Analysis

  • max time kernel
    30s
  • max time network
    35s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    29-06-2023 16:09

General

  • Target

    3a2f6e614ff030804aa18cb03.exe

  • Size

    2.2MB

  • MD5

    e625ef18487a37a71b489d39c65a343a

  • SHA1

    2a158d21141564af81b4877bdfe622a152449272

  • SHA256

    3a2f6e614ff030804aa18cb03fcc3bc357f6226786efb4a734cbe2a3a1984b6f

  • SHA512

    991c4c13fb52c1befb8c0dbb9641efa9ab745267e99e9cd8cff5f09d25f82203673babc34bd7d6bcd7a64afbed0bfa309df1423cf09624003010a37e906176e4

  • SSDEEP

    49152:rEpkLwm3ZUOrb/TEvO90d7HjmAFd4A64nsfJY9vvI5ECEgCGt2Oy2ay+z1:Sm3ZqCEaje

Malware Config

Extracted

Path

C:\PerfLogs\Admin\Look at this instruction.txt

Ransom Note
Your network systems were attacked and encrypted. Contact us in order to restore your data. Don't make any changes in your file structure: touch no files, don't try to recover by yourself, that may lead to it's complete loss. To contact us you have to download "tox" messenger: https://qtox.github.io/ Add user with the following ID to get your instructions: A4B3B0845DA242A64BF17E0DB4278EDF85855739667D3E2AE8B89D5439015F07E81D12D767FC Alternative way: [email protected] Your ID: KARB4VvXbq You should know that we have been downloading data from your network for a significant time before the attack: financial, client, business, post, technical and personal files. In 10 days - it will be posted at our site http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion / http://bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion with links send to your clients, partners, competitors and news agencies, that will lead to a negative impact on your company: potential financial, business and reputational loses. ---!!!---
URLs

https://qtox.github.io/

http://bianlianlbc5an4kgnay3opdemgcryg2kpfcbgczopmm3dnbz3uaunad.onion

http://bianlivemqbawcco4cx4a672k2fip3guyxudzurfqvdszafam3ofqgqd.onion

Signatures

  • BianLian Ransomware

    Ransomware targeting critical infrastructure sectors since June 2022.

  • Renames multiple (7720) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Modifies extensions of user files 5 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops desktop.ini file(s) 42 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe
    "C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe"
    1⤵
    • Modifies extensions of user files
    • Drops desktop.ini file(s)
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Windows\system32\cmd.exe
      cmd /c del C:\Users\Admin\AppData\Local\Temp\3a2f6e614ff030804aa18cb03.exe
      2⤵
      • Deletes itself
      PID:2920

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-1437583205-2177757337-340526699-1000\desktop.ini
    Filesize

    129B

    MD5

    733f0e276869599d8f8fa02e83cef549

    SHA1

    4cf1e1259b7bf57fb66056c7c42a99c802f2c1f4

    SHA256

    3422b15799710170487bd6bb8cb6dafe864c17bdff1f855c0de4b4b60b30f86f

    SHA512

    236c309d4b3484ba0b61ee77c4a76ec9e183b7ff61c0ec7a6a95771463c83d5b32d48e6ac9387a3793c9a9c1df5eb07f562dc0deab9ed4889827f37936f1ceac

  • C:\PerfLogs\Admin\Look at this instruction.txt
    Filesize

    1KB

    MD5

    eb2edd7202757cb7b8a8a302be8fd64b

    SHA1

    c86c459e94a28527d37fa889eeef268c7438accc

    SHA256

    5a2fe19742cb5066fba0e226dfb06f86f128a6c0314f3f19ad992dc8525069d1

    SHA512

    cee826b228cc27ac0c0d9e2a1a39146b6309dcce2e79404cc4be0088da1b8a81501ed71ef3f36a328387ab5d0d255d171f7b97e6384c850ea6b95f93339e3ae2

  • C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML
    Filesize

    582KB

    MD5

    5dda6717e6953febfb70ab8135d52c4d

    SHA1

    fdb78eb981f5f5d4b4bbe203f378e599ec6c795d

    SHA256

    fd565e11ff476e281175f04f75d02792f8f47b2a25453b7f7d5d55e73d9082aa

    SHA512

    c60ebd1c44991103f2eb828a9882c3600dacfba0f463cc8809e486dab060c73a7608ce49cf4e1a1e1e5f60c1c8475c0250c221396233611def123999ba24aa5d

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_K_COL.HXK
    Filesize

    113B

    MD5

    4c1fb5107ac6da0c9b1ac679bb13a545

    SHA1

    d93deb539fdd1d60d9e567431206acfda20274b6

    SHA256

    edd819d6d6c112f443cb0544e3478b609a64af9dd4a94ef9544ee7ca73d8a843

    SHA512

    bd9320bd5a7d8e58bbee298d5f4f754d40f5e87f2c169f24d997969637360feaacaa157f559da8c86dc0bd4b758960119563cd2dff0f75f2ec7f0bbb32107f3e

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK
    Filesize

    114B

    MD5

    a41efeb5c16200f993713605c142cc5b

    SHA1

    640124cea394914ae6bb5109f20b63c7aad62a98

    SHA256

    f91dac0fb6a49b5585f57090a5d4bdf738f60420544562fa02eeeb20767f9245

    SHA512

    71a6e8aa915c1e20bfe569b3f014e5b41e5e50e5a7bf667999e8f3b9365c47447991896d6fd7ccb114de8e7f52bdfc09c13d48bbc395109136a404354a461a7a

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SoftBlue\TAB_OFF.GIF
    Filesize

    341B

    MD5

    984f2c36c4b95b44fed50235222c7536

    SHA1

    3dc7dabae8ac9b510601065b066ce58a1ec5b747

    SHA256

    ac7672bdf11c1bde54223e599672a66f7351f34376536448a53606f0d902a94d

    SHA512

    b6a781e6ac802908ec3de6fa8f03f46d0820a75febc38569d081ebce0563011fcf20bc782e1eed716b5446df8a2e214f037fb531daa9de304b012b0a9d87cecb

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\TAB_ON.GIF
    Filesize

    222B

    MD5

    87806198469613684897eb5e42f622d0

    SHA1

    57c0dd4afc07ead40ae8e1acc1f7ee589ca055ee

    SHA256

    5279ea99924d9a07ce5764bea785e781734b2c967d6d118ab177ff6dd8f5e978

    SHA512

    05078c20dbe96c85ef51b8e4b1ab761b0d7af23be96391bc3ff6c2bed024158592a20fa1e8322f2218c8b82799539c1368b0d8c6cd946c6fbbafe9611f5a850e

  • C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL
    Filesize

    239KB

    MD5

    e1ceefbdcc0387664b4f1c682ff26cb4

    SHA1

    33fa78530ae6fca17f18db905b21d86d860a5ebe

    SHA256

    9ac6281034c250064f21ba921a1e69996bbda6ae9a675c4565cdfc0c6c0b7a88

    SHA512

    33a6c5227e219f5a968137952baeb3cb54f3dd90f296637cef7fa64dbdb58acd45e050eff6ccfb80b66dffe4e8eeb8cc663270a799eeb67f2b5a202f4ea00a07

