Analysis

  • max time kernel
    30s
  • max time network
    36s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    07-06-2023 12:12

General

  • Target

    06911599.exe

  • Size

    2.0MB

  • MD5

    08e76dd242e64bb31aec09db8464b28f

  • SHA1

    3f3f62c33030cfd64dba2d4ecb1634a9042ba292

  • SHA256

    1fd07b8d1728e416f897bef4f1471126f9b18ef108eb952f4b75050da22e8e43

  • SHA512

    2aaac092a07e7238e73f7ed02243500de6f0c34182ab894eb6adb4364212b852301191c866dffa3450b8f795217b3f649b8eda91e604f5784523b7c22efbcaa8

  • SSDEEP

    49152:8ddZj/Jrb/TyvO90dL3BmAFd4A64nsfJ7j7TPtGzd4RgLj2Dau/oZz/Fz1/:8dHj7KBg5ov

Malware Config

Extracted

Path

C:\MSOCache\All Users\Look at this instruction.txt

Ransom Note
Your network systems were attacked and encrypted. Contact us in order to restore your data. Don't make any changes in your file structure: touch no files, don't try to recover by yourself, that may lead to it's complete loss. To contact us you have to download "tox" messenger: https://qtox.github.io/ Add user with the following ID to get your instructions: A4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC Alternative way: [email protected] Your ID: jFsmcdPh2S You should know that we have been downloading data from your network for a significant time before the attack: financial, client, business, post, technical and personal files. In 10 days - it will be posted at our site http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion with links send to your clients, partners, competitors and news agencies, that will lead to a negative impact on your company: potential financial, business and reputational loses.
URLs

https://qtox.github.io/

http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion

Signatures

  • BianLian Ransomware

    Ransomware targeting critical infrastructure sectors since June 2022.

  • Renames multiple (7852) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Modifies extensions of user files 7 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 42 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\06911599.exe
    "C:\Users\Admin\AppData\Local\Temp\06911599.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Windows\system32\cmd.exe
      cmd /c del C:\Users\Admin\AppData\Local\Temp\06911599.exe
      2⤵
      • Deletes itself
      PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2961826002-3968192592-354541192-1000\desktop.ini
    Filesize

    129B

    MD5

    99f8fb971e6c5f17935076f119131e2b

    SHA1

    d149df87bb6cfe06579284ba6428e212c3fc20f3

    SHA256

    3fe9280f6b27bcdd81791ae59184daf51aeb30800529efa163793b53a7ad02c5

    SHA512

    8127d45767a8410528856f9ee261f729ee95ce3ece0617e7583e74cbbef19cb707269e7e91595047bfb52db82a78cc5fb39abe648bc3983533fae6212fa8e393

  • C:\MSOCache\All Users\Look at this instruction.txt
    Filesize

    986B

    MD5

    46bfaf26de54de2cf393f9a6356aada0

    SHA1

    210792c0c690d52d2833e9b0077c4f71ffcfc2a1

    SHA256

    e7cf0dd9d5808c748208ff3fa4c91d3073643ff088826b4f7592b0f3867a2b77

    SHA512

    e60dafb09e7dab66c9305b1d35d81ef197a76753a0fb1c8818069bb66f0106224e0c6967d622364ec3fbcf181b890bff8d094ad586d0c7b3d031362652a389e8

  • C:\MSOCache\All Users\{90140000-0115-0409-0000-0000000FF1CE}-C\branding.xml
    Filesize

    582KB

    MD5

    e48114e0b8ba94895ee48bdf84f39f6d

    SHA1

    9468d5ebec69e6d8d41901c9caee1f64691bdb50

    SHA256

    e42ca4ccc543f72408d187765586f66b8f9c39e899111d3f546ac2da1f8c7d67

    SHA512

    11e601e019c2ab29a87f50867601602726a12031aee1d7e5775679f60135fbb8c274abee8c3139235553d2f99e8a4476acc39ef0851b9bd822c9a294e385166f

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
    Filesize

    341B

    MD5

    17a688c5901d6bc57af9970ca0af10e7

    SHA1

    d3d1873a55114d8031b4e8a9a24196e11f853ebe

    SHA256

    9a35d614106a1028bc1fc6c11b9a4b68f3571bf32866155c1893571fe4a32874

    SHA512

    ad21abf65bb889d7df46b1740ac0b958373590649f98371ae89e69e4ef1cfeb72c2035ba5956e1aa510cfb626dacebb7d0b03911e187a7829ad51a9e50b725f8

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
    Filesize

    222B

    MD5

    cc5e6f0574afc20dba12027043f2a8c3

    SHA1

    f598804e64c327cebf427df4c7ec8dd76da3db2f

    SHA256

    801ba3e9472212f937b7e2f510d5f353c623e293c646661f231c2a18ec98480b

    SHA512

    0a4627748a6fdb80610387b92343114a730f84865c83e1f9435568b24be99c788570a18ad70c2cf09c4dcb129ccb31033b11b33f2d4bae3a4516b23fd0c3c7e1

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_F_COL.HXK
    Filesize

    114B

    MD5

    9b2c529bca83736bac2b752fb032eda1

    SHA1

    3fba6cbcfdb74a05da8682b1ac0566f39953400a

    SHA256

    25d82eb9b112389a981ad29b1edf64881a8d6603a29cad7f1b98af88079f6eb0

    SHA512

    bdc1d1a38bfad07ddf1a39da18b592df78f3ef9c89af176e0e590b556129f397c2e636952e5012a6037b887f6ab99b4b5b4391a68f1ecce2663759074af8d0d7

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\INFOPATHEDITOR_K_COL.HXK
    Filesize

    113B

    MD5

    aa880d673d0f8f098feefb52cce18cdd

    SHA1

    4958b26d72b6d91e13ba03f70027bf41c334036c

    SHA256

    fd5df107f60119765abb01499f82343fa71765037fe58981633e5908c5638815

    SHA512

    a21a2290a6d00445fb2caa9eb109ea0a285dd2d02b9d6f939b93eddbe76094093c8f21022cb72e6b6c65759f98cc1545ee570f855b0b01d4f60d9783e491eedc

  • C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL
    Filesize

    239KB

    MD5

    62ee4c8038d38835a79c1dad545017a5

    SHA1

    b2bcf2b149dade9f701064cfe8e46c799a01426e

    SHA256

    add3c3f303d9f15c7c0db7a2fed014a23f7f71020a5bef8b87f874412f22f4ec

    SHA512

    2eb2b6cb42972f90f3e55fd609f800ec93f7b2dc6473b45e0f75fd709796355f49662d8473e13151491388035b77a28604d8534f871b63275e7edde76293b01b

