927f58e66779f734861b

SHA512
ca953551864d054ebfd1ae0254b3c213a70dcab53a115a12ce01e3c9098d0e48d6ca9d41f7f7533b95ad258c6b80feb69e78ea12d8fcb39d2572f1ff5b4eb6ea

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
210e12ebca9e89d6d3a44c4bcd05c2ce

SHA1
7679fd03cb4d77ef1de55a61112edd22a14ef7c7

SHA256
6a6f83ed874e2f7f47910dcdd1cf8187ac27d8c5c110173cd9633b0d338a832c

SHA512
7c2323708d20fbb13251328b198a0a27ba11e869c732c88307235d32f8532232b963ccf0b84db4856b202c72ffff081cc67f421fc82cb17a4c97a94997da8f22

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
93d6c7414388042b9238b641ee65fdb1

SHA1
430015d4d35c0e3db261660ce4089741f1e8b294

SHA256
a3ddbc826ec6fe6c47c44a36c9134c650ab801b436d60dc95962b881e470ad61

SHA512
075a5d307327b11770da32e1c1c2236189812ef2c1cb08fa0144fb2ec97f89751c3c35730045740ab12ceaeae1a67eb43b2a9119f4ff19e259f377cc2ba97787

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
04548d7b2d62cc104a66e814eece664f

SHA1
7376e037ec01f0fb3f48ee5fd6ebab7c98fcb7c7

SHA256
eca77f24ccffc58f9a76f64f1567f18dd2cbb9d78922cf337dd7e35366d8dc41

SHA512
8d69a5cb4a780099ccc5367a8c703b55f0d3d6c37788f71c6b6cdcf336c2960e4a06693c6de686c8e7a38bcbabcb655468e6aa094b4d977ad58b45b02cfea086

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
6108eeb28e99bba60f5aa85ba860e03e

SHA1
394862c7b315c927c72c6db9f2c7ee6c3cfeb0a6

SHA256
b3a03dca0bd7002e4ffb8de57aabbe127b9050926e9b1379a929abdfc4719d34

SHA512
a2ec8ad1fbe8ab469e28dd5718b0e2a092dab8e36a10f89936fb925212335200cba80b65371552477d9e2133917d11eb94d10917d562a2bb23a7fdcd24e3e4a1

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
be781cb34af8f1da0e9b2773c3e18faa

SHA1
53865f60b51dcd4b3e10a427c4c7c45193cefc4e

SHA256
ae67b5bf118b7ee4a95ae0ba1f030789f5da62162122006b75a20840ddc6231d

SHA512
11835ab094e411d47101b7a2e6be80e7d0032055f1301e9e6a16b03bea27a705fd4647fc5708fd5253867ac74f138c1144685082f6f7c0a30403f6ce791ba520

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
5699386c747fdee713443da703924ce8

SHA1
7e11d4629504d225fb58a099b8fd315b17239e51

SHA256
0f5f25e5cf4428ce859a2997f428b50f285fd476d8c21b293a3cb9d1d29cdf46

SHA512
4b4a765673097af6f832e5d87cd69ea2247954a05dedc9b8affba841f9187ae5f6b5fa7400386aa10379e2d7eea23e1587d13e7d7359f45b77bcc14406b649ee

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
7e0d19252e72c855d9d7db263e9730f0

SHA1
a1a0257ec1f865151d437671b80768ab3666a6c9

SHA256
7b914c37f4af316d9fadb66e8ded4f03d72205f9f9de5d2224a582ac9bbcb36c

SHA512
0cdfd3a37c34a261ea1a8cb70198a07b689f7dbf18c28815e53bf433fa6db40dc563b9f0ad013921f618ab2e2e31f15ef4a215c0b1c9f9f4f1ef2e87cc2c449f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
039b95cf7c9e1c25564ec5b14e284a01

SHA1
cabda0b88ee38621afacc3886abbd38abb2b6cc2

SHA256
bf52c1a498a30b0f01dbda17bb562805ff6aa4ff73e297812008e819538e9fb6

SHA512
e1b23e96c2723c637e9a29d7a2cd122a34b566d52eaa9468810583a9065ea3d6cb45a8cd8fe350866893c84f9aa646b1b4749bdc88eb0003d6a2572bb247e1e0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
2786966579699aebf2736963901fd3b8