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
    Filesize

    185B

    MD5

    5f179c0c1c4f60415180ac7b25e1224c

    SHA1

    aec2372236c40764966c8f30f804951a229dd472

    SHA256

    bf19555ae9e4eefd370bfc792baf220978110537e5a40d896092ac68ec9e1cff

    SHA512

    3ee51d72685c89d68f5e55de05feebb0a05675a557e44acfe478b5ab6e47ccb4c5d1b49622bfdfa49df9f6ee8021610c265f456c7f56487c0d9c0d8aa39b4cc3

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BrightYellow\HEADER.GIF
    Filesize

    367B

    MD5

    7eb6f9e96518cb864e1eb253bc4fe51d

    SHA1

    230dfea843860aed4201ca76b2c885d29b2104db

    SHA256

    7d4cc981bd55456ec0989228f8c80e6aca0bdf6126cfbfe52cb1c4386b1771ba

    SHA512

    7d94c3d6dc169ebd960623a28adeb9baecdfde0bc7d2eb1966188bb1a2231aa513dbb627101691e4729f9db91de5946f3a931af99d0c3858bbfe3979d0d89480

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
    Filesize

    496B

    MD5

    999e236b9dc155e7fe9090a713b13254

    SHA1

    8f3ca62145e4d72fcca0000ba335573fbae12704

    SHA256

    4a469e41be5b5c482453cfc14cb83b67fd2072f4c42c6d910abdd1b2b61371e6

    SHA512

    e6a2bef9bab3ffc9947360f2d44005a903d45e7effd5d510c848fa16aba42a6bd1549c9d8d7abe64d1d14a0fd8943cf6daab809669fdddf4b996e91a7bf7f86c

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
    Filesize

    1KB

    MD5

    c21bf37265fe7e0174744b8649dd139f

    SHA1

    d41f9119f2d42bffcfacdaccbd057a5905e347ff

    SHA256

    589b1e6be24ebffcd7d46ef5d93a25fd4607ae134be47cd3293450f04cf1c2f2

    SHA512

    6e02f09615454495ac54723a5b85f0253623ed8eeb7988ec23c246c3c77a32e905c8ccf22d2a3de40b7b8e7f76d16fbc22959389939a0d048ffda71637eb27ba

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_OFF.GIF
    Filesize

    462B

    MD5

    48413ca2254d2a3401a77d5a6fd0b4cd

    SHA1

    d046842bbb8b65d9a400437a3e918b34db3e9f90

    SHA256

    8730160dee3256a37d7e5fc2e3ae467d569ebaf41aed892885d344ea5daca8bf

    SHA512

    25a5e8a459bfd38451b3faa1c6715502184e2c96a68583362ac90d00a257bf7d351b174b9ac5a422932bce098ecb154981a5b8800e17283fdccb94a37b1d0556

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Lime\TAB_ON.GIF
    Filesize

    267B

    MD5

    cf270664094bdbb18246ffc240a858b6

    SHA1

    1a404668befcf336e51d74245dbfed0a274bfe13

    SHA256

    1d1e8aba663fd4eadde1798a5f6ed4e4462bbf332ba2de40546f65de94a0e237

    SHA512

    722a872584bb43d96756a56b2b65b428613cb6cdc736ca7086a83e98829459beb7cc993b3684710d5c70a14e856dce7cd22277b3e6819f65d536b1a9ceeb260f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HEADER.GIF
    Filesize

    2KB

    MD5

    4ef5fcef213a99c6636cd9c6d6429185

    SHA1

    a769b375a76d247a6ea68c90cc824773ed450382

    SHA256

    2bac33394cc422dee8d175dab2822166eb4ce2b9f8024f406055645899d2fff4

    SHA512

    d25a12a6b307469ee0730b821fd061c6480e2d276da45f4bc1f23e5db5015d66bb30d27906586a92f5206d62fa6257a657850b7add99a770b4ddb4973a6664c7

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_OFF.GIF
    Filesize

    364B

    MD5

    167049fb74a65349c1527eabc041f664

    SHA1

    f196f4308813e13f69d501a47018b91eb90def42

    SHA256

    294b8de8d9550af46530e7a1ab30b10d71dfc6e56199f844d8321c133bb5b936

    SHA512

    9fb7fff2932950677bd466981626e7c0c46a99cc6eb221aa8aa6f3f6544be32f899b4efd213a3088935c8a608d1a07ef1bfcf8da8c8aa88c14830d76ba3b9644

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Slate\TAB_ON.GIF
    Filesize

    364B

    MD5

    5efc5e05b1420870c6a560fffb055a37

    SHA1

    581a4f57c76722b1ab52fcd4b58d6104c8c0995f

    SHA256

    9f7a5ca7e07a081ddb9f9ba70cf853c98fd62fa21ba3f7abb3421165d03b2811

    SHA512

    0612a6c1dfd7de886cac67062dbdf89c99e80b37c047f1fae6ac3c90f20247c53740cca087bb59054b8fb05009bef1b313acfca246e196321a4ee3c9e7c230b2

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SoftBlue\background.gif
    Filesize

    6KB

    MD5

    9e6f7179f95ab0232302d2c6d9c6ac5a

    SHA1

    2e42dd3a396bb9050ec97dee59e5626c0c56701b

    SHA256

    5d74979ef3e0b8bed73fb37f7e460df54edb40896d7ac3273be2e782676b963d

    SHA512

    edfb5f7a90a89c9bf5137beb7b2ed97df5b0c04f062260a3b8996513625e6a38c144d7c61f2462bc2f4b1390e64998ac315bdad8cd0362acbbedc08a52435edb

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\header.gif
    Filesize

    26KB

    MD5

    7e07dc5d5c2eb85c14a62841ac8e61e6

    SHA1

    c587f25a5f670f5559d59069340fde8229df3967

    SHA256

    3269d76436a9cc069dde108c6216b789fa4ccc0b582641ceab26e9b3d0492a09

    SHA512

    fed4b27252df0d7ab4abbc4b704608b178b2b9853086b4a748e8c4a1a86cc1a36cef06ad1eb6296a81d2d36603d9f86037449a6400f6a2cccc880ed09ae83a2a

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\BG_ADOBE.GIF
    Filesize

    24KB

    MD5

    4587ece052df9116a45da16b867c0c22

    SHA1

    f5b3f6303c8e0537ab1c4165f9dbd220f74d8445

    SHA256

    7efc6a03990097eae9bce64f4b8c8ab0e7e16efbb540a6dd33189f848910576a

    SHA512

    aeb9c9e15eda2432a0d3cc171a32e6acdb5dabb4c8184a1baf5efdecb03a697c9848bed1953af16e57af8a0f0e8f4347ca681147e5858f3e60aba448ebc359c0