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ADD.GIF
    Filesize

    580B

    MD5

    d07bca280f47978b0f6cfebfbac925a4

    SHA1

    9dc221c4028073d019e075d22c39ecf8dee684c6

    SHA256

    4f1179f8988f641bf5a2a20aa1e7cbeac997e5424869bf822751d8b3434efcfe

    SHA512

    2ded7d4fd008e8d2aea5e12b5d962454791cce8041d8b171282d4e082a12fb1bf6d41edd3b908f9635fa11932d78e0c50f5292dbef2562c3ccde78e5cd6502d9

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrow.jpg
    Filesize

    2KB

    MD5

    7eb17b3f9bb83d3039c7ffba2ca07ac7

    SHA1

    819113e89e6d37dac2aaadda5e27290e074a08c8

    SHA256

    32bf1f46743689b59ce4c9eeac27a57d89d42a5a44db1baae26a129c6702e9a5

    SHA512

    f46ab72c9610785a7b8c990e6781f7bee981596ac59fc7fdb4c1b6ae1a9312e83b88868121822dd5457cdf2113c112f32c47799f87435a3711f3490680986bf6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\AddToViewArrowMask.bmp
    Filesize

    2KB

    MD5

    0c6b4e1f07bacd43e3533c108afa200f

    SHA1

    3096f4593edf7df62bb9d315c7510fcc22e46273

    SHA256

    532d7f6d487bc0d32e09f93d056cb19d2c5f2a8b25821ff1dfff6e7ca35429af

    SHA512

    9ca7561adc2bc0565d6515185fdcb767fc7c84516871a34456d1f7e2969fac3c3b9bff0a41af6d9c002ecea4707c30ea3fe7999524abfc7243c70a9765101740

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\ERROR.GIF
    Filesize

    873B

    MD5

    57693a9d3361f2bf818e5e7f3a8d8964

    SHA1

    4129ffbdf089897869aee0859efbfd60a7dc32fa

    SHA256

    6e3555e7fab7ed8a64abbe253c3b331687974f48cb3bec6332755cc645905bcf

    SHA512

    59a19cd4d1d11a5ed3347d61b6fcaa8fc7b97634e9f18980a1277ba8e5bc63ce18b59f62551c3c4a242643d2a88d27e80c8d0b39adb4317a45da2b7de9a9f15d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.ICO
    Filesize

    318B

    MD5

    a9f27d923cc090384388b9c2dcb6f3b7

    SHA1

    3d94d639fd1932b6a9aac75f575606c2b3e67dc0

    SHA256

    93089058797660dcffb91a9058a4ca2113e5110edb8796a22493cf6052f70306

    SHA512

    69537c03151fa31f586164f3d2462e43ec858af8bf6fd841c5fcbbb57780f2bd4a9a481a9ce88974563aeefd48dda4f49f25428be6efb53144dae1dc5ff60508

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg
    Filesize

    6KB

    MD5

    cfa83120a111b9dcb3bcdf82e5cd4e5d

    SHA1

    b52e393f1fc38e3c65e153d8fb6472071243d304

    SHA256

    7a8fd8e0bffb2dadcff4a3e9ae364001cdac16cb233ad6316255b55889111163

    SHA512

    84e5f6f1a1fc7086e84b71e1a677c5dd1120e37f20643fbf26464ce4588d5f17504ff150fb555c1fefb894deeddbe53f1a14b20c906950b90665e7cb4cbfa137

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
    Filesize

    185B

    MD5

    7b44d8e7ddbf48ee8e826197598e9a37

    SHA1

    f24a9fe91ed0dc65509d38fecccc70d3f723b3fa

    SHA256

    b3cdbd5477af204460a472a5e196a033afd8ef146aedfcd2a903198bfaae98ed

    SHA512

    db991bc5ccfff913e18c5ae0e4906cdfb373731f6838cda633265cd3a15847bd5b97324a93571f376c7309fcfae0e2754b37e89f45a14a0494efb90bfc85b24b

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
    Filesize

    496B

    MD5

    be59d8c958d68868b2ef289c0ad00a86

    SHA1

    eb48d8f090bd39eb2bd26e054de1fc65cea647ce

    SHA256

    d56c51ba63d4db1b691667171f75f43274ddb25ce4804f8a978dc681e1e19d3c

    SHA512

    249b43dbdd1dae154bdd3a369bbfd3def4fb3bdb2e02244b96c8c83b79895f40ac721986ab22d69fc6e4fc41ecccc61059137089f0fdf6dbaeeb01955657ff07

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
    Filesize

    1KB

    MD5

    eefae8cb42e618dc9c75dc75780583dd

    SHA1

    fbcbb5e566db27c63824a18e2e51fdf065f0e446

    SHA256

    fa4a8294b0079cfb5f1825b180c8939277afe511ea5ffa018e48bcf607b2b6a8

    SHA512

    bb6ac2b736932a8798c40ae76a60ef1676c315ef0ea6198bad520c4599316aff589e4a22d58b97afa95e14c4bb5de258731c4af53821c4e34f6296dd71bb2b03

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\STS2\tab_on.gif
    Filesize

    264B

    MD5

    8e59c315a93d3b430e49ba81542ed02e

    SHA1

    07e8b3a15068fdc483aade61b91beb73e57feba5

    SHA256

    e36a598d8b90f63d74f281505bf357bfe5cea52c92b96f2a1f55d9155a3b5f1b

    SHA512

    6e8615243f89084861ea8a8986d003c152e9433bffab46fa5f209d3749cda8041f85c6a008e86ce2736126d97076e222457b6a73252372189f2a890873399ec1

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_ON.GIF
    Filesize

    364B

    MD5

    2fe966c338d87c2becc5cbd088844f34

    SHA1

    84543b2310c30a58a551a77ced8a139dc7c3c50d

    SHA256

    f7a55c60c7c626dea2cfd44e3f306b983873e51ae190f73332c420a60ec52685

    SHA512

    4956bf22f1b130f7b084c8bbfb41aca9eedc39eff8336e010aa107932b81830dc9921779feae9b59b14f9d8cbecc6572368c7822b69306830d09fb67d79dcbf1

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\LAUNCH.GIF
    Filesize

    615B

    MD5

    a622a21272b9fe4b95c3f5afe37e5c23

    SHA1

    32b49f0959aa814b7c13cf3999a94841cec1c1e0

    SHA256

    23faf1d9477f293fd5043d72e9e5a8c3e95fcee42cd2301c5df95db073eb012f

    SHA512

    32f1f96ddb8c4c3176c61c9b8929841130bc42054960dfa841c2c69d7a960b7556d14a25c8c57883dd8f218537029d9a6a6516926912727eb20d55939f0ab3ee

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_FormsHomePageBlank.gif
    Filesize

