asyncrat | 4f9494cf61c3c10656a3f8eed5798ab604c815c34472c42c18b49656fb71d73e

Analysis

max time kernel
254s
max time network
255s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 12:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

WaveInstaller.exe
Size

249KB
MD5

b8a6cc953ead13dabfef6854bfe65139
SHA1

51aaa0723d5d22c74c15f625e12662bf4aa2cfb7
SHA256

4f9494cf61c3c10656a3f8eed5798ab604c815c34472c42c18b49656fb71d73e
SHA512

9e7078acb76dd33b0811990b03b7e576eaedb75f13ba38f7c6457956d8c211231e86b02a6280e8dfa858b175003061867b0938e96efc7f9a2627d023983b3257
SSDEEP

3072:G1NvtzbxNdSuLAsNeDF5nI0PGIj9lua/Obw0hFv2PCWpIdNrY:GTFzbPdt0sNOBTunbw0/5Wpi

Score

10^/10

asyncrat default ransomware rat spyware stealer

Malware Config

Extracted

Family

asyncrat

Version

1.0.7

Botnet

Default

127.0.0.1:8848

https://ooo.fluffiflower.xyz/:8848

ooo.fluffiflower.xyz:8848

2.132.191.110:8848

0.0.0.0:8848

Mutex

DcRatMutex_qwqdanchun

Attributes

delay
1
install
true
install_file
Explorer.exe
install_folder
%AppData%

aes.plain

Signatures

AsyncRat
AsyncRAT is designed to remotely monitor and control other computers written in C#.
rat asyncrat

Async RAT payload 1 IoCs

rat

resource	yara_rule
behavioral1/files/0x000e000000016859-14.dat	family_asyncrat

Renames multiple (6066) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Executes dropped EXE 2 IoCs