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
    Filesize

    255B

    MD5

    f342b73eff09077c3463e22d22f27e58

    SHA1

    659907a553c0fa025451d336987904143e8049bc

    SHA256

    52b6d2639ec1bc3e9b5710e7b5d69e30106b1a671b14ff74cd1c9380d98fcf55

    SHA512

    c3c57db9bfb8ba9eb5ee795889dbfd81ee1f42909ffbedb069d2ed83155fcc9f7bc7f8c5611270ade4c3b8d8a18ba554ae45938865855d5cb9bd07554d79c194

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
    Filesize

    323B

    MD5

    baad1418c2d34c41200f4e7c367842bc

    SHA1

    40b44842f27cf4fcf7c05ad838923fcc51d2841f

    SHA256

    8c6dc1a29888a1059ae4c4cc28a941c7b34ef26272dd3113d1cd76d4c8668621

    SHA512

    2541dda9bc67a4c3f772fc97ab1a0ec8d6e7512b6a5a90ae411caa2ab475237ea33db5706525c6de8b4295f3726d2c84328e9fc5bee4111c47e45c2d007054a0

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
    Filesize

    148B

    MD5

    7800f300264af20f6274cbf934586ad8

    SHA1

    0259bfb1c600a09a3e6245847b8f319f18524312

    SHA256

    98d8a1ee9b68623092e8e187097cff99b4794623e2caf3c6065cd2d184da2e6c

    SHA512

    283a6c237be9a3b1bf4afc8b0c9a98741aa1943755fabb048de9de90404228d2c916dd2e58390cf339e449cf1c3c55f22c64e233fb0677418fedca2816ad6578

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
    Filesize

    440B

    MD5

    7b7f57747542d8fe84147ed4d1594600

    SHA1

    2458b1c67a677836d490e053e995ca66ab31e8c4

    SHA256

    81d613bb67b5fdb0c3201f3d3149425c3a93889e0d62c82187503dd3ce8cef7e

    SHA512

    49a15c4c5e5bbb116c5d2032d631ae46071800cab986f11f438186037ba94ab0b51520fe5c537ccdb0ad54067f42fb91203904e7fd7873ef234ca8548306a096

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF
    Filesize

    3KB

    MD5

    f87ddeb5051690dbfe451b57c72cad2d

    SHA1

    c663b018e83348a56b41334e3a3ac3668280d640

    SHA256

    2ec3a66380bc62eca025daf94df1d8e845dfaf9b4eaac0673d3637e3f17660c6

    SHA512

    46e87c7ffad9b085a0faa06a603f8627be1c5d2992cb60e41fd0f0b8568e110ebe780f94ca1a8245b759e02ebf17cd8e9e79cdd22af33126422ea2139657cea8

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF
    Filesize

    462B

    MD5

    6158c13710e15eb6156c66aabfe6668d

    SHA1

    12f84da6d6116e7265b358e9ce07aee0bc9f5e8f

    SHA256

    3774610c5e8aab16b08cee2fea981287af26604683621dd8f482a847fa64e9ea

    SHA512

    2e80960d5c69797de60bb0f486835aec5347543f63529fbc05ba7d2e9f2fe76feb2c142df451ff89a025a3f75b47734e1ce61394bf4cbffe9cf9f5cd4bbc908b

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF
    Filesize

    264B

    MD5

    a7b1bf5f7a9fde463dd288d73cc1c743

    SHA1

    d27e3a0e6f63fbd3622766487a2e4164aaaa7e07

    SHA256

    2d6dc0234c2647d43fd15ace296c2eefecbc4c2b76e2ab32e1e5510387678713

    SHA512

    d19308fcfe070508ac0ee684a8c3265f5e35edd672004dfd2cba9caa92eb93b7399bfb247513f2dfe5f45a8e19863356e3995861d972c5006a501a7bf73dd2db

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
    Filesize

    233B

    MD5

    be137797ce11f8f767e7eafdc3ef98bc

    SHA1

    ec7ef88aaef1f6bc54f768f2092f9753276054b4

    SHA256

    303a4c189d8576a8c5d0b76d7c74f2cef12830d02ccefa4e1de7c6a02e0c3315

    SHA512

    5b60918b0f227096a3313222b3e15020e22a81f99ebd190fc0272a7d460ca65620605ffa6bc802cedcf621361e6efd79c72b928b7d84987e2879e142bc396f9f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
    Filesize

    428B

    MD5

    e776c01c0de08e3321e3d5470d7cb47b

    SHA1

    4b80ada7298c3a54fe77c7b8a7af778447c6a356

    SHA256

    0bc4eeebcd4a23a006643ae915e25e993cfccd867b7535075660e8d273367e33

    SHA512

    fb2c936fa10bf91cc9e9a66dcfc5e6f09389d81a7c1dc6546f694f1f502e6815c2706ff163ed12b11c3dfbbd3be23a9fd053d0515a26d1bd24167338622121f6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
    Filesize

    815B

    MD5

    9c38561ae12ad5d137b8fc9eab45d190

    SHA1

    0cb9bfa4b03345a8f263765ca2c5c38848f44223

    SHA256

    72a1a156391bdbab67dc8eda49e54136e09999f0442276b5347a2013d597ef8b

    SHA512

    09e4d516b98833df423cb192bad1fb1c65c1e35312d6044562e2d821af3f6108ac52ae375a18accb40464c61f3fd55661ac52834bbece499edcce395ea6df32f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
    Filesize

    870B

    MD5

    ef7efe323aca4da1e9125d1dcba1e6ce

    SHA1

    ea5059515bb216fa5d6b3df5d4aac6eee8b40dcb

    SHA256

    7a0747fdba8e637246846e4e0a7a577086aef221817aff3c4a25080442877bd3

    SHA512

    aa2341a4f1340d4e89f70baa167415c9ac23b62ad6ee413575aae6abd373d14c9b985c6b3d49f49ff45ad46f05ce853e2d0798d833cf734d4d349be04d56c2aa

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Casual.gif
    Filesize

    5KB

    MD5

    4bdc81e13fdffd35ac6ee7cfd24cdf1f

    SHA1

    13661f907fe71f1149b7e4db48d4458481e43745

    SHA256

    0d96d2febe009d6271bc4e73a6731addef275a5aae993e7c8525a89a690f396f

    SHA512

    a5c1fb6877e732e0101c2ef79cb42af31d6e55800f3473cc561f5bdce0d5eee6638c57e8ce3971ec5e7f8f038973837ec69dc398d9571d249ace2ddd1ba5a956

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Country.gif
    Filesize

    31KB

    MD5

    917d8eb1be9aaa0731a0efd68685aafb

    SHA1

    ac7152d1e5d0b78efb6a435bbd5a4be48a5cb72c

    SHA256

    80d8f66ee632d09f78fe2a955fe09b5311ab33712038499eac14ad2beccad9cb

    SHA512

    5e033cd27f8d2e718e542ba9aeab18272f20acb38b2451334f30e491b997bffd895cf0e37bfe6d28bebdd00c8b1a8d83680448f24b7345bc524abb3f1abe356d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Earthy.gif
    Filesize