SHA1
5505811c683e963a6047e53cbcc6899720ad7c1b

SHA256
5f70c4b188d05930661b31251f6d9fcdd0375dd79b105b6f394f656760412c02

SHA512
4ae69236ca7afa9007cdaa4c63127250a3a0058452f7b8cb247ec07335782efd39b1e57b1a3f683406b492a72e2a6f705a1e50e0da5b9a9bae2846db9802d642

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
6236a02acd00678e0596b080a517367a

SHA1
c034caaab130bc7e1237249ebcd25f35f3397997

SHA256
10fdccc9fdfac36a77e27b34cf77def23b545e693ffce2b444392e0f98d34853

SHA512
cec558e4a47d0cbbc3ab48bc474ff3d3e7d510da210944736a114d7a2f14f8750ab43044e96c24633e68767aa102d99533b04d2f21e2b42af9106816005605ce

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
5d29b4cd0f2fbfabc75a9c4c4a429aa6

SHA1
9a69fb4ce5bf0d7b30143ba40bdfefe23d40786b

SHA256
a6173b0929199580af121b8a4a1ca03188bb7e077ae03332d4caa6cf4229a052

SHA512
9fdb5793f8d045cf6339cfd7b52005491b6c5a8c136da71ab4cd6f814255c7beadbcbe67999ce88c7de2d59cca8afe3e7d35058aa26528e100de3f037f433c40

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
462B

MD5
bca701f69b8b09c6a0869483cd1f5801

SHA1
b7f5fcda3a21dcc22ae6fe4aa8b0063964626a43

SHA256
0a7f42054cded5f7bc51f830a3be8b42cece3d9145b5c76d0259c5fd5402cd16

SHA512
75d75a2c021ee00d48dbeaec0d38242e18c2afa25584147ff97ed1f1a2880676c46088d6d43d10f1b70b37d5670512c8b0eaec27380a0621c69eeaf2f4635711

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
16ce1b166c916b6d421b922172ce7a3c

SHA1
d1c989c8775645cd09f53f58dc5d60666f43fb3e

SHA256
9560641ed74e375090ac38e386e0b26aaba767da6c33f0e14be762e23e19aeb8

SHA512
46fb521559501431ddb88cbbe88d9af7278bd5b6c24eec116e3f74b06ed4183b7a9892b24a422ef17847e10ac04fa2c29ccc84e7e4fab3f8a95b2589e16a0c5e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
0ecce95ff6103cdfd2c475e6a6c099ec

SHA1
c3939a270b45253e61468b3ca1c1ef8d57d354c4

SHA256
5c2456b088cac6abafcd34ff70d986c8ea5ff1839d4a8782a8a8be735f5e77f0

SHA512
f14d817dcdf3a6a65a31570e3889c26fcf6b8fa504f522e01e49500ea3764d689a37c0b4aa3f342037782ff681d703871741168c25ebbcf9564f807cc827fa34

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
da9b7469eaa81ee201192427e4f1446d

SHA1
593f53473e12643d74631790458b3fbd6f713887

SHA256
54b3d4892a6656f902548acd7f120453da116131375fe8999ae4245a4f385f43

SHA512
3b46dce0f07e30a78f8a65cb3c1f9345d6b6379d44ef93e1562bc6d9ceba89a6295ae98e48fff606e20cdced864d9b827700464524f5c6b29aa4319e05ed4690

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
364B

MD5
49844befd6826f4d8052d06b178e9159

SHA1
6ecd569bd18498eec9f1e27a54bfdbadda7170ec

SHA256
f3401f79aa6f53a302f8e6f4cd27604ba387ab6050fe57edc1da260f30361df3

SHA512
3ab18b1c6f54908f41cac7a0d22c5d185c4f40985e99e31d81af0971147752ed22e6ad297d4af7e8be9902979d367f59dec9dd880d6ba5ba4fcf082251b0e67f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
b4f90894d934dca4d12dde074cec0d2d

SHA1
63c0c9c9ddc6d71cdddb93bdd085d85ec1b5d77a

SHA256
0062a7bc67f1cd00c9acd44ecf310e031db0c11724780c632dcbb6fd95b92253

SHA512
690f3909e44d30bf3011763910c10daee0156ebdd436d1f4aaa81da214f47d8a819721af908fbdff99b96c3585a614579ddb5f73e3627ac30b4212d1f4c6966b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
3cd9429859ec483ca34ee6368bb0b96f

SHA1
ca6d4ac47abab8122ceb31334a1e4204b14cebf4

SHA256
4b0c4baab1e542d485b4bc7a23ea2bf9d338c1a03103dd19fb00f79ee2c42e87

SHA512
50c7b59dae370413ec05e8af7b0a28eb74ca5af81703171848892b9fd40a16ce497c078004bd9f1318291613c368623fef105facccf73c5bd92db3b82b22f569