    19KB

    MD5

    8b19520fe7460e0f227b53f4c6e5af0b

    SHA1

    c231fdbb8d24ebd2657e518bc7ee6df9ef97d466

    SHA256

    d2ca76798cb1bbffdc797c7726fc7dda995048686a0e3ff90efa134e9d93a40f

    SHA512

    6a22dfb1983c1ef2bc36e06e06872747995dacd2d9fb9d71e064d64291bf7522fd3f4b7f9e19b46c1e046457ea97cc839e0424fbf7a0aa43174f4f5e8575fde8

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\CALENDAR.GIF
    Filesize

    899B

    MD5

    48a1591867d068efd7412a18af168d50

    SHA1

    56bdf2ee29acebc76882b4b1545801aac1c66519

    SHA256

    bbe31cd1ba52b48f53073ff5a09029ec57c817cabd57c3059be4f1010f94d969

    SHA512

    93e08a0966ca6ba260d2a0f50e6f16a984d145749a9c379ed20a9af2ef6bf57a269b5448f23e4b1aab1e64296ad5c0dfa4b2a8eda7072c8757162b29e9fab6df

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\DELETE.GIF
    Filesize

    625B

    MD5

    9bdf53a2c130741c413dfde717e6992f

    SHA1

    2ef7dd902c2add72d083e058d72562ef7702aba6

    SHA256

    78d0dd7fc0c1e5f4aaaa1a62a5275d99ecc49f5d42e927f96bfb53f258edd4c3

    SHA512

    4b458e3340bffcf0c21898c888bba4a16ee6f05b752f5de6129d984ea2225ae3922205ce4644896e7645d345b5dc47e18ca6430a6e73e9f1330fcd8c17905081

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
    Filesize

    255B

    MD5

    45fbbc0d5ecf7f6389c4b0ec77c0bf49

    SHA1

    6ee38764fa91cc68d62ad4af89f082a171fdb938

    SHA256

    f08730ada4dcdba7b592bd3d5a73ee7d78030c8fba6ed7d4e3bf96073d4d22db

    SHA512

    a913c3d95ee68fa3b46ee87685026ef527e46eb1ad945a5c18e62779b24d1724dfaa92e8da936e58268d1684c5001865a1f23dfd50bf545a1ce243f917c25fb6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
    Filesize

    323B

    MD5

    951a166cad8bdcf7ded414db9f6bdbb2

    SHA1

    86955c195d71b9387a71d2caa6858aeada3e0dd4

    SHA256

    ee467fb1644401bc20a5ecca31bf4e095ac57a15cf7d122ff5672071faa2dc48

    SHA512

    b261fcf51e752d8f80a25134a78c8719257a53ba9acc8587232089490a0ee148e04163b84393e34ee40fc729760a6f73bc00a5b2b2b54741ebd803dad27dc3f6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
    Filesize

    367B

    MD5

    749ada1a79102c34056c174d1ddad873

    SHA1

    c20a8872ab36c5834068c1e6274b386f31d4c578

    SHA256

    28adc840be329cc5c41eabb3df8d734a478649332304ebf7420eb3e772a14dcc

    SHA512

    e38c7f61786d08e98bb465fef37a7b85b733c1df7c491cd01c843c56e843fd681aa8bfb7574481cc7362006c145924942c2c88d0082ff0ffb6d20ad272deb08d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
    Filesize

    148B

    MD5

    125c4e8738f433a7b35655a34f14aeb4

    SHA1

    942b71df46d388b0496dfaebc6a97d5a496f250a

    SHA256

    95781df93c673755588b890ffd9bd8b920d86a74adfd760c31521da7988ea6d6

    SHA512

    c662977c58a1d7e8d487f228c9f557134299e089689e21e80655f580030be925f57f7e7b32750887287593a8a708efdc208b8627ca94bfc9e59d4f9652466ae0

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
    Filesize

    440B

    MD5

    b324277a095205035dce2299e20e679b

    SHA1

    9526a340c4beecea7e2209d8a082da8500680235

    SHA256

    867836fff1d965a089d0bc8a23bdbab850019f17d1a67c9b502882a153fa9d3c

    SHA512

    a97a2cd9ae9749d73db194987858d3c7965e4132769f3fa950ce4e3fa081b32d4353b84e91a26563cd045bd89e2c5f82e3e4796e63b4a15f44fbd3d3844f0adf

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
    Filesize

    462B

    MD5

    3180d455611f34434b5631a11013db89

    SHA1

    99fe283133ed4d4703d608346c5d8e2449bc42a6

    SHA256

    df354673f5b1fd0cf358b66684147c391e7adfd82de4016c0a7c508b80f96840

    SHA512

    f62da228bba58c6c4d5a1238958429fb49c8f1d5b9752d35fb309be99e4add963370b0cb11c6124a0e8c72ef69493a007f63a7b495717c98332bf25b179bfdfa

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
    Filesize

    267B

    MD5

    5b773d56d8d5855b6549dfaa4aac4851

    SHA1

    0447acc124d31e21f608d49e5e8c35717c4dc933

    SHA256

    89164b0860fb6acf6fd24773285a45560834a59e60cd8ec1e423f80f30fef579

    SHA512

    4f0cf82d28f2a82ed58805fd068d44b619d2f8501392493ce3309047ba3a5e3abfca98675212364d39b335f600c946e518991c60da07132e2f2ebd4a89447cf2

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
    Filesize

    2KB

    MD5

    d5e0e2c9a96295b05ef49fd492d5e433

    SHA1

    6e96971b805bd0c853e6f2e4dd5e0abe8e58ce35

    SHA256

    8a27b75bd18fc7e1a95c4472e6a6cc370ccb9a0e15750e5a71a9a1d607664165

    SHA512

    e3065e044a1ec1ea474024c6a1036e5b47cc3beb303adf00b0ed7f32494b4060d0307c05d3ba16fdfe78e75d1c45c45e9c316a9fc6291b300a810c856624f709

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF
    Filesize

    3KB

    MD5

    c48a2f75d123e9d14be82b928f95164f

    SHA1

    c4fd7f7b8d977cf7be637371f92d5f87a5ce51ae

    SHA256

    d22f412a45fd8a6f94b6912fdf0197f0fbe05511486a34221787b11c2d500423

    SHA512

    3f2eeae6b276ee6fb8932e8cef03ac4d488cd5e728a3aa64ac162b4ca2619b1afeb545e78ea091101fa274e5f6c70ddac6b8c0c54ca562e2d1da999208df7b4d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF
    Filesize

    462B

    MD5

    c2d1568631a76fb0cabbcf883caaae54

    SHA1

    391341f179d34470e85961c36b6c47cd9f2a9a30

    SHA256

    9b5c625e0397c160014d296fad2d3a551f6485f69bbbf3b4dda69719521af6a4

    SHA512

    fa93947be6201807234fa5d8e0038532e621682bf46c9242e8a7c3c47cae20d373bdabf50420fc064eb4c357dc874b1a012246ac830fa494a03674aefc50b7ea