    4KB

    MD5

    f4dd9a85ce82fa3cb2afe36ffc14aa2d

    SHA1

    bb43faae2dcc3a52ebf76145e8dd303263a5ad65

    SHA256

    e9484b93ffb8106c025b64e05e978214bccc8151ae3160daec32698ffbdd3087

    SHA512

    1d95f63ba9421732f6f3bda2b5a6795c1aa596039d1428244468146b75922dbad8833c09199c5c66852d3cc018bbf5f4e82212a3afa1817f221e391aca5847f1

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_GreenTea.gif
    Filesize

    21KB

    MD5

    0a34aeda5c3fd34dfa0418eb9d7eda6c

    SHA1

    b85fd90307e651b4e4a63e05af725100f39dcab3

    SHA256

    c234b881a8e66b0e4751f1468ee46c87aa9e2b4a206de3ef55af5e67e9faab73

    SHA512

    2859b51072509a8be63b888e9b07a97a53562ddb3b0a32c950d6dbe98d86ca563469adee8b7e7cc3c6d830c4afb67b0fe11f675a04ee23564a3d149076fad897

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Groove.gif
    Filesize

    106B

    MD5

    00193c95cdb13f832a13deb6095bc7fb

    SHA1

    4fdc92c94104ede94a2a91f6248af20102d51c9a

    SHA256

    84955c78bd26293789f9a0c8fe075b5ba8277b7190fc19e7c9d89059800114d3

    SHA512

    5ee43cac68d904247d450c24b5a9a6788ee150c74901dbd23c75a9bbd7152cd413beb4e10809262ca7554aad3dc9bc7fa4fde14062b8e21b83f80cf22976758d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_LightSpirit.gif
    Filesize

    8KB

    MD5

    efec55f4fb789e98982f264390ea416d

    SHA1

    6fb85646bfb76a3200b6d1342bd44a2f26912922

    SHA256

    5c144312459e41c5f2813b95eae95a1aa272bacc7b975c30aabeae2aeebcb13c

    SHA512

    d4c848a229ea4d1ab287935117af5dfa560f3528583e71e9c2c2c61a4e0ef9550dc133fdd9a0ca5475a6fb25b7aa5dc264cc64af2058b853d2aa0199a6c9284b

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif
    Filesize

    15KB

    MD5

    7a80f5f8ba1423cfec0d222f89c98cef

    SHA1

    38d8262e4a9347cca9f5641540cb447c128385e0

    SHA256

    6b14667f1f9a22c3f9f6be8c112bcc57ab667b2328c75f1612f09cc372c75bfe

    SHA512

    9db4bb9635726c6db92f1d25cd7e0b31af7e0fc4bb2f9c1b483f46985816f7249337fd62b9a444b2f6fe59e9d4042ad3c0aa18a598e41a0b7053ea17d2438356

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_Premium.gif
    Filesize

    6KB

    MD5

    a40595fbff5e4240c374a42af59884b9

    SHA1

    0d84c854ec90030e8cf88e1be915a7a8da23454e

    SHA256

    c5edbcfe0f813ff23f7571d56a2dd80a3b577083e0a9fd7866c907a6c0860188

    SHA512

    740b25804364b70cfd88118c73bbdb20718ea7c16bff6c4962db02a9c70464b7d7915bcbfd0d9c214392de84e68216a29bb2d45174ea8085c3f2d1ec5e4ec712

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_SlateBlue.gif
    Filesize

    20KB

    MD5

    6f1718a621ba75ce567d7b2f2eec1c3e

    SHA1

    97eda255b0e2fc904151305d229361f93f4872a3

    SHA256

    33ba85684d56bfa5c8152884647503888a6d7373ec0e5eaf7c3018624100a1ed

    SHA512

    d8b6b6e08b69d68575bd8e1f13076657559291b6a47bb77320a55af682da5798301af7060fd8f099eb0ea5a78b7f896dd9bb3026213504efaf50aaa18992f4ee

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_TexturedBlue.gif
    Filesize

    6KB

    MD5

    89611fab4165e043a7fe1d1928f234b0

    SHA1

    46ecee8762ba8e6614b0e978c9c2e704fc7b021d

    SHA256

    b3e562104184c21399d8d45ace865c65588e26b1d81aa59e59869f3c5cbb165f

    SHA512

    aa0bfbc0a1a2fa17dbddc448b5c5d8a4169e5510e9fc050bfe226e1187d93a9dac8dce424daab4426d32fbf48588aa0ec28e69903a740c0a19e53c86c41bbd6e

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif
    Filesize

    15KB

    MD5

    529756343cfc661eaca52279e03f9244

    SHA1

    8468b738d001849e734c96b1c423968e9b2ee14d

    SHA256

    c6312ef265b47fa55c85cb24d71023601116f47bf957b1ca9e117b078c02d382

    SHA512

    b913828a8faf25f9a73fab74fe4be2132f233527b83299df9f9484858310b67f3afd09ad42179a2aefd9fbe2f6367266283c5ebcfdad73856e663a196b990748

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
    Filesize

    890B

    MD5

    3bc75095ecf71658db63758744ed04af

    SHA1

    f6fbafc5b04b11e800c65bf6bd5248238f8cad26

    SHA256

    14c8ac38fb602068c3a6f33d6665e055748132b2eaa0fa41bc2e13479c48cecb

    SHA512

    fd033d1910dd533ed75e7e1b324b1695f80fc3fb3f467f273b3a179195c027a979d8749650d6394f40cb3bec786a74da6b3b0ab4f65cde59ed805f5b71eac3d5

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
    Filesize

    852B

    MD5

    30f7aff34c1eb6edca4e22f3c625e3cb

    SHA1

    0ab64c45ea201c3c313f420d1087bee29ccc62f9

    SHA256

    ee3428178b13686e66be0294bc7410dbfcbc279830150c7a870368c69db88ceb

    SHA512

    21701f65e20e27f499f04297e3bf49b5a9f4d98988537b33e9fb2cd8bdae74490152e93c7db0cfe9ff7c5bf4ac85239e61ca8c0937c53e4b0a60ed4f8bfbcb94

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
    Filesize

    860B

    MD5

    26e14d9d08c4a5f2d4b54da14a073aab

    SHA1

    9c868ee957b8f49310089a78d27cdbeb18dd6108

    SHA256

    b4f53262c86b5cf234ae4dd084a4c2753576664333510ada1b4da79f02354eb4

    SHA512

    7e10f409e01194e70f0bf2f8af63017bf33cffb118e0f870b3cb6aadae287b6f6a5fdbb2508d20c291107f3a0b1b0578181992d54e6fd5d9abeaf16001d0b312

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF
    Filesize

    580B

    MD5

    03471958582dc8ce49710d5342bc9644

    SHA1

    bc37b12780807ef5fe0032d31d434367c9316183

    SHA256

    fabb22d957cab00cc65ab6257442d9dcc927d6fc3ac873b85db0f73eeb40e84d

    SHA512

    09204f80caf1760c9c0c1db8d63d20d049964cd180547d8adf6d3148520b8b07bdd57d597790222e0d73e8b1022d745c823b61fa6aa7caa4413540126e3563fe