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
638ae348a237992d2e1e519cd4da5d72

SHA1
f3cc8f2cbfc61600f5419d54b14f057c536bab15

SHA256
fce5185def6cc4beca46797ac939fd5fda07dfcf2857e0851f6601e518c2c789

SHA512
b6079db97823e7baed1b11ad233e74fa4b194028aaa622c891a43ab091328843e26a85d493263baf69de1b0b078ac71168b38816bb9238aac15628d7150a5bbc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
73e5e3d6f18e5051671ab0f5c9c15e75

SHA1
d5bb54b8fdeb1109573befdf7c108eb4d1ed4c6d

SHA256
d66789fc5543880f093f1b916944881d65e52401c3748f1ec6db5b9a1617a20f

SHA512
ffa6fc591fd3fd529358447aeed60213f3ff6328594fd3b04e2bb042986a0c2fff43136b754780205281ffb6c8cd648598bad8847fc4b586869f00cf5d7df2c3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
17e9955a3cf9f546e32fed1a2083364c

SHA1
095bf4964cdc08ad6cefda711d37b276d49c3ed5

SHA256
216f22788772d0381204beab34dd5fc01935492baa904e36cf8b779e59ea6eab

SHA512
2c834d74901836add01ad8608da55fd8819255ea4d029466bca43d17ff1b30f9157c7f05aae9737acd843ca960d087a106065d66c0652e25d05957e116e57cbf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
b8a4aae569bb166dbdc76dd21e10290b

SHA1
c31bc69da4d7a77d0f9d1e1738107ca86c9b7de4

SHA256
bf2a2a7b09ae9da374eb630b1b3117c69fe92d2243646cdcd65e43d9881ed263

SHA512
5e54b12bf56f8c597438832d84119c06a2b8bbc65976dd2a98495485b99422ce0216e8bfe8fbd41cc9decd3160ce4e76e3440f4d0afa4a515a937763288cfb71

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
23489384e9e5067b4b495141f3059839

SHA1
796b21515fadaeb1e13c0c61504dc5908ff3e81d

SHA256
67a407f6fcf300a9d052fbcf20f75b97e78e0a49f3c5c11f18373084dc913327

SHA512
57a9b1a526328b37fbefb10f046e9e61e438029c800c8a4dd8cc57a6c5ef963b9086adc4c319f1915f2a1d93a45536bcced4eaf00d64e2c7b617651897683c7d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
52618aed078c68affcb94b3b247a5c44

SHA1
b233536748baae4f6b638db7b8eb58a1bc276e20

SHA256
bdc019fd534d2988b7577699d89b179351d2fdd131516b473e891f0e3617458a

SHA512
e89eccfdbddc23b182e0ef6836fbb48bd75159f5a13f8fe55dc14ad31e3381685e878358af78a1444e875013d149cc5477dc0d7e023068d52e46b80baebe2a3e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
56ef1dcc9497336fa78a35305340bf47

SHA1
68f3a81b873fb29b74ebeedc4a215627e87d35e4

SHA256
339aed99767c4b58931ea5ef0514557ebbab4574762904d179693b940104b2e3

SHA512
976d8b32d92d485be55200933ff9504500863a446d07e7f777ac7db528860dc79f5d237f31d3256552762f4f91b99f2cb1e1af7abb5c8648aa30c1f5ca4757fd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
e1873b984da48fff189cc309bdb31645

SHA1
d7f18ed8fa0074ec4d5c7c6350ecf3ccb21e5996

SHA256
a50a4c82332ada722c66727aa7a1ca7857fd311b9fc0562b5a0529280870e904

SHA512
b3952f3c95513b572ce2557852d9ab0812ee9ab6c0d4a1f5b76b7c1552814a90c6c3540dcaa5ff5ccd7601e1cd4affacf7679cf18d92c0fabfb8dd4c25c47153

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
099df57f6c29c37e67c0ce2ee102d665

SHA1
5f2a0a833f18e8acbe1848cd49d4cbab93da0450

SHA256
4b50b29efe9b830131946f35e9785e1b20ab24e172461da61ae15215f6e8a8d7

SHA512
262e154bcb1397ea5df8b73e0176ce8d7eaeb095818446e0d3d6c1bf752639a0cdc35491cdebb0d1c35f037532533d05048086e106d836476f2202cb8647ff8f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
284ab340f5c2059998e2eeaba1c81e6e