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
    Filesize

    233B

    MD5

    e676802e3cff7878de24a433edefd78c

    SHA1

    3966c4952c2bc86504d236da7ad9ffee19de444a

    SHA256

    da24533227f3444c43c16ebbf8971de34892d6382a42eb2267b3b4593cbde066

    SHA512

    43b131d065f51d280e168fa39591fb8554360f19fac918245db3ed04030d55d2a6b8d941c53e8f9ccc0e950c64ac2f6c58e03c253ffecc649249ff773cc54aa9

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
    Filesize

    364B

    MD5

    1987b7b8f563d7fd34c18126c976418f

    SHA1

    1d54ddc797e74914f18093e709ad00aec6ddb26c

    SHA256

    4f52e24e379d98e82438d68452d59cae4ac36541966df615e5dffd961c0d7693

    SHA512

    f9abd9b50a2f356da2cad60d9e83930e3dc8dbcf6fb9881a57d45a6851bdf18c010abd03d367fb70bb9589578619c8c0bc31240e68d162658886eceb381908d0

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
    Filesize

    6KB

    MD5

    45b1b42da26d091f79b3482b2b62e4b1

    SHA1

    efd78f1f5a67184472097d436288bb2e18555a5c

    SHA256

    e77ba93a713f4bb0efcce5ac3bb22a14c3aa9eedb294a94e27f6da7e889d6042

    SHA512

    a902456578190496fb58a08de5e57d8f8f688f808c5517418fbb4f4c0e229e387fde6905826a196e144c8d162b6679738f26b0dc17bf73ccb9a18c3414241e9f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
    Filesize

    428B

    MD5

    38d48d5d19a84cff8bb875de7b08905f

    SHA1

    19bd6c11c1719cc550547c518e8c67acc6e72e88

    SHA256

    2942f178cb6dd24627d529c928ff9c9f5446f7ccc143fe42bc68255bec1680c9

    SHA512

    8a74555e2cd4ad50f410f6ed0683d624d36584b79b6be2873ab85bf9b78d5aba3a98a075c46198c6ae57520f2d3a6f98be31fa6404290b27ddf1a93c105e142d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF
    Filesize

    26KB

    MD5

    d1bcb0d833b14fd1f0fad81834e8a76a

    SHA1

    3b4867c1c3ad9c51109f70a90154db23374f1162

    SHA256

    cea7f5ac5e491aeb550fd8959fd3325c84a9b2a434ea448835b0bac5d9b2924d

    SHA512

    3106bfea44980ece362b2de8e15d7720d781707fd703fa3f5cffd68146b28631a1c252c899418cab61dfe32f6de5e073dac20e28b4297fc4f3721d787bb04363

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
    Filesize

    815B

    MD5

    4159f6ff6697b46188060aa3cdf4f72d

    SHA1

    ae1aafe6f2373aefd32d2201819406b07d02b142

    SHA256

    2708699f2f3c20c78a8d30a5bdd09fefe05a8b5a6458076f0fdf97f4296dcdcc

    SHA512

    9e66135bd0bf1324cf14f985f7bdf9969c37969269771b1c7d16ffcac8215a1cad59b19fd767770c0a6c4e4535360140623bbcd4ecd7f36b231d35ccd380efeb

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
    Filesize

    870B

    MD5

    b6a71e38b17d2a4aeea132954c3d4ef8

    SHA1

    f4c2173766ab6aff12c8c4c5293faf9fdfd3b17d

    SHA256

    37acd4467669909d9438d386df3822daaa397ee8143d6302b0990b0c9f362943

    SHA512

    273886039c0684a0e18bde999046a165390baac52c73522f4c30e68f2e5d41422f4249b39013f7240f8798e6857ab4c0b9f4d0ed13476cbdaf0832b1469dee6a

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
    Filesize

    890B

    MD5

    8319def3041ec4d83f121a0133f0e787

    SHA1

    82c87d62c60a4d4a077c9a61318178f83adcae96

    SHA256

    70513a142161fc416c4411f605949939529082fdc69c65e2242cdc62bb062a17

    SHA512

    87f9c5ff3d2305715b1366abf914e982fa055f630dce0cbf616d75f07279749211e13118e2b96347e49f51349238e9aba5cce7d122e3c134536083df574efdef

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
    Filesize

    852B

    MD5

    b24a44b13cb79d532a415dec9a85e4ec

    SHA1

    e075561a1ed0b4099cc76b5f4134c6a591382c47

    SHA256

    6648a4424b9b88d5a368b30509678577f7ba028658378135d9f681adbfdadb3c

    SHA512

    59b4ab6fc2734939f7fb51375d50737816dd1731d2af0baab1e1ec7b59d83e578ad4fab778d7167eef3916831e36f1e839893df03c767eb66b8fb9c4fd7c4d2a

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
    Filesize

    860B

    MD5

    37520e102f699efb59e8353a30d9a49b

    SHA1

    2d54f8e46dbbb1e4884b00318f7a29c49c68a054

    SHA256

    ec8405fd45783d260181b7b26019ae866dec6e709b8f7276b637e0bb94b480a8

    SHA512

    9677bf94a7813c99036b8722a1da4eaf1a0b92d6c72454c35abd9288a3822254cb8368044b75bbcfed3154add9ed6b887a090d18ebe4466470e3443b9c18c851

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
    Filesize

    848B

    MD5

    d94b0f9e119744f3779b3f90914e7fc0

    SHA1

    d83c82d8d123d5ef3a40070425d7b5d9491b72b7

    SHA256

    a83200f8157897bbb7707fe5ce08832e0886e3df8a8dd5f22a1620d89bb3c81e

    SHA512

    01d65061700eb886cc430bf3f3de1aeebe45b1d6dac0274d4f44ffdcc9acd14affa66c0de56af301e55f86c83c012519e10822cf598b9f9c24f25814f6e5f535

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
    Filesize

    847B

    MD5

    c53dd2734190cfaee09054581f21cecb

    SHA1

    c6b05cef367e4e91958b31793eae0ae145e38094

    SHA256

    698d2bed491caa1df7b74a2559dcaad506b30e0e4d942ea1e0fa7684d430548c

    SHA512

    39996d9f6e3cf99dee75b5ba5fbbe83f8a936525c5c1c63ceb90148900b52bc2086bbab5bc754476c64f5a6c0fb03ea1e58257495d61b146d0bf00573f575cb6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
    Filesize

    869B

    MD5

    825951f81e94047832f04dd78d0c2055

    SHA1

    293fcb68474dfd1e41bfd94f661f937cc6cf0297

    SHA256

    a0e721d9333264198843202d41555d121ed085c4cb092d768a84cde9752319ee

    SHA512

    a4a3610f41c2666f4c59a21e6c46f5494357cd762d3cfc6303f100e68648b5f8d24cc25fddb424f0be98bfdaa3b6a3ae98818670c53c0a40df308c6cfe898f06