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
    Filesize

    899B

    MD5

    94333d687036d72ef934d9504f0023d7

    SHA1

    4fbdfe1ddd81c5382ea095ef7a55dcb22cfb380a

    SHA256

    2c4442a2b0938b676f48fcdc725f1d30e41eda37adfdd3ca3109e75612787631

    SHA512

    8a7284f68982784318b3eb76c711eafcca16a16775d680e83cc827d2569b4485296258267fb6f605f6ce9810e544ce89057905a9ae26f6c240dad7baf3070d8c

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF
    Filesize

    625B

    MD5

    7d315387ecdcea8225ca28bc87cb8309

    SHA1

    d825059c0d6795acd4bf449da5d21ade15598ce2

    SHA256

    8df1ce206f2cf1d4718c4bd7224514dfc248574e7d9f5306f3d8013289a968dc

    SHA512

    9a58cbc7b5af9037aa34872cd706be16a3d58abdf76a868f72d783ed417dabd6d1f30c96d5bc6b047fb97800856e6b5cfec7e155df7fa15a81d31c501b6a16c7

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF
    Filesize

    873B

    MD5

    fa1a62c3df69d5eed05106fb1a3ed9a9

    SHA1

    ccf19d4932b974c4231f0675ff70db595c4c342b

    SHA256

    3a6a7f7891439644a99769c5b3a7d847fd0477c813f2b092361c952592b420fe

    SHA512

    727aa75b3b8c6ff6d303db1ab407f678950d5fb2a4ff30856dbb160c91493fed90802bdb4640f61143362a142e276daab927bca25a6d4e304669204a6e69fed7

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
    Filesize

    5KB

    MD5

    78dae597aeff0264497331dbb8a8d619

    SHA1

    d85f0943805ae042ec629086bd07a8e139bdd753

    SHA256

    7ece9af59b1287cfe8ce000b7be0cff3854ced32fef6a1f4d2c02d47dc30aad0

    SHA512

    219dbc052da4e3b1c0b3c7a2af357fe4b0782c7a328bfb5dcac7902fbffb0f05c530e86ffe37d594681bcf97667f60cae4487b4f56f2e960b718eb8af54f1c12

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
    Filesize

    1KB

    MD5

    5540cab11a7df8a13ea83aa04e623031

    SHA1

    b605f3c4ca7659e34f6fa68606e96a792c6917bb

    SHA256

    a1e457e22cde5b427e325f95346947ea07a15fbdebe5e066b8e981289d1a4179

    SHA512

    2033467b94250e523f91373f343e47a4e403539c0ac9e4c525b546717f2d397823392d56554860510ba4214c0ad21ace74e23b39f6067f48c60136530e0aab49

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
    Filesize

    615B

    MD5

    2314e9d06354828f764395364dde390c

    SHA1

    529cd7b129cf2e76366cb30f5da59b673a11a794

    SHA256

    640675ff0430bf33c643baf7f560bb847646e077e465c9767cf33e326e61d462

    SHA512

    2c539a8e111432728aef9402a18025cc50b2ab14b4e8869a3fb9436fa2aa6f04f7cccf834de69b3db9d071454afb97aaf60729631a186c283651b07a035cfed7

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\attention.gif
    Filesize

    2KB

    MD5

    880052b7a6d3093552bac2b2a82eb3a6

    SHA1

    c1a7c68a7931c25d4afe7c24a409e25151f2d176

    SHA256

    b4f9078c67c71252cae8fd160657523a85d447d9245c2a3d97d47784b63839f3

    SHA512

    f9a5378790c61675e53802cacbc09f7f768f850820e5f081d5bb1da563ba16ad92cc9488cf79451aa3e4cd113fb86e108cc513d01d3a6816c94e3cecb47c1055

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
    Filesize

    848B

    MD5

    c8433fd1722459e171bf391b9d0f80e4

    SHA1

    2bf9b8eb3660ea45b16c4e6fd9cca1bcfda4d760

    SHA256

    feb599b99aedbe2dfbc05a9739c548ba11799c6e6f16aa52b9264bdb082ad15f

    SHA512

    303cf112f0c8e9de7750bc795eac4efdfe46a1e8688cff13802af801d4832bca422873e312962d7a3dfa4022157f3263f4b6caba542fa1dbde687324a3cf6f90

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
    Filesize

    847B

    MD5

    2eb7d30ff487390d028033509d684e80

    SHA1

    ddc51fd0e0eab838c527a530e96fa28bbdc56cba

    SHA256

    50bb0f983d08a59e0ebd7f8ae876b52c57030507febf199bb21bd1c6709a6a50

    SHA512

    4badad4bef342f1ab38654892eeec2ce42e2dfa3fe33ef60720332285b1607ef6ab4707d56ecb4c47e4915c47075c7e28a1cc4f72f0f9e973138782e5531bc53

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
    Filesize

    869B

    MD5

    e2e01bd9d2f7400e00a969ec71a20623

    SHA1

    77eaf1ef9414d8a8d2b568fe1e53f0a9a573ac45

    SHA256

    a9468ae4f7f295bed05f4d045526150476f155e456b1a1a17aec86a4aa83c5dc

    SHA512

    4f74783355884ac7fd192a3e7f0173ea4ce9eef29ff77c2b1f0b37fb5486b696772c83004f10346c4d35d3a39cc08077d78e65b5d4fbffb8e3a5125e8f1f031e

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
    Filesize

    847B

    MD5

    24aae7533b8e72cda1225bef461a770d

    SHA1

    e1e293a9ae5eb03b8a26c19bb7f112f6e5a8e950

    SHA256

    51cfebdb1cfc484edbb2b6fadd9bd2cf83ebd4317b92e2a10d37a4430baa5cfc

    SHA512

    7ba4fe36c78371a4228f025516eb03c0ba36bd46e5c6f5f1c45caaf32188e0b11ef95ad62aa609f9b144864f234ad242157b7c56d85efe5e96c94e59d43e8561

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
    Filesize

    863B

    MD5

    22b2d6880d5aca8cf6dee7afe676aad6

    SHA1

    84f93a4cd39f486f307fcbc88c380a511aef1a18

    SHA256

    580feb93fcd1ce6e7ef74ea2b9b2736e8826a147d697c5f3df657261970e7309

    SHA512

    2ee50906568cab48a09c88c812cb2664a768f32cb78cc86f7532a0b9d823730bb4fba3c78e26c27769329e9184c252c9056345e106b6fde2054d41a8b447e1a0

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
    Filesize

    861B

    MD5

    540e9d8ffc628b66ee27ba4e32816b94

    SHA1

    74cefae72b0076acf50da30ce73f15038315bc7b

    SHA256

    ec144df58c7bc0faa49fdd358a8f582e5718c794525be7a215cd18be6d584518

    SHA512

    94c3dcf393c30a5f813468cc85f7fa62ee726fe93298ac60f364cde2b29c83af1a09f7ee985c6387995771fb5c031c5c784be3131ef67911cc0d74134c238afe