SHA1
5af74597b77b4d3256f5f1fcd742cfd78ca9d4d1

SHA256
9467559924b9d2cbe5b2f12daa6cd6c0a437602e19e8d581f9c5abc9a43be558

SHA512
9543805a5431232068647eef68b3e4d5a8fec6c505aa342432a22b144dcdcde9ef8eff93c28ba35f16c449e0af70293672b844d0c2aa2b5541aad21a592a756e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
4f37bea14c4b58f239074447f6b8f8c9

SHA1
75e38b62ba2e2336a01ad7e7b548f53ce270368f

SHA256
704a4d3d88e1ffc828ab20c1fd3f46f88c10cd24e29b0de2bac3d39b7bc641c5

SHA512
09f3596359c392cfafc55361c8db36bd723726582440fa17cabfcce1ba39d7548434e736b57e7ebed521058e027b2a7a2719293eb9e63df58e20aece809dd395

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
6e110348e8af8af853b6e7f9a47bcbaa

SHA1
7c6b06717e97edaa34fdec202a8bcdc1038a54f4

SHA256
ce527f5abb7bd64c174be973cb22133d44ad60bbfd222d6d1c332e16b808008f

SHA512
7068595b7bb8e764a43a0fb1b9a2b3e4496bb8c48b75c302f0fc77106c5af09115ea05890e9dc5f4753078c54ad20e5958f36fb378f36c9bfcff55e1300b14f0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
09739a5ba4715462fe355d8dce8ac1c9

SHA1
a72260f9eb7ed5f9fe7c08d30988b2ed9b5359b8

SHA256
27d7d8b6ac63a504d778c231d0d3569b231d7393320e10cab029d54374d2f283

SHA512
0fe22b695cef390b3da2874a17063c9e92828f53432e238416bc69dd4b3367c2acf0470fcc091b29aac7a81845e734cada366066855bf8b157b0f0e571cf59da

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
2e72c59ac157596405dbafe15e75ebfc

SHA1
07693e31dc0e625c6b9c131f26751b85d271bd88

SHA256
01dba86d6b95be6a2721017b3ae4262617b494aaf335a78bfeb1a929b6e65a00

SHA512
3f83048c557d8dea20deab6fc1c4a6b584316a0e826e22b042f88daddff8fe8f47232f151389d9046f95c631cc7b2348a8c756fb4025bcca323afc78b0755635

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
b7fd7326a115c9d9fbf896bd9397e590

SHA1
6cabf5fa18be61bcea66c06f6ab8f34f1d5d55de

SHA256
7b59c09bfc6e20610abccd654f0e28e9b96d2f3f6db324fa8d382b39c87af4b8

SHA512
e67cc86858b2219e08ad3785469359b864fb78f3ccf1335a40e888bb83cccf776f35e8c69acd03b7eea5b1961736df10d58e094a58e6d992ff311af243bdd70f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
516d2351c2b304f3051bb79e59323fcb

SHA1
e4c6937db551b40d5997da935c746f2754d3109b

SHA256
ca55cbd207f7082198569cb7cedf5466c4ad4f3e4891939902309a8b16df1d8f

SHA512
992334f0187659b8cc8fdd333dba6b4de444d4fd6d13776a58a058fdbc4371da09deb545d47237cc63e9d6605a5fea6d8c4bd31bdb7b64831f5dcb98fffd8f38

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
0962f0b609a2c49645fb0c784cec64a3

SHA1
fa5d15ad19f899108196c4385cef721b7d0afae9

SHA256
b6a36951be2a3ea5d45534e64c7fcbb3e36f9bda57eaae7eded7a901a53ba09c

SHA512
10db23576d1c16669815631842c990d3a5a9933f3141e858ca9f97e648362bf5995199a817f484600f7405b03e0201d23f63e901e40242a4321e3523dc80077c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
554803dc3660d7c3d61ae990c4513c4b

SHA1
5de8940c2027cedf8994721806332982e82d1445

SHA256
4f6eeadded6a30dee9937ec93953c35130ef47515b2c5bd6795620ae33319f7b

SHA512
81de6c8d0f1021b123c2a40d111c07fe3a454916cd86b1c990aa54b2316c720d69681fd0ec8f92942274de7eaf0c64cd8524d357ff50dc9a9ef08b9759745b11

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
73b74d80970b54955562ff0f58c4922e