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
    Filesize

    847B

    MD5

    7a5eee39a5062f00e2ed47ffbc3e2834

    SHA1

    ce0d6dc1d95b3188936c4f8858ac622e1f8d85f9

    SHA256

    3d0fe265c73573487417f6228aa33d8697e7f585d9d19815f37b58df75570c52

    SHA512

    518c49427389ea8211fd2c1de2227ad11caa6aae5344b84c8733420d553a8ed0cb19a8e6ab7889df5888d3430a85f3903bdc734ad27d4155dd5fd7659f98ba1b

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
    Filesize

    863B

    MD5

    77ef91692bf7091e4076c6068a94b85a

    SHA1

    79371e6e6dbcebae890eb6773c05c8569d81595e

    SHA256

    b189bde7398e927bfd7b36b1d352542f0d5bdd9aaade19c228d003cc6be574d7

    SHA512

    fe0374468f2a0c2112633bf6c5f767d6c043a3eabda2a9aa9b1b8ace03dbdea2df754c376c608ffa2b8ff42426900eabfe42cf1c9b3f45f2fa3bb47fda172c35

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
    Filesize

    861B

    MD5

    d57560f28925b5fd829edced3b8be94d

    SHA1

    8d77f47fa0d76e8d75e07687c357a8d74554d99e

    SHA256

    128c568f597b3f7b89aa7db66e71a855157ebf956e06b50a6a9bd0431eff6b8e

    SHA512

    11e742f7fcf2e76433f2d8e2d43e16a24bdc0f37b2be7fe7f5d8a13b4747be497079a693bbd57f1266f02bc1b6d86509564e7d84bb2ad954f0c60e1a4839565f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
    Filesize

    850B

    MD5

    07953303bbe3b83ed2b75986eea133c1

    SHA1

    17052a5dabf921b5fe3641328ad85cc0fceba707

    SHA256

    6c848a5a551e08a768e24151590fd22200449f69a0a8d535cbeed20d83b4169a

    SHA512

    790e439a3107cf274fa5d2a6f367702904a05dd3b10c68f4bf44500c9c525e48224bb5d980320626db336fa7358f6ade3f759c352eb108a445937ecf306249ae

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
    Filesize

    883B

    MD5

    cc5cf38ed546010e53c5acb150c430f9

    SHA1

    5e30b528626c4f5f8e1863e9ee73edabaf493d3d

    SHA256

    a4ddec5efe53b603c532967f44c4281b5aef2b87ae61d621c2a32cf3b30666f9

    SHA512

    36616ff5554f3e007f814aa5ae9223d3b9ba05e49aaab77967d5fd7b58d18b6390e47feff30850fb0970f94c059484db89f3c0efea1ddede235ff5e549999a1f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\BG_ADOBE.GIF.bianlian
    Filesize

    24KB

    MD5

    410fe9f3fceff4b76e7e77e7f5a65305

    SHA1

    39aee5f28542cb9201ff7519f96aa70103f281cb

    SHA256

    ed8c5c3eb311643ef151542a5a0ff2bb4ab71bc54156a03fe5930d0da693cd96

    SHA512

    bc15e95a6d94eca681be6e8cca7151c3e46408fce2c8b66aa2d32e5b70f0e1b2680f5cfcae34d6f4f7c8c33687b4f1332ecc46a448b1bffcac16db3d435e7585

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIcons.jpg
    Filesize

    5KB

    MD5

    cdc05c96da812e63096e8d0b38e94209

    SHA1

    8db0c685ae6b76640539c52f7b91cc3a188e56ab

    SHA256

    c548c8e2b14fd7f776cda5f950bab99b8fb511d72458014c31d7e6414ddf6ddc

    SHA512

    963933ea64be2dd6ed725e6197bf86cd915c55042c9f4dfca34a8ab28c4f9689019a9d0088df9aee095ce8afa1fea3645b703e21b910fc8c1ef67c8219746cc3

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormsViewAttachmentIconsMask.bmp
    Filesize

    1KB

    MD5

    8421816ca9b17b1dcd58e001802b4968

    SHA1

    6e7c0e52be711e720b94d0efffd33cedc2cec34b

    SHA256

    1e295a0a16612108ce648757e25231fd2f8295e3fef59cd33377010359912337

    SHA512

    eb20e7b7ea0dd71a269977f476d836ae83966349daad87d32c2088216ad7e74e284be297111fbf02f8914e7cf59f396df7b5e49819dae881334cf5c9a0c60888

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.ICO
    Filesize

    318B

    MD5

    92d60d374fccae80025d8adb9ca624c6

    SHA1

    03f545ffd0a33b9e3ce5ac11696da0a28d829d18

    SHA256

    e83f778507a8223609a90273eba2f8a9f39a67ded8012f40d0fe6260c5fde7c9

    SHA512

    d293a5ad8f4b13944e7a979054e54b1612f6b8556f729b834d5cd0e6ed1cd4450d1af0003a3913ad21599b0159d2d4733c0e8277899d2ee5b12698d263d3187c

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg
    Filesize

    3KB

    MD5

    67959d200ba7033b75ac4d0f53bd060f

    SHA1

    012187b15617aaa1585e9c8dbe032d06f2a304e9

    SHA256

    9e43d574acc94a34140e26e4f8128d05703c1ea2bc1684cf81dc2fdd177eedb1

    SHA512

    72b5f02c0003cf8595af964b4c5706e63301214f2a0dadeb1dec95a75a562ea8e72420d4262ab1f484a30b90bdcde1b74e1c7916a10dfaee255fb3c20a9e8ff5

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\attention.gif
    Filesize

    2KB

    MD5

    fb4834007826ee1dd66611dbe0fe5516

    SHA1

    ebfd92d0a6119d07b1c2e83db853274fae13d397

    SHA256

    12f34ba2a32a5bd069129c3c4022485e0d3c75bf7d6d4b28f61655f29bcdaa2d

    SHA512

    e1a0c601c8d0db6a7026d9e12e2a2ac61ee04ecf072220666171b1fa8ca08f6b6a6df97c9df99331a1abea8bd6dfccf911a13b6c96b51dd16c2dffc51e5a2fa3

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Casual.gif
    Filesize

    5KB

    MD5

    13a70915fe1d0e1add324b4da5f7fd62

    SHA1

    4e08e32d3e3d622ef0c604c75ef161cb21c1f155

    SHA256

    c4590bc8d4d11f85fc0bd4ad3367903c6de88b7611b21a425cb456fed1f8edec

    SHA512

    cf155c85db4dd4a59b840a3cb5ff2a7182ac8cd3d123b782da3a128327e5eac96a8c27569d145b62cfe4952298911b26de995d6cdbfd182f6adaaf7af308c117