pid	Process
2756	Explorer.exe
1672	DECRYPT.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02755U.BMP	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif	Explorer.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-waning-crescent_partly-cloudy.png	Explorer.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Vilnius	Explorer.exe
File created	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.htm	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\IPEDINTL.DLL	Explorer.exe
File created	C:\Program Files (x86)\Windows Photo Viewer\PhotoViewer.dll	Explorer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	Explorer.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Net.dll	Explorer.exe
File created	C:\Program Files\Internet Explorer\Timeline_is.dll	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-dialogs_ja.jar	Explorer.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\es\UIAutomationProvider.resources.dll	Explorer.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Web.Entity.Resources.dll	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR50B.GIF	Explorer.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mn.txt	Explorer.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotsdarkoverlay.png	Explorer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\vlc.mo	Explorer.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proofing.en-us\Proofing.XML	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21295_.GIF	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR20F.GIF	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsMacroTemplate.html	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\java_crw_demo.dll	Explorer.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\System.Data.Linq.dll	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-uisupport_ja.jar	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\OLKIRM.XML	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CST6CDT	Explorer.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\System.Printing.dll	Explorer.exe
File created	C:\Program Files\Windows Media Player\mpvis.DLL	Explorer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libvnc_plugin.dll	Explorer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\librawvideo_plugin.dll	Explorer.exe
File created	C:\Program Files\Windows Media Player\Media Renderer\avtransport.xml	Explorer.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0390072.JPG	Explorer.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\System.Core.dll	Explorer.exe
File opened for modification	C:\Program Files\Java\jre7\bin\installer.dll	Explorer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\access\libimem_plugin.dll	Explorer.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\divider-horizontal.png	Explorer.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-waxing-gibbous.png	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_ON.GIF	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL081.XML	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\epl-v10.html	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\MSOCFU.DLL	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02810J.JPG	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Urban.xml	Explorer.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.DataSetExtensions.Resources.dll	Explorer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_chroma\libi420_10_p010_plugin.dll	Explorer.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_right_hover.png	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar	Explorer.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeLinguistic.dll	Explorer.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png	Explorer.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\BIBUtils.dll	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\UserControl.zip	Explorer.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Cocos	Explorer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\liberase_plugin.dll	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\bg_FormsHomePageBlank.gif	Explorer.exe
File created	C:\Program Files\DVD Maker\WMM2CLIP.dll	Explorer.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_filter\libgradfun_plugin.dll	Explorer.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00154_.GIF	Explorer.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2876	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2512	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1988	WaveInstaller.exe
1988	WaveInstaller.exe
1988	WaveInstaller.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe
1672	DECRYPT.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2756	Explorer.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeDebugPrivilege	1988	WaveInstaller.exe
Token: SeDebugPrivilege	2756	Explorer.exe
Token: 33	2700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2700	AUDIODG.EXE
Token: 33	2700	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2700	AUDIODG.EXE
Token: SeBackupPrivilege	392	vssvc.exe
Token: SeRestorePrivilege	392	vssvc.exe
Token: SeAuditPrivilege	392	vssvc.exe
Token: SeDebugPrivilege	1672	DECRYPT.exe
Token: SeShutdownPrivilege	1816	shutdown.exe
Token: SeRemoteShutdownPrivilege	1816	shutdown.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 1988 wrote to memory of 2612	1988	WaveInstaller.exe	30
PID 1988 wrote to memory of 2612	1988	WaveInstaller.exe	30
PID 1988 wrote to memory of 2612	1988	WaveInstaller.exe	30
PID 1988 wrote to memory of 2892	1988	WaveInstaller.exe	32
PID 1988 wrote to memory of 2892	1988	WaveInstaller.exe	32
PID 1988 wrote to memory of 2892	1988	WaveInstaller.exe	32
PID 2612 wrote to memory of 2512	2612	cmd.exe	34
PID 2612 wrote to memory of 2512	2612	cmd.exe	34
PID 2612 wrote to memory of 2512	2612	cmd.exe	34
PID 2892 wrote to memory of 2876	2892	cmd.exe	35
PID 2892 wrote to memory of 2876	2892	cmd.exe	35
PID 2892 wrote to memory of 2876	2892	cmd.exe	35
PID 2892 wrote to memory of 2756	2892	cmd.exe	36
PID 2892 wrote to memory of 2756	2892	cmd.exe	36
PID 2892 wrote to memory of 2756	2892	cmd.exe	36
PID 2756 wrote to memory of 1364	2756	Explorer.exe	44
PID 2756 wrote to memory of 1364	2756	Explorer.exe	44
PID 2756 wrote to memory of 1364	2756	Explorer.exe	44
PID 2756 wrote to memory of 1672	2756	Explorer.exe	50
PID 2756 wrote to memory of 1672	2756	Explorer.exe	50
PID 2756 wrote to memory of 1672	2756	Explorer.exe	50
PID 2756 wrote to memory of 1760	2756	Explorer.exe	51
PID 2756 wrote to memory of 1760	2756	Explorer.exe	51
PID 2756 wrote to memory of 1760	2756	Explorer.exe	51
PID 1760 wrote to memory of 1816	1760	cmd.exe	53
PID 1760 wrote to memory of 1816	1760	cmd.exe	53
PID 1760 wrote to memory of 1816	1760	cmd.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe
"C:\Users\Admin\AppData\Local\Temp\WaveInstaller.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Explorer.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2612
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "Explorer" /tr '"C:\Users\Admin\AppData\Roaming\Explorer.exe"'
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2512
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp1FB1.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2892
- - C:\Windows\system32\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:2876
- - C:\Users\Admin\AppData\Roaming\Explorer.exe
    "C:\Users\Admin\AppData\Roaming\Explorer.exe"
    3⤵
    - Executes dropped EXE
    - Drops file in Program Files directory
    - Suspicious behavior: RenamesItself
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2756
  - - C:\Windows\system32\NOTEPAD.EXE
      "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\READ-ME-NOW.txt
      4⤵
      PID:1364
  - - C:\Users\Admin\Desktop\DECRYPT.exe
      "C:\Users\Admin\Desktop\DECRYPT.exe"
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1672
  - - C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c Shutdown /r /f /t 00
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1760
    - - C:\Windows\system32\shutdown.exe
        
        Shutdown /r /f /t 00
        5⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1816

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1888

C:\Windows\explorer.exe
"C:\Windows\explorer.exe"
1⤵
PID:1680

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x564
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2700

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:392

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2184

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML

Filesize
582KB

MD5
f8b535ca695c54544048a2285b70fd8b

SHA1
b96a827da801a0c0f26e2781ae5e17c2699a7b93

SHA256
77de049205409ace994a40f30bfa3d3c105e93f638b0905d131f5d1281c6f8cf

SHA512
10cf7b2641e3064bb1d503bbca71a963bfac296db09d53852d26938d451c91f1ce251c4f25b1b4413a7825763464cb8645ce4eb8415c59dffa428acc8ae51f28