SHA1
ffb40d9dcfc84b183098492736f47fbda0c07575

SHA256
146fc4910c85ac629d7ef4fcf538940a532f31b487f02a4fc2371c844ee65274

SHA512
c398daf572d9293f47926f89fb21541f7987330147a694cb82f52bafe64fe539af2f6f54847fe722c40fdd39cd9f01365aeb0e4847c61ae8e2011969fb939872

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
92e39cb9a8add2267a5b62a3c06e0bd4

SHA1
fdaf45bb066748dcd52e65b8532144ee10877462

SHA256
4b6eec69b700b49b8ca93945bf42ef8c405b21ccbed9fba6e31c8e8c8afbbb1d

SHA512
cb1c0ced6b6c8282902a8f9174e1e9d05ca1d5fb3e6da99535ebbb4a6cb2f3f4e19ea98ca5037af4cec9d15ff17ee6f842655f50c70139a06edd3ace65d78d16

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
6ac318abc834e2ebf2a99265ed467098

SHA1
c7700c9916d53942375c4150af0d9f8310026bbb

SHA256
707192fffea05a93c86d1fd18b92d45845c9000e16e0d4b6b85d7f017359f338

SHA512
51c9c497a8787a28bec91889f32fafca2976dc806a1b9347161ab564a277dda083e099beffcba3dca596b75a7eda9a5508fc2ced1aaf57f0aec66558109fe67b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
ef8ab93b2e7420e7ba9751d71c10697e

SHA1
a9485e60b16249339bd3ac450f24e83aef5d27b7

SHA256
42496b8c3c483dfa550508f1410a3558ea2b377bc0cc3e8760b2b499b364c2c8

SHA512
d65dde32f6524fc9d51faa15aaa7ac1c8fcef3ee84610d5793c5d7fc1b50773e4a22de85be5c26b9944b46ab1667314657fd10ac07bc79b2217bddf3b15b7f66

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
dc07dac3d90ffd2a4a1e0169290b3c81

SHA1
1ae48d93d89e413ff6bf1adcc85108f82d97ccb8

SHA256
b268298c9ac41bfbc80ba422f386e03685d10c3a08a01779e69d8fa6840d2e49

SHA512
35a7a5fd25709d6b221c1bccaf1cf8f38a63e8ae721fe63f22a895a883811ccccc56d1c3ac505a183878e68c7b1245b701e8ecf2717fbfb7aa9a96742f3632ef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
4fe154642db431cccb7efd143b3a0deb

SHA1
5c74df1b5d581ca96c23ac491a35b7d48c272cb1

SHA256
0c446417e6aa556d84fd07345cedaf6f722906bdc649724efb7f89c845707ac6

SHA512
50452adef7423bb10b74cf52534c834c3bac7cc0637bb7b340e4d7444734c0526f5853e634881d454a0b8db72fbbcc893dcb5b4d5fabb7f48cbb85e81284741d

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif

Filesize
153B

MD5
0e33c363ea51f3e279fc0e7656c91b11

SHA1
997909accc0947c80cc3b7fe6234d97519a74fae

SHA256
4af925c2e226ef6419b4cab0d3e8c84290bc9c6b477c6683ea69a883eb7badd7

SHA512
06025c341521bc3cd4349cbcb475aeea6b6a962bb5f9b7537f2a9256c7f03ac9a0ff9e30b4cf7e875fa7a50ab4bca30d7d89c81e9f7b5432d3970c07e0bfcee2

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
75df60c9ff5f46b3fe7255d3f46c7c8a

SHA1
faa2fa55f4afd67de42b8e7a42d1beba547b561c

SHA256
3ad5602d3b4a2026eaef4c86291f7eed3813ba4a97f1e868d37a064249804dbc

SHA512
f8dfc406bf12e2879cd5bb76d5e0e2dba362d7f1ad253ddf5b592ebafe37871ec0cd1bc5b9cf460db70ca4989997330ca39fd158042a4538bad2230c47c991a8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
24aa843cae74eb058fae9b56e1ffb69b

SHA1
25f9056ecd85b2b9ba4907ee4c6383ff9b0eebe2

SHA256
a689db92734df0cc76958b81e8f99c33f60a20913f1e33f3cd91bc22ecf98367

SHA512
f216d708b5f0aaae45bfb26f475109c8ec17420fa14c6aa765fbc334ba5963f4fb19cf320c097ccffaa47c36299d66fe79fc15704667672716ac50ed93b9aa43