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Country.gif
    Filesize

    31KB

    MD5

    a72e2ee7619b54d062e3db8467e28d62

    SHA1

    f7cc88b05c60f78ea21a522e08ec22d8a45ed333

    SHA256

    8d1841307b307e7d6517c19b3ad77d93b0144191947751327f42f90557299a6b

    SHA512

    e14d74eaeb8b398624ae55ac79a1cd0d1220eb67a7da832704ed62ed54f6ca38e1f15b5c25cbbf87cd08bafbb69cbab55a3c2af4acf609b09fabe694645e0302

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Earthy.gif
    Filesize

    4KB

    MD5

    f71ac2ecdeaeb7c470fe45fd54f655d1

    SHA1

    ba32b70849551905d8c4c6f6c5431c2fbe90acb3

    SHA256

    6b3c55743ffcd20ef748eed208bd6ab746647acf060ef9cda6e6ce868233955f

    SHA512

    ef37f392c51655f9609c8fd1bccbd65ba3f3a58de3234c654dcdf3a1a667e37642635902def649ca6d0852643f6fd0a3876feeb778f37ed2770c5628f5ba26d2

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_GreenTea.gif
    Filesize

    21KB

    MD5

    d2e9ad8ec57ceb4a675071a63f38fb32

    SHA1

    b332334c7a7416b3b0571a365b901092d3da610e

    SHA256

    144ddee682c7e8c5af40cf3cc712d6e2ef824cd5fdf104d2143b5dd870776e69

    SHA512

    b9b86e0cc7ae457536c6bc04a2b498b793bf735a413e23236ed278df81bbb234573ebfa418d7a45974f19270a2586a433d93d4d6c870a36ed7b8651ea3249476

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Groove.gif
    Filesize

    106B

    MD5

    075eeb90aa767e7d0303736cfcb3e3fb

    SHA1

    e1c71019bf60f2243e05e29970ed08e30a1c93b9

    SHA256

    3874ae72d3d496f7d665900e1f8073caeb38d4ec64ca679af9ce402b1c4aabf1

    SHA512

    9b81ab15c805e20b6cd90ea7d3228bb27b99c504c0daed1fb0ac4e1736e9af062171795a7eefaef5d2ad95cf5e4719a76bc0b267058416c631a9ccacf178e7b6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_LightSpirit.gif
    Filesize

    8KB

    MD5

    c4f8a1572499b223b4fca31bc78d8764

    SHA1

    1c37337cb056937d02944f3df6c03d5465ef254e

    SHA256

    8a790f307719893a1ef37fb32002a343e2d221a0a72755313f99d23a98f62988

    SHA512

    a65d6b700cac2f592b3a8a5ad170c1bdbe66e0e074d5998831958a46673d537677a4336df5bc6b93708e87d0e2d42bdf7e81db68af14a6731504662bd629a965

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_OliveGreen.gif
    Filesize

    15KB

    MD5

    a1555a0e36034c43b0f14de5f6fa52c1

    SHA1

    c7da5b6b8f189d68728a6c891e4b922404db68d6

    SHA256

    cc15c63b64fc80e9e390187aa185db8a1278814726a5a5f6ba40dbf1c35270ba

    SHA512

    fc00a00b3b244c3c590726d752e78fdf5701fb1568b4d299475a31fc8d577427d5ecc9552c959e1d2532adaf4c832d521a726a2e7b56f05ae841de972f4dcd43

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_Premium.gif
    Filesize

    6KB

    MD5

    5f263a5937062f8c981ec3e2466e83d9

    SHA1

    32da3c1c8cd5af239db175cc1a78ec7d95c0bbb3

    SHA256

    e0bea00e87a5684f54c4c4d6e8f243b8f0ae66d887ec789fd2410df106c17cbe

    SHA512

    504ecd1f019d773c4ec38d05030aa5655133648d270b28269832e4b480043775f43728075e35f9ae49481a85627764ac891e8b23a57873d9db4a461b19faaf2f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_SlateBlue.gif
    Filesize

    20KB

    MD5

    5e337608e005b7f93c4dc810308b8383

    SHA1

    f43c7fb39565190f27396d1f75a7fee555fe4f2f

    SHA256

    c84d390b17a33bbab518254bf209bddac8ff635a82164fc9b081626c427ddc2b

    SHA512

    bd9065df200f937994e3762de49f43dd3b34d7fb9f5872f43fe8538e944e95142d962ea4fe2c3a60ab39c182e96bfe489e5cd63b92feb73c37e016d73797139f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_TexturedBlue.gif
    Filesize

    6KB

    MD5

    e3c77def62fa2df7f76e124f71cd33e0

    SHA1

    77d33569b8a1646f7a3b733d2c3cfed2a2fbe6b2

    SHA256

    6d06ce53400c4f1c0a57d09694d6c28afd9c39ca120ca97856a46c47ff4bd634

    SHA512

    ef1aa5f6d00519385c87fac1a6b2bdb74a624759ff5faa8c29a89d313db9dfb710acd5488516ec00b8178b3d4c9d0b19a667b798686e11dda108edbaea050005

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_VelvetRose.gif
    Filesize

    15KB

    MD5

    18dc541b91c14d082730cf0cda9542ea

    SHA1

    74a744021635f6d4833440d51e004379df66656c

    SHA256

    662c36cd309c2dadca29eff6155755846ce9480fd9dbbe70b66652a05d3bbf36

    SHA512

    0f0fa58cdeb3e35a4f4bb7b097bfd4d71012375030539dc1e1ffc801a4481410530c403650596f65b7ec2b5e6ad74d01b29269316683619daa94722c65c9e6b4

  • C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml
    Filesize

    247KB

    MD5

    5fcdf94d6421c2238c00af57df2c78bb

    SHA1

    7f8b45136d0d40b21d8f71d49f755682ac10bf2c

    SHA256

    e9433c872571c6120d165ac958d70a95b2347c4f581c60913566214039f68e3c

    SHA512

    b7fa3561655c970902724b9f1219e78660ce831f297ed635c133bc5e7326f3e7e70ac3663b9f294a3ce668359274481093f21b1cdec0669db1b9ee5df280c4c9

  • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML
    Filesize

    807B

    MD5

    747752b2ea070d9f9fef2e3b93680185

    SHA1

    dc8391b66dec8d181b8e68308497ee080fa0a010

    SHA256

    a38ba4e1cc77e60331d411ff48b056a8a8cb4ea1baa7f87fdd2f221a70537035

    SHA512

    039d0d43b6475e8e8afc8be7826e97e2daad96dad1fb585a5b53c343348a22be759a49c82a7c2fe5db3558e9cd43f592faa4856d1c9ac17264ad07950885f189

  • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.HK.XML
    Filesize

    806B

    MD5

    aefb6e81ae688499b95dfd2ea52f8988

    SHA1

    1ac5d52f4d645a1e0286c95fca9b61f09a9f7a78

    SHA256

    a94dfa596feede8959aa72bcce3dae3dbe3bbb40c6c3a08cddc4fa3e0e079781

    SHA512

    e3fec973df53ac9deeadb79e20f8cad02158b5cee064ffa956d20be9f0ede924391ec9dc622a8a3db307bf225546e7299b549d9b30500003e176741a449337d0

  • C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bianlian
    Filesize

    5KB

    MD5

    4b6517cb6d8bedfd0e84da2011a91c61

    SHA1

    3f902250a78145e5b9ff6053531094a298fbe5ac

    SHA256

    0dff1188b39e14ac6ceafe38a5428ae84a3ca28837fd7273f198c1ae11b556c4

    SHA512

    19df2d0df8796f38cac9f9a36b396cd905897e4f5843ac81f21669e299c11d7f9723b9aa5d2f0e6398d16b1546939a37123db6935f8a414dad60c409d6e78faa

  • C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT
    Filesize

    3KB

    MD5

    0378fda0eefe503e4c17884860e17337

    SHA1

    8af732647d2f4c8959e38bc2779a90fbd7c0ee01

    SHA256

    ef021815a9475f7ab569cd1d3bb01a6b15845444665572baeeb7ba3cc998561e

    SHA512

    75961aaa5d67a440eda5db85b9e53a76fe3a834c508014ac031a9bed311134a82219c61604561a149e34e4aabf05c9699f6e3471f8cc9c6120b281fa13b666f6

  • C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE
    Filesize

    41B

    MD5

    c244267698c11f12859ca4a1cb1a9800

    SHA1

    29de00f912f72afbd8adda0219f1277ec29052cb

    SHA256

    5f00db21f74b5e6a4acdcce38b1fa0f81db6dd62bacb125dc632f0f75751478b

    SHA512

    3c7d009dead52d5336b864247388b4ce478d7cb5aa542d9e055dbc00917c3b6aa9fbd51f04b40ea7bbf11fa9c74e4ceb3ed70de3df3ac14d28651057057b7dad

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties
    Filesize

    3KB

    MD5

    d3d8637d50e23e015f9394aa033b1d7c

    SHA1

    d966b84175c17655eebeb35f23927d01c56415c5

    SHA256

    a0ace7bad00c974808973d286cdfef78125470cc05174b77a4e042ecc7ba9528

    SHA512

    fba3ef374ed8efa3d964170c169e93ba7886fb4bd9362d1e202197e8e57b5f2928f7e11e022fef5bc99f729b8073ce832e1414f208aed9ed96a2c8be7a4e7fbb

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET
    Filesize

    1KB

    MD5

    a0e3f7ba79f179362a715de6b3f28152

    SHA1

    186a9ed8c65ae4594e5b510c84d287ae2d41c4f6

    SHA256

    01e6e5852daf75dc5fcc5e3f332aa6974b7e2f8498bae5a1f4774e5afdbd5793

    SHA512

    28dced3d6f28f832a1589de5c111e4c8b294ae11caf84103b410f4e82a6188f452f02eb71ab50cd3ab0ee4441bbd3713cb046351474a8f4c3efdd937093176e0

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST
    Filesize

    27B

    MD5

    210c522dca9567983a73de173d546207

    SHA1

    39884e4998110ea806cf65e26e5da5def3c04fc0

    SHA256

    a78d62e5c5c8bfc3f1f47d706f950e0007485dd7f541c7614e8c4ae46d1f785a

    SHA512

    5873879bd27e67fbcea8946a482302e4047dc9f54bf8608c9b34fe6e96c05c0e2768b2b654f9f3a11d86bfc701bdfc7b5883fd26ae666d5ce6eefa01794eba9d

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT
    Filesize

    27B

    MD5

    b6b999dfb633597fa784bfd24a683410

    SHA1

    68170e063ad8194f579267f1257cb86e33d9fe13

    SHA256

    362e0f3ccea64e3d4a442cacab92f8dc490af8b5086a5a8819df58fc7a68928c

    SHA512

    216b9000edeb4ae82f73980c5d1f318f4dad6f5be8bd4a515654d0742e3f6ecb3dd6d8facb65a8b2fd3b091503bb8d22fe325864febc7ea1a45946e5bb6ca94d

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+2
    Filesize

    27B

    MD5

    b9c962dcd13376047cf0c18a402fcabd

    SHA1

    00937407d9af4639b1ec3ceb8ca8a83d32e71e85

    SHA256

    50c8f0deca81c6ee7eb840234aba5facc4837b24e256ccd6def27170b24ee0ca

    SHA512

    d2724c94f2284cc1818bd3098cb7bf4522969132b856a04122c1895913e43d0676969d273e50e23666346c618249612ae27d28c2cdd04cb5383afbb97db599db

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4
    Filesize

    27B

    MD5

    080fad2a5b678282b0f9afe1719db426

    SHA1

    91a87e3cd848b4b77a5b3e72f2d090c4f4ab44c5

    SHA256

    5963e621eb57be44667a3e1c1fddd9b8e9b83dc46c16303319706da949288d14

    SHA512

    2df1d2b5786a8290848140c49e63d464838f9f12c3f52b233d7bdd1300730781f8ad81ca1317970354be3fe68b8ce421fbe06a3074a0ddf1f94fbc6fd379f25e

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6
    Filesize

    27B

    MD5

    3ddee78a46a50b04bf785d984cbb4a36

    SHA1

    d3f760304bfe916a2a3bb3d41779aad82315f53f

    SHA256

    cf06c2e58c8b7cf3a29caf17c91b0b169d52d3edcec7ad39253f6f07186e4b51

    SHA512

    3ee096df405d17638209328eb7a7d3499e8f32c7823bb0165e769f42944b73ad4417b769ec7886210ea887454837666ea8d68704c6dd19f24ce7e09cf68bec7d

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8
    Filesize

    27B

    MD5

    8f76e17cffb88076e27af6705fc1c93b

    SHA1

    4cccff1a9fab46140ec21d922d5d71da47271489

    SHA256

    00d9d837a70304a9a1ce63ce1b962c1aa461705606e5aeeb28444a86328aa1b3

    SHA512

    dd613519bba3b7e3a7c6828b693981a955efcf681fefb1c0703f13ca2f984798586711981cb986ef5ce9abe4517c59c76b9f9c61f89d65e335d95460948c3b51

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9
    Filesize

    27B

    MD5

    e9646c4e3933567dafa285694a328ea0

    SHA1

    4e0aa082c15773783139cf3d02c5b9ee9bf50d02

    SHA256

    a658182a6ee8bcc17c8a1bf0df955e9dd6b991df6fb62668b46a174dca445ae3

    SHA512

    28f700e3fc10fa2ad69eb1518c0d082e312363ad1e37a5be4a85d6ca1570ed80e9d146ad2de16f44f1325028f594f8d54a6611369b9f2dc315a31370407ce3d7