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
    Filesize

    850B

    MD5

    0ed050390a506033f82f9b6089f22801

    SHA1

    2ee355b8a72d52288857e916d5263839300ec9b6

    SHA256

    1f9049f45a2dc74ffb35fdde0c33b297d1e885e7d5b3b66ac22a619b1d631a09

    SHA512

    9244e2c2a9f671ab03aebad9bb56dc7207192a50ead069bc7f3f5f035827cb77f89a715b9ba373bb6d8193d1de1071bdb3dd6a3acbd511c7ac7d6d6e8e5f9a25

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
    Filesize

    883B

    MD5

    6936969e277f18c902fc1fb916581f6f

    SHA1

    244421290d67cb3848f0b5569080de17683a0812

    SHA256

    fed92cbe2a1a2b24d3fd5a47fabe90ee8cd766d5d8817830555976aef295a608

    SHA512

    bba72342e924fe8780d5eae8bcd01e3ee1b175798dde43c5ec2054fe23e98375f0b5a2f197702f446240a78dda95850f0a7975b1f21f38f6a63ca3b839c718ca

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrow.jpg
    Filesize

    2KB

    MD5

    e394fc2ef7cb5be5096e4e332cf1ed98

    SHA1

    84a11b67b0ddfe3cb83ee83ae291bddf44f3f6e1

    SHA256

    8e4d32eb2a79e52a3643e3fd38b01659da155f03fc31d8fc424dec1b4b7c9f3f

    SHA512

    48731a9c11a2da7b07e74c28f435455126f9d6b98e2db7cc538101bc149b1a1de58258d0d761fe4292de9a895ad4fa3752a7bea1f6feb29119fc30a8eff7303d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\AddToViewArrowMask.bmp
    Filesize

    2KB

    MD5

    9d10db020b720c6786eec341a2141d57

    SHA1

    f47c071dd1aae4f0cedc079e3ce1855993d3a0a0

    SHA256

    9e1a0985da6644730cb4da7f0b71cc6b5d8284adea402f4ea59d0c66ef179283

    SHA512

    64376daf842a2597863f4e5a0d5de2da01eef12315264ab15639f4d9d7122e85121e4f33b2fbc79d8190e1211b9c86f401c8438f9a3f3f8528f5096a22656739

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FORM.ICO
    Filesize

    318B

    MD5

    859893be44e8db95c4dc5012e1cb4e86

    SHA1

    fba0ef005163aca91525a35927c04882223c5c71

    SHA256

    30ed5ab67b10429d680f5e5b1818c36d540edf8e426a972d1d99e8b047d94614

    SHA512

    14e1dd699daac9ab50b92ba91961d03ebca51ba233a4a001fc112932574d37e92268660b2a664362e702547bd4442f1f46a2f01ddbf87afab2cebfa30dc9d9c6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FormToolImages.jpg
    Filesize

    6KB

    MD5

    0b44847ff20c0423e326c1e926216a25

    SHA1

    32fa0d050862266567d2e7f77b047d48f97f619a

    SHA256

    216ac5f0508e3f1448a6225547abe63e89c91cc3f17346a9b8e7758d8bc08be1

    SHA512

    9afc62730ac88c0763db015cb389345017a471c8390f11ba053803da2d6e898612855cb4c98fa17ff04b84fbd3114e2e2be8b0a5a47b794137f81c11e541d203

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.ICO
    Filesize

    318B

    MD5

    3871c2f608a0c9e903b50f045ddfdebb

    SHA1

    bec53b0c8f28c6f391aa4ad5dada8131d5eef5e1

    SHA256

    1a33a446caf68b8230c367ebd515ac053f02a1dfed2402e0d645658d1fde3afc

    SHA512

    90be89e1c56f2fa7577cf634baefaed0f33d1079bf88f741c217cba4e1283ef0d78520f04f5a66022aa677bdc92750a95a14ab9be347461747b1b137b3bbb89b

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\ViewHeaderPreview.jpg
    Filesize

    3KB

    MD5

    1f774018b28f8931af9b6ebed1578e33

    SHA1

    0843fbde310f25520f6aaf0426fc13c4b11e1b10

    SHA256

    60b7b7bd15ea2133c3a9d079e78b31248641b57d427951841f0455f2408e0827

    SHA512

    44c161732adde3113dd6376956d3402da459fa9030383c365945a5d9958c2d0fa0f2b636d0ab603f505430a94ae4fc41b30dad2d8f79ecee56e7c8387ba54590

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif
    Filesize

    19KB

    MD5

    30a542569bbb7f04b41cb7ce845a61ec

    SHA1

    eeeffd089aa82f9a326b97ad83f7d0649ff80633

    SHA256

    1c45994c85f5e5aff1d88e378a1a4a345652e39132b5b5c8bf05636adcc05510

    SHA512

    32f0be6a2a218fd623c2cb0e63628d79d08e6452090c1372679dcae628871bab7b32e62fc4f6767bcb039798a65e4cf18a982791d42482130b07ca335c1ac878

  • C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml
    Filesize

    247KB

    MD5

    7935c2cd6de21a38cae8abf8d0394ecc

    SHA1

    2b3cb68384584bb3b6b39bf8de5ba8ec41188cff

    SHA256

    e1a074b388c372f4211d1b35cf57dad8d9d9d5098ba42ad4bdd0a4c52a8176f1

    SHA512

    5ed2d98f9535d69eb32ce10113b30a52107b9d53f866702aecb0633cb710ef33e5746cd0e449fc55e3e61f5d7792019d28fd74e4e7583b11a57f19ac1cd058e9

  • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML
    Filesize

    807B

    MD5

    cb0d96cb9b8dabd9cf7f9b60fe02582b

    SHA1

    fc436792f572bf97e61a3b1d31fe0610ee2dcd20

    SHA256

    6664430fa082e2cc88253438d9fdece6a1baba8980d3d20851176901022285a2

    SHA512

    d25d4b9ae0966e9609c2e1d4721fd4e589c196988d80f090323dd9e5e242e5b01317918a1d3504ee44fb798d4c6ac90ccf4629e093ba690f500d3dab413b762e

  • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.MX.XML
    Filesize

    806B

    MD5

    b549a4910a0395848f0bcdde322ce828

    SHA1

    e0bccf0dd7495640ca5d33e0ae01d4ec8520c108

    SHA256

    e63b6d02b9e6701832c2327b6dac4ff3b3b186465c8568ff491964cd2e4d7e0c

    SHA512

    256ed53f846cd42f4683a696a6f5ef55a087a2c5b2ae2c68cb471e1a2f88f5f0eb9661f1cd5084560fa3d8cf718e99ce687ddfdb0d181a3b2c4d4c328610d354