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
033d3f2e1a2e564bdeaa941e4ac80126

SHA1
701e747c8c1b0d66776d4eea71482c93c61e56c4

SHA256
22626cf54e374130b5a72504bbc2211fa3ad43c0db15f4d603da9af52514708b

SHA512
dcd1c0966b7e0dd084128aad911123e9fe3cb5fee0792bee69bf8063b7b21327213784fd6736598cf02cd977852541fc750a05d852a892d79d7c3508989cd81f

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
6562b69814cac50c5bc68847007a5ee3

SHA1
f2fc3158a184ae07a722e16e7cbaef5dc214a16c

SHA256
d953155789c331f208687a3d06293ef21d3e7243c07a788d8d0f0d8839543f44

SHA512
76aadd4d07a95d2dde988142b8d4572b2f8b6f8afe01c9f2927a750d5cad98460b85f8e5224f69c59a2c8bd6af26b4ca9751b61fccfd530825944a5eed5f4f97

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
a24d7ad34881500b239b0a59cfe4b0ac

SHA1
014c4fe958513c4ed7dce8d2ffbaf099e25c1e83

SHA256
c092bb225d381c903c039cd3322389c487207f5ac251619e1b09b749a699648a

SHA512
30a420aac5cedaa45949ad8b9236a326d2a614246c9b9aa071b3a60f1ab4fc862b50bbc8fc0d888139eeb37943df6e7163f41ab1fd20b9bd4526afce46927000

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
5f641bdc7eef1d8b71edb634ea01709f

SHA1
bc11832640bc738b186c1b10ed8f3a28ba8d2b3c

SHA256
56b7dfdc53cb914690d8ac9d1c1f88b5e4f5371850dd95ba5e505f0b59ae02cb

SHA512
b8566931efe8d8682ab3a3499498266e975665154876e63be4b6d8f9062d9daed5baa7588d2267d2b489c77d53c70d7540658371c04c9f1d2522b4fa58ef85ce

Download Submit
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\security_watermark.jpg

Filesize
49B

MD5
9d4c290dfa6a86684e4d9e7a993676ed

SHA1
f22421fe0ff895b54eb5bb99eae6aa8a26f0e0d0

SHA256
c104ac78d12e7e8d9d3076fae017b6cd2f0be0bc27cf9c55f259a1a08a0a5188

SHA512
4182eefddb467c1f1cab925676f29929b7b90aeeb878d54fa6766d27b8771e32f72595e3038173f08832278998f781903c83a5e3d413cd688129fdcbe871848b

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
21KB

MD5
6abed569545dcc7b5ba87bb6d9370f60

SHA1
26c35f3957afeaab64605c51f5b47a1910c9d5e2

SHA256
ed6286873ae80f1a9507d639d39f9dada10bce0e4647aa4d1bab783db9b3a4cd

SHA512
f7227870fce2068eb9919be31af2e0e8fd8e67dce412218bc6a35ec1f9f802be168aab4a08cbfc13bc4c485b19b09790c4021de43178d128cde9a20e099ddf08

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif

Filesize
1KB

MD5
64d0f4f6caa5c51008a95bda9b0ce1e9

SHA1
e7f08cc71eaa8045e02d036279fc692c179bbce5

SHA256
54299e027982f6ca88f58d15dd73593c50a2b60f40300e8f0387633f6dcc5282

SHA512
ce1acbe2ff23de5a86a57b752e62a91c881535c1b94eae3c160290c94c814fbc85bae81cc7355f195f8405b05e151be0ec07fb2dab43d5f6040701340ddea5a4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif

Filesize
952B

MD5
5786010e0b0f2056dcd104c5c2451e4b

SHA1
2b80db74bab724d20fe2fc2669249113343094f6

SHA256
20dd9eeb013872ae7449c695ad593051748fdffb44b32d65b6c665be18b50dc1

SHA512
9f8c4a9412e996a9ebeca99bc74ee74f9641026e29e99b0bddc8499fe4650bb668457be2bb9ba91e4ee91d97e4d250a2c48ae80714129f01c374fbfaac41bc47

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif

Filesize
121B

MD5
f45d246e1d87cc9c533ea797502de11d

SHA1
7d26389ff428b2348a24477fee89fed63efb3e8d

SHA256
e83657e9e758e957e3fab4b9fd70d0f8de5007f34a3baf90d8041271b3964149

SHA512
d81840a8f33c197a803122b61616ceec6e1c7fe544b8f034a175209c7246ccc3446b0eb88cbdb6833c0c842193e243d88583937f9e1edf4fa66c63d3fc12027f