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
352B

MD5
4c64447fe1635e43b24cef7e7514547d

SHA1
38eedfd299ae2110c9df007adb8026d49c0ed924

SHA256
0298d50325f1afa3da7087f75bde6b7aafce42c66e7b7000be0a1825b8dc27ad

SHA512
9a1127bcefec4a59d6fdb0d5184a6c7e0c1b6330bb7c8eb4cac9b96be91259a4d990f81e471f0ed31e73de7c6c29196668d8c457c7af68adf87100947132ee30

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
224B

MD5
f67d33dbd4f59d2bf8f676ffd8f1ed42

SHA1
72eef82ea7449ebba6251bf54264fae39e3690fd

SHA256
d22e81656c1fe9fea24d4439a751db8b7c449acb08887fb2ba62dd80b7746050

SHA512
b08df93c2ff1175884bd2df583310885e44f38fa2aff1f8ab24c4547b509c23ecda67074f9516d56778f1b31ab8e0bc6bacce395ece45f077c8bbcecb197b2ba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
59675d1148f444b6176e229050a4ae94

SHA1
a780d9678083bc0898d4b5dccf6f24d3999550d7

SHA256
ec5d28f01994364fe07f5be54a533a0f875728815e300c8d66f9605abaea86db

SHA512
fd70d665ad2578729a6fb18eb0c55bda10c4c8d55ee63578193682544d225d9d8bc158e25825485f56af7e69c39fb8f5184a127132122188498fc5df597fdb3b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
192B

MD5
7e1ca0685d295769c291c65bfa6bc4ee

SHA1
f28350acfa695d46c7f39325a64a3ab74405888e

SHA256
435fed35a6104e9542e594a158a5205d1757f6f2493f98be0d2d09ec6243ba40

SHA512
5efac8bf82d9a559b16535a14aa5c76011674ee9e8a180173882bccf545b029bd9b596ece618ed16ff1a25925851ce75a5307ccd2aecafcc9fc36ee9abecdcf3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
512B

MD5
30270d3bd6648e185ff0f2d12a2463b0

SHA1
a9327ab718d9f806504e650050308eadc58d6239

SHA256
8a41622f639f0952057be98680149fff5dc92cb62e1b16f51a35c3b9ff421f95

SHA512
36143a515e55b2ac007cb378072ec9b459efbed752df23cc5bb1674539a71f7585985f46980ba8d34c2fa1de6d074603dd8e3a0bde6fca81131808bebfa2db92

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
69e1aafdbd4ae785d0259e05aa312cf5

SHA1
4a086412f2e1af6f333146fd54fede4433a2c591

SHA256
36e847e279d3e7edbdb9d5c1182043a9689cdce84fbf51b14d0dcd63ba5cb6d7

SHA512
e181bcb0e5d0000845edbef031afeced706cc033270af0709008b74df8c3336307b9309904864e2115f7d537cca5bf8682766e7305b47a1cfad68201026f6961

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
c0af755136319c416822448796817da5

SHA1
9de4ed5c70ac9d88c37835b1345c1c9deb99ade9

SHA256
c40e912ca0fcdeef808efb8acce981919d9d7a591daa4e8cc998a235e8d1ed93

SHA512
ef79994040175327b656091919d7e4772a71ac12acd55726b0e402a29af0172e11eb221fa626d184e03632c5132281bf98cbc5357b02f40c241d35f33a163e1c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
5cd473b21174d764cdd2c610d2f30475

SHA1
f4d61fb3baa67e01cbb11323efc66ee7629e83e0

SHA256
4448598fbfd72dd096e84960420caf93e2cbf1e8613df67b94f50d5c8a7742e6

SHA512
bc963bc85b43827f3aa8242fe422de4ffa1a603f40f8e065c01258db8e8835b9d293c62658a0cf65a1f680e3969a891463c2fead4592d30c76a62e80c98e41c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
0d84b909184ca34f3bae83f4098cd879

SHA1
1db6a6327f387914975d71ca079ce50a20bc6e23

SHA256
9b6f9070bc38cdb0a1f814b9af8e0a95f48017f81da007b926f32da37e15147f

SHA512
b8efdf8d00528911d2a14b374b25dff5cb7cbd7ed5e2adc7c608e92d93dd9828360012500ed59746fe3644abf3a804f172d1515d0367690f0c77b0dea29d58fa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
9b59a9395d15260247ece253dc4da81a