  • C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl
    Filesize

    5KB

    MD5

    7a77ac5b6bcc15bd02f318f2826b1bbf

    SHA1

    cd520fc8acd13013055ff780d885a7d5fc0cc692

    SHA256

    6983cb70a5cfa0f8f5ab729bb688edee78e583e3a0ca39cebdefa8d4a98507a6

    SHA512

    c7c0440b5a933d8eeacbe17efefefc20861c1a5216b7c6724bbab82ca6c321d2eefe97a56fe4767506a2894644ff7d02aeb1db73f6038e21c380f85431684950

  • C:\Program Files\Java\jdk1.7.0_80\jre\COPYRIGHT
    Filesize

    3KB

    MD5

    796b6ccc73833355d4420bd56aede607

    SHA1

    d9627190bc5e9a4e4d1357717d6fcd45282b4441

    SHA256

    fe08a91e3f412509a6550008e8b7a816c6728bfb7fd4268899cfa0a1ecea9721

    SHA512

    bbf2e77cd39cab8c6725924e55ec9bac1656d8413cbdf8475665a9ad71423ec5018ee128b1cc14e70b8899a80a899f32476f545bc81b231ca89c38bbf76b5d67

  • C:\Program Files\Java\jdk1.7.0_80\jre\LICENSE
    Filesize

    41B

    MD5

    629d093032c020360364e47422d02daf

    SHA1

    0708d01df4a6f2e977e5ae57044037ba1cfa39de

    SHA256

    fbc2d77c65f6898d2a985bbfe5d2f668655c38edaf6fdb2d4d9094493b77cebf

    SHA512

    a03b5bcbcb5d471160a0c9f01191febb350f4376d0065d76612536d7e9b20c56ddbd9f15743717561c2a2198a7bfe0e4966aca8b5b6c9ab9238e983121987750

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_zh_HK.properties
    Filesize

    3KB

    MD5

    a62ac7c3de031389036b60881ec7a993

    SHA1

    2c4023ce7ea77a1ce495eec1b1c9c78c9df29dfe

    SHA256

    a0882f56c0059bfd419aaa085bc497abb905d55c5e44d34729fbb788a5423e4c

    SHA512

    95a2b5bbc629fad03f40599ddd79a46765775430a0859aa3f07bb81f8c6485434292925bdae9eff303a43b240e7a5cdfbef17d03c0e993c7ade40de17fe81159

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\South_Georgia
    Filesize

    27B

    MD5

    47f9a6cd1f37c0e813572f22302418cb

    SHA1

    eca0b375e427d45a6b7df5551d335c1515305fe5

    SHA256

    da312b408d7240d351f67794728012b5820a31cd93cb7b451b42d572b5fb2993

    SHA512

    64a29aabe9995961a973bcb85efdbaa0e75676763f61cee392e276844e8bac86ab6d6bc76c20169b18680382ce14d68e3e2db983f4d4ea8bccb7c21ef42923e1

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4
    Filesize

    27B

    MD5

    7401ba4d1db8874cf8e651c1cc213a29

    SHA1

    ec22501940b25e6a54fab8adc1cb18d6979646bb

    SHA256

    d8122d20197f855b14920f6464ba823e9c56b26ac4e0fca2c5702e8541ee52c0

    SHA512

    15292b0d7295c66129989a4c6f53360b9be0566811a7e3d1ae6da8688bd7efd826671a7ed89acf5a8bb8d8456683d39e4f10b1007c17efb47af2e505ae7c40ef

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+6
    Filesize

    27B

    MD5

    4f275d63906d0ca518fde6a365e0d2e1

    SHA1

    66fb593dab2344e02c191d7805ce09506406326c

    SHA256

    b7c881e9a1f8f30056c3fe4cbcab1155244e7c4b60fb13c0255416c06c88a79c

    SHA512

    b6b6b3ebe5bd026dd008c41a8d3deb00ccb47aa568bcc009c10e12a2764d3d51f1577bf07fd3cbb1d5aef46d8f9c89ce50ae44b64cc73e7fc310dec3efa3348e

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+8
    Filesize

    27B

    MD5

    bbbdbccce1a0187b4e6361b5772f6e96

    SHA1

    cb0d66311502d00585cbe9fa075e5eb5aadfb2c5

    SHA256

    c62a189a6bf88c05391a45800fb5a99c7b90988ef190568a791d6b156e2520f5

    SHA512

    18a30afd75ebcee0c30246fad0cd1bf998a4b95e383e5e3298c35279f2b85ff24013b405681609bccb2e4d9ad95896429cdebc82190585534537b41c5f4d02af

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+9
    Filesize

    27B

    MD5

    b5c9e46f023d70c23ef59f7a36f5fe64

    SHA1

    67a44c9048b23eded937c70e58209860e3b81a16

    SHA256

    880a0b3c86ff5617258c55f2e582a29ef5da9cdd42a8855d96ff118d617f9761

    SHA512

    182da81d9385337d5bf8313f2a8e8c22c9bef93382a7ccc5feaf43250fff4907386a1e81cfe56b800f1acf5fc3bf600449525513b1a95a3a10a7b2df817c5add

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-10
    Filesize

    27B

    MD5

    8dbedd16c13f5946dbccb555c9454181

    SHA1

    fdc566749107d353e01a78aff97c246e58e6fab4

    SHA256

    335683b4dc22edf184926c730e128e275abe1f8fa8e74779f3a2dcf0773749af

    SHA512

    6212159be796067b6d7875fab51cb6ad16a05f82ab58ca07af8ad88c6bb9bfc291da4eb2e26b35e961aed0865cd313faa032a1f4d5a42ea13cdcbc78623f7b48

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7
    Filesize

    27B

    MD5

    722cf5675da0b11e818a1d0b8dbd6c82

    SHA1

    fa5a4ae2ad9e843e80dd6f121f4dd1bda6226404

    SHA256

    5cc0c123e942e35ba6a5c62656a07323729ade38026fac257c989b5093d260a2

    SHA512

    a3349d6d7a6e6c8fd387495cc42de6fccb4cb321d96cc9cccfe80fbd28c2294f0f58d705627f1055564e6e1afe67e45c3ff883b180f63ddf13b9dae49c1192b6

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET
    Filesize

    1KB

    MD5

    1d3ce5947190507eaad8dae8c559f20e

    SHA1

    a55a480195487c98dfdc8c34a4c6fa71f72af179

    SHA256

    3e3bd32bcdaaa1402b0990d1c4bdf8603e7f9845fd3ad9e5e9af1cc94574f1ce

    SHA512

    9a42e750cdd5dca2071ddf5ff9120e95053da2698daa6dc5c42a9c12d4ecbfbc5888a4c855721bb42645cf063d6125e47b70aa09701b5952676d2a97a82aeb58

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\ECLIPSE_.RSA
    Filesize

    7KB

    MD5

    27d68a73cdba4e2f696e0fea72478e28

    SHA1

    039a74476d1d0354e434922b318a85948f748fe5

    SHA256

    16349369903b231432c4357efe991341235cee52f7fc2b013f403e0229f61ea4

    SHA512

    0c787641d9f2747f935d106e92f3aaba3ff1cf1a09384d633e331f06b3c5c0dca3a4abcf2a6e7266c9678a7c7581ffd2a5d17ba8b801fa906cb453d1b6b7c320