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif

Filesize
1KB

MD5
da159fa49c9c9d881b2173416614ea62

SHA1
86a20c2bf5ef9a907493a526e5e34e78178ea98f

SHA256
f2098dbb22c5de98e3c752fa52c45194c008a45c1a902c83c3834cb865d3343b

SHA512
f06805b4f17506ae34c13855d038d2c200108ae6179784bcdf63eeb54d43f9b35825b88e5ed6e5eb00f4f3a75efdf01387706506c4b6447fe2133cb37703a53d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
8KB

MD5
71099e67582505d4baea03aa2c6e970e

SHA1
3b36fa0175383d0816bd5332b4d0b4a20b681a47

SHA256
bf385bbdbecde6a89d83bf69fd98da7efcdcefb20e059f672db18311e84d1f88

SHA512
3a9c152c57241bff9e53be714d9d0a6518a613cec329681f1aafe551e7445754d41479ed3825c4010b080ce8f80e3549de07a32237f7663eb54ce0ad01d5f049

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif

Filesize
61B

MD5
4c08304e59638e745b1b8284433c99b2

SHA1
bb8941ffdc48bb05fc4ff7b3d9135fc9ec649df3

SHA256
69d3fc93b44b21c5acf06f0b667eee11ffef5f05a5d35b2319c70365f40520f9

SHA512
04c31ab1203f3a87ad92f6a4b7cafbf2a4ada26af13c7f6688c3393c53304754fbbfee72dfb70847c5f327c042510496147f779c150b31edf4e0fadd25dd4400

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif

Filesize
914B

MD5
07f1de4655d5a2654edd09a347ac699b

SHA1
7d769dd9ce19d9680db2cbe14338bfd9af8e8fdc

SHA256
f599e79d1602e3afb0e3879f06f0f9b2920c183d05f6ea2a919a138078deb072

SHA512
d7572b047cad2348196be95f6f81c792e9b2bf99b6f6067e6a2ede25c50c2e2b6f4bc86f88406c4e3aaf3c795ea7a6dadfb7ac47073ec6ea6627ea1a35925aa0

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif

Filesize
90B

MD5
6ac3e53a9a37b26f7b1a4dc1af879aad

SHA1
072b62a0ede426d59571df378ce38e07edbeb442

SHA256
685ad3b4aaca7c1a275d6d298e437fe4fa99c877bba8a07af9b222965cc8e42d

SHA512
cad2a9dba9062a752b31f8d21d80ed023dd692a64a4faedd7b0e1389ee8ce98a4902b191861aff8f32d746e2e56e0bddbc6be876c80616e78e4b6b3eb51a0a05

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif

Filesize
90B

MD5
830d4728be00abb5e7878bf13abce8e9

SHA1
b15ed1a988eaa64664e417bff8dbc0b457a38852

SHA256
c7cff7f287b61767214c043df8068f8850df6475b99ee9f88ab15221992b9127

SHA512
1987bc59a2b6d6c611eb3d168735eb5380b50a087991b73dcb6917e085ab4abf60e93cd618915e5ef898af940b2672aed967cad7efadcb53d387fd8ced4a6e37

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif

Filesize
328B

MD5
5943ce3b15aae8cc91daafe27fc1ce51

SHA1
c6564e4afdabdfe6dc58e455e69ae87cf82e4090

SHA256
1abda9ebd0d732870f63304256a4a807ae4e7a1b54e520895dbf8966133f2ab4

SHA512
39dc7ef815887fc77ca0230addc0b8f44e1c050ce1d0259b231c94339bad6455b51ad589837e185aa1d5ccea6032aa599ba7f14cd270a8f54428485b04ea8348

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
2fb1b121ede30685a1a3129c9cd74781

SHA1
41796fb63b25a49327c313035f4901e90c938f46

SHA256
fba4f573510ecf4ae6560847d155b6f676a3dedab32af69598e574c76008ec82

SHA512
98cda1cdc1d86674e06778190d8e06499cca0e9c162696bae07d6e0a0c7be756d31d4568b52bbb4af3ee13dbd767459d3d11222439c113e0b9439b91fe9dde93

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif

Filesize
162B

MD5
cc2db7c033ced53bd5948b9c2c3e07be

SHA1
5622b220743b4958b3e38805d637778b8e91f710

SHA256
8d9f4028b8b7a9b66696af205989d0fe6097754dfb4902ca38651b22901b694f

SHA512
1ac5ad36a5a651aa150ecd65c233da1901f59711834d01507f0b9ed3924aef45ce19cea7eefadf64f28ad37101442092f93520d899becd85479bcf687b181eb8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif

Filesize
586B

MD5
9a381f98037fe0237738f2367a7e4823

SHA1
e5ee85bc1f399e6fcc4d558e738f7053b9f218b0

SHA256
1f66ceafffc752374b4305ad3552658f6836a10ff375614924804ea4cdb1532f

SHA512
cb2ac093d5ebe67c5893958ae349dfe56758308f80f491bcb16c90ed53c8c5f9b76f55336fe75f4b823f33d96ce9c8a575d5b73fe357f2386e4a1901d224b501

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif

Filesize
124B

MD5
509aa3ce33c261561ec91cbdaeb3e7c4

SHA1
1b2656df7c8e646a52e2a57daccafaaf1913c218

SHA256
60fa63135452ab9c7f281971135b3d47616c60c56cdcff49d4b4fd2d60202a0b

SHA512
d4de7d2f53dbc4695478e8f4735b3e5958298e7d6e3aa25c5558254ba3b0d0495b7f7380ba8bab2416a5d1c1000c2c2f7c6a89ede93862efae66d660cf9486ad

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif

Filesize
65B

MD5
1e6989501a6e9ae7e5daecaae7c18ba3

SHA1
e159ac3e69a065d9f39f2d20f9344ac4e8175366

SHA256
eba5dc79c02453c98bafb92eb819f6bffaa8efd9bd79b41bafd08e1fe9aff0aa

SHA512
d38cbe6e27e68cdfc3f5d92c3561263f638512afa3db7ad08f75f35af4414a237f00481405024be18a2fb330bed398dbeb8b29c14b959964850718301c224fea

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif

Filesize
65B

MD5
09aba0ab41cc35e641018d48c9f9f7c5

SHA1
7d1b757aa4ffcd7d39bc3fe16b7aeb0e0618ab09

SHA256
611af8749f3e3a5552ab9db1bf55b00a8ad220c8db0887570500fe0c72d84696

SHA512
f03d49f59e8964824f1ac2493c170570ba890ea0f27de2a0e24e0ad7b5c532eec6d08fde5d6a59e8ab0552b75526558f3c79380ae1b51501599fbfa4d88275a4

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
8KB

MD5
77aaf684f34ef1f3914a4afe5ab4fd94

SHA1
90218d603b64381db9a73452b49460d2322cc92e

SHA256
a795320361cd3f8a71a667957240f3e279a5e80e86b407329bdb44cd4fdf179b

SHA512
06544268f12361f451932eb84ffd782f719632e3fbdbf092f155628eb24b161e8b06695d6d07a61696186cf803ea488c9c1e2e2863c13ca6cf750b8fda08ec44

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_leftCorner.gif

Filesize
65B

MD5
60e67daddd3b344fbc0dfe616e27ce43

SHA1
f7f807a30a7524c0eb9d7bb3773577c535808e55

SHA256
a700a183832667da796d4f7e8f0e176007fddd239c0e534d2a2b7c8081af90f8

SHA512
1c3f339d967d0fab26ece6bf9736f3bad14b5dbf98dd9fdd551b54a511bf45d4e1bf3f018fd3088da5535ce8da71d51c61b4278b0ccd77b507ce98a186235076

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\unSelectedTab_rightCorner.gif

Filesize
65B

MD5
abb4347be81afae1a74fbd33a3deb919

SHA1
6256dfd1da9731fe98836c39fad4566c17ea3dd5

SHA256
440888ae524118979bc2ade3f1a6394dea3b81e6d0343d7b268dae8c17f0f91b

SHA512
91cf62a6a2cceb5d93eded9323f38f6773c6c9e6f14aafa073b1911810586176177d4f04962c0c0956ef145c6745b4f4467b627a811444711c2d1bc75b352b79

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif

Filesize
880B

MD5
1cbedb4b475fb8df8ae5dd1fa986ca26

SHA1
ce398a2ef5dea0ecd29733080ad9e687a29d6bec

SHA256
8b3a9e672522c1618396f178cb3c0f72d9cd45683f68db96e02f9b65515fcc19

SHA512
5037a15e108c860a879d180404cce1a865716834cbd511c67e7508205be257d68853bbcd6e746a9ee80b7c9369ac56793d59fe889748588d5c58e8ac10fdb715

Download Submit