SHA1
2cda837357f39730046095f091e3e1d23da5d0e8

SHA256
462a5c30e4f0663e8e8fc85f1b17622f7e969378c30c4e6feaa0ee2fcf84f74e

SHA512
1d3ec3dddf20a09143a6302ef20bcec2f0a2802a826610d600672db8e2277db727012ca23c3db1a58d6895154367ed4e72472eaa5f687fb78be7e197d49a2ba4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

Filesize
112B

MD5
082f2b8057799ae615af13ad7def03a7

SHA1
39770dae70bd49d57405e193c318aa71ce633000

SHA256
c3aa5c84b03e7750009e222312cb79b8c9a4e580eb83657745d1bce9b01610e0

SHA512
cd847793bc66e7133a987a9a4a405c39f2b3e69b80efdf3a5120745c3f272247626984d5bb9df8353812bffedda866996d27152dc0f743a25898aed1aec3a711

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
730b39750fe0a51cf738329e73aeeeac

SHA1
7d5e11278fcadc1b21b8b92a4d9b515f02b79556

SHA256
0983b9d978f457898e7239a604a38fe7524b457151cfe111ab9b4e4c7e9ed5b4

SHA512
cdd67485a486373f0f3751c84e4db0e9fcb2a44efd842fd984da2e7cc870d0359c92f0d5a81d26c46cce8b398f2ce88af62a8803e942bec0bc4a8ec7c5b4a93f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
ee00afa7feaa8d4db3e73e82282cbd80

SHA1
9d62bcdaf34e874e067d7bd19beee65267f57b4e

SHA256
a56a85b3bce1ed146ef7190e9b0422cae9fce1bc6b5f61520397d363ff4ec092

SHA512
a6f6846dadfcdb42cdcbab7add3b2c6e947740256bcf84d766919b2ff2019f7d7db051ff066dc56e88173a609bb454c07961d67f967ca0856029871ebb962758

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
f562a6d6b46edd00a472238faa4f0e1b

SHA1
857db366124207f64072f0368eaa2a487d2cac36

SHA256
957b35076570cac0667f080d87deaa78f044fddf71adc841b728212f254f47c3

SHA512
979b27ba1b25eb24ed578b0ff483e5a6ec8b5fd819d79b75527242b86eeec5c4033a7455e3e125e34f889f266a505858e9d6204b0e3c90fb9628d97a5378b5b7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
92bea54765298ed7d96a9389981f73c6

SHA1
1ed3e662407cce33f1a43665845e9a5e308454ae

SHA256
73824068f9ccc6d79a14bfb9bb1f7bc3b625e260502e2e94373e8c521f6cbc6d

SHA512
a80d41abaf563206cb63d0ed4457912e77bf078902d32bb3c6eae697ba5b19c8fe5f03a3dee7632bb17d3febdfcd640952121df649691036971feaa7adb2835d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
69f676abd41f0833feadb96fb73ff8a2

SHA1
c860e01e26ee6df031ddab765eca8ce1ff58aa5d

SHA256
c145c11c73db2cf059e20acfc22c46281d1c3172d6158a089e58f98d95b7f49e

SHA512
eda8ec30e996fce774af6cfcdfd584d49846bde53a096ea4fcfc6e2198e038505727d54cae16712f9f2e02c57200d94432d76a4ccf8372dbb56ca8d3f1e03e30

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
ea985ac661575c557b797060c8e29b51

SHA1
567e1b12fa37b9341544ebec236106ca835ad176

SHA256
d6adcfda0ea536f3f2ef21981825381cfb067a78748367e418cc78daec2e2188

SHA512
e705fea6acb696fbb16352fd97b468ed1b3ebd20b29ef4d12a45289304fd49692362f8466badabe66e921b18607ea93f84bc9ca5b3cb4c34ee2b38ec7517617f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
3fadbfce289109ec3f298df678cde627

SHA1
ca5b425cb29bbdf957e8cf115415142e2d508e63

SHA256
93d9ef1458f5d07658344884895a732af324659bc8e2f718ce5acb0186731556

SHA512
f43f2a2404b92b5939fc9130a184d932bdad1ad3476413ae293c1ae165391f0b787481e1ad6aa777770962b6af5c618587c35dfecb7bd6f4cec31ba1fae8c092

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
5b6b882079cc82d22490aca96d93ce58

SHA1
35353c4083478250137347ad7f5872bb4464ae79

SHA256
6a79f8481e17dc277483ce7dc46abd782d51a79b7d61cb58191857d860971e8b

SHA512