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST
    Filesize

    27B

    MD5

    50e671a3def8c8da6da77b405d03cc44

    SHA1

    8b9a6e6e3ad5e0ba0d953e953cf386320e68cf11

    SHA256

    a3ed3b797f11c1b4cbadad66be02da01798def0981483073ba6fcfe710c42bb9

    SHA512

    2307e27780d24782c09fb051b8a4341991c98a56d351f757c77bdf6dd3abfc4efc0b1729504628c77e5225b546819b43fc8459b1900e960f61f04aa548dddc6a

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Christmas
    Filesize

    27B

    MD5

    9c63c3110cc5c35a6e4e5b1a0305ffd9

    SHA1

    1dc2a7afae6a1a6cd431f3a335f639974719b9b7

    SHA256

    9648cff05965cd5b2f98e57c499d3c4f723a86ae10b4e9c01bdbf640bfac8524

    SHA512

    c9b1cf2d1d88db7ee9eb2ae061712baf294dcb0517d7f5fe37c1a5e2be79470166e4336e2e006b2c3423da4f7057eae56d2d1c239ae30c729ff358e30f63c6eb

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST
    Filesize

    27B

    MD5

    ecc8ad934638ba14191d09c53245f65d

    SHA1

    278822b5dff566971da8e582387b4cf4457c43b4

    SHA256

    e2ada26b501f1c6908931dbab9cdd3185060b7b02af8985210292943ed21b19e

    SHA512

    06114e630c23d925b86a85b00b0723a60b50b7b4d4c72da81dadef962e0a68cc8817cf70e3220cba25a7d2d6624e7c03323f31a27a68d228c825b92d52ee1f38

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Port_Moresby
    Filesize

    27B

    MD5

    6505d03881a5c0777ab255016e25db34

    SHA1

    ed899a38883b51603b77c4f81eca92c557b3b814

    SHA256

    300234bad81cafa5620bdd46eba85583c281c41cde09ad88b2f9742ba1898bbd

    SHA512

    89a94843fa34a545278beafc021c649a197082c21ffb1468fc200e12db3d0c5aedcb8a26c453f8f5cf86dd3be888f047cd596b715a13233436b680033cd6d060

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf
    Filesize

    57B

    MD5

    1e15a5c5d59829c5de486f09d43861fa

    SHA1

    4972d7a37a7d9f05e3a7600b7d311cba01820914

    SHA256

    96659773185b902f4c4a23f77581d44502ae88dc65155849d7c332a76c934b8f

    SHA512

    9b914c2cb63e5398e95ae2f49790a578cb3a3dbaf56eda0b8a3a63c92f409b84c349ba1fbdd3549dadb966cf433fdee38c0ac678b1463771cd2a7910e01742f6

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA
    Filesize

    7KB

    MD5

    be5e6407ff19345fe724dc01aeac78c3

    SHA1

    8e99efeed0b249916f045cbcdaf0e58256d87b8c

    SHA256

    75714519dce9aab1e282f840e8623036a6c036949f482744c6d3861ee36e0e16

    SHA512

    ef7c8f3fc88ebf6d640ddf676c35676426ec921470b2d766384f7ed63dfe0813a6f7f0e987aa2a22c90eedade13c38cb601d74850d06ddb2a1d9e91238699e5d

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA
    Filesize

    7KB

    MD5

    1d84f9814504f760d7a7ebdc9dbeebd7

    SHA1

    03478521ecefb8f0b7a422366f6c6a3dc122e303

    SHA256

    f9a220eeda942c3b7423d506a5a91a3f2a0c1ecb962e6392cb444519e92bfbe7

    SHA512

    5bef71f18ae08bbafcc957acb873ccc1ffa7fc26b35bf44355d7399af470825114a2f68b3b4fdb27d7e486e2aa536a7fb891d5f114c78601e2ebcd401d78933c

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF
    Filesize

    133B

    MD5

    4a62b79d21f37ce66bed364aa1f91d4b

    SHA1

    4775194a08bb8d24c88d1473f430aeff6f49108c

    SHA256

    e75f75d7a46c73601af7594a4fe904bf5422cc37629f9b1ce8257b0152358a73

    SHA512

    8e2ebac127ce6ad5dc65b114732183e537ea6c5a51d9d513677ac7ae463a16c57c735908a372462c786f810c7cfbd0719083cc4ae9eebd1a0382dbcbf1550dc1

  • C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    153B

    MD5

    51cf73927e1330ab33a90fd16a8877c6

    SHA1

    019f6ff1cf9bde7c6754d872d676df9bdc900e04

    SHA256

    47d842af9fc97c6184b59dd8eefc62a590936f550725d415dedc4fa70874310c

    SHA512

    6328c27d5bb24534fa7bb33597703c6d46a71dec5b4cf3241c900a39c9f34f0dc8dd8e9156313d18e8e08ea126418a075e71547e8aeaf94ee1c89014e6d6789e

  • C:\Program Files\VideoLAN\VLC\locale\eu\LC_MESSAGES\vlc.mo
    Filesize

    607KB

    MD5

    80bea4526be83a7c510f0c6250035fd5

    SHA1

    4e3271f611f4c2906f3970e3288e263a4ceab4bc

    SHA256

    651825969eb6c02dbff324aa93456096f65f87edcb63185061b4d23118362071

    SHA512

    91769ee3005acec9ff541347174360cceab9b09f09cd1361d42fdc22abdcdc075c0580c05d59b123c774dd14fe41a95a0bdcd482c1d8b2a994018593e8f3495c

  • C:\Program Files\VideoLAN\VLC\locale\mai\LC_MESSAGES\vlc.mo
    Filesize

    783KB

    MD5

    b4a6769da8217bd3a1365a9bc37a80f1

    SHA1

    c6b6648e4ffefa8dcdb2ee2c67325c015d879c20

    SHA256

    e9caa6286e9fcfcd8d6ddcadeff833d49e645272cfd62a60044c30a02e4aedc3

    SHA512

    eef451f39e9e17f79a06d43095953331221045f8c3f2193263f550d724664a1b338a1fb168d628fda1f84703fa3053bdf85501106c7d075e886477e8cc35ed10

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\MANIFEST-000002
    Filesize

    50B

    MD5

    14d4efec49eced566eb562d7de0845bb

    SHA1

    15ad6879331199ee8e65890d2eee51f4c933eba1

    SHA256

    1dab878d5b1aca566b88323f829d1657988497d55ae2c3cd93ab0522f4c19515

    SHA512

    9e92e32eaea952bee815240b931032957e73b896eeaf131532e962f2514c4df3664f0f5953aacdba6020f206a9ee3fb04a7141ca7b0bb3f9d0980bc673d80642