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\ECLIPSE_.RSA
    Filesize

    7KB

    MD5

    0458a75f1993c21f7150cde7416f0615

    SHA1

    63e6959c3cc65e0269f153d8333ebd85f97113c5

    SHA256

    7af5cc5810131255c5bf305ddef02ad473f38782cb29136816e29445e965628c

    SHA512

    18e430435637540ccdf6a57049832b6bb1fe37b920cea9fe983f372fd8cf5f3aeb62177e3b4ab9cb50e7648e9cd671f9e15f7f0b9542141e627c41f737542fa7

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\eclipse.inf
    Filesize

    57B

    MD5

    225affc6be841e5c7aa88a18a3c2c58f

    SHA1

    9ca8788ccf0d3b8bff701282dd8d9d884721d7c9

    SHA256

    356c12a0235491afa7e1ff3ca67b3a367fe37453663ab918ce36541c9a43c21f

    SHA512

    20e40328f3c4abe72aa2fa2132a0f1a2d523b41242087b8ac59ed517a42c5225bcd188f8df6445b72b3489155b5707f97b6d317b73758020d243ea32b5080580

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\MANIFEST.MF
    Filesize

    133B

    MD5

    bfaf1b3a80bb2b452e804b916c38d24f

    SHA1

    d0064a1908116839f9fd5af99916a39ef82a6865

    SHA256

    387f60e0c7361d72041f5036c35ab7a834a1412f81541fe347061b5b59643056

    SHA512

    e499d9a6a91040b4565b60964db8678949edb08b888b2f073269ec13188d69d22daaf8cb99571a1186662805d60c7fec65f89b660e7220f6987fdf4ef2024779

  • C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkNoDrop32x32.gif
    Filesize

    153B

    MD5

    d18d20179fd3912d1be349e75c798887

    SHA1

    08aca6986bf35e275a43a47e953348f5e53fd3b3

    SHA256

    7b63a7bfe4a75f6de72f4e0c541ec8f25ce81e3cbe9dcd0ef3ff2ffafe041453

    SHA512

    a6b9fcdbb9e9e9be07c0f89621dfdc70c6980c155f5654965b72eb7d8245d3d0b981122c26202c5208a10805ab31cb10ed87bbc9869410f61641bfea58ed6530

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT
    Filesize

    27B

    MD5

    2f6052214794472ed58b471c279fcfc8

    SHA1

    36c1da66a7ec72111f440f60ee41fd3856353969

    SHA256

    adf6fc567aa6933ad62872ec5ac6e709af8062539459f4bfc30455ed8b4fee4b

    SHA512

    f901e34bad6a7baa5829e12f2a1e565bb4d2dbf759e616639edc8e9f7de768bf98ca01246cc99a421fb012cf8c2a1fa03f108097c8aa963fa368e7b55b4f9673

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+10
    Filesize

    27B

    MD5

    a3784c56d359068dcb338a83e4b1a9df

    SHA1

    a25576e703c77142c2c43c4857de4abf7b7692ee

    SHA256

    a1afb2ca42c16eadb2ef00ca338420f80a112ee3f55c3173c8cbe06c5441c2b8

    SHA512

    42ce1145f7625a11c834a5098f7e6eb156fab46b00a4b9c2205c2ae938c6dad90a7ccf143295051235494a07d6d7ce26d626ae1194ad490b51f7b90c82dbe9ec

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+5
    Filesize

    27B

    MD5

    4a125be6490d7bebb1b1bcdc6c2fca4d

    SHA1

    a31de6e04d0f973e159f1bb4650cb7dc80f55441

    SHA256

    34a97eb363da3b628cbd780071d2cd5719dd372b95fa8a5934f3000e8a25060c

    SHA512

    fb2b29ab97ec444238c160c836288c8063361eeffb415231f6738fc6ffbc45a4261bc002868472b16579ba7307c705d490cf89d8d37558622197d2c946365d9f

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+7
    Filesize

    27B

    MD5

    48d42d14c91de6f4b2473c3e6eedce31

    SHA1

    8a488a39a4455f6e8838ba931e3e6081117a3ee6

    SHA256

    d011c1e434c987ccdd2e3e14653143ab0b87a404127270a97fc13a9a1f88cb24

    SHA512

    091a3578f03d91f75db0ed9c7319c2b679e49041a17534bfafcfed43c8cc5e939ce214962eae8223068f95cab00c94889395288a221e261fa75019b93f5a3324

  • C:\Program Files\VideoLAN\VLC\locale\ks_IN\LC_MESSAGES\vlc.mo
    Filesize

    663KB

    MD5

    fc33d0e213d4952a143b68c22f940158

    SHA1

    10981075fe8a7de0b33a9114427232bf9dbd617f

    SHA256

    d19bb270e0612d47658b5e26f1962455232d3961ca4471af3f14041492c8fc14

    SHA512

    c3d47fd793d849bf849ebc598781faa6c9ebe0076a425a0f43db1e7285f9b0818c31077b035a171b7b1de337540caed5e818345eff21099934e83b7f42b841e8

  • C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo
    Filesize

    604KB

    MD5

    4515e969390ddd10b76a308bb167b5b0

    SHA1

    9935db7cd4487a53e6313309935682040b7ad123

    SHA256

    f7474efb4ecd6f22415939c070b80679167e5d660ae9ba832b5ec0c1eb70e703

    SHA512

    1e285207c35849433a24189e497eee1cf419b5b848607fb45950bf7e1dac62feeae09193132735eaefcddfc7ae909565f221203c9f1026bf6970992c507eb0e6

  • C:\ProgramData\Microsoft\MF\Pending.GRL.bianlian
    Filesize

    14KB

    MD5

    88be4bbae28749af4a1e2c9cf440da0e

    SHA1

    b2cd233fb5d6404e9fa4773fb212e0a0da36ca84

    SHA256

    3707ebec8a9a9693ae65cea0fdbd8a17d4523f7fcf8864f37027fda96082fe1d

    SHA512

    4782e27d2ad86edbe5bc1cf5a61af81cfa362d08fbfd481b2e455ccf650289e624724245bd919872e5260fdbd4f3322204840c36e7f77229e87c6c3e23d8d160

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\MANIFEST-000002
    Filesize

    50B

    MD5

    f5b854f091406db62644930ed9417d0a

    SHA1

    ae7f69d7941fc44944bb7b2aec10f9079f701845

    SHA256

    45224139a7d96482fa2342830fc0fec579622b29a173958ee67b4d5bd9918f83

    SHA512

    187cf47247457e5515e2a78c7db6ac1c9d0eb944265f627c23ccb472189e34c5daba28c2380b5f82a49762f36e7ad7deea4dd1b3dd74ee3ea774f9c1ba505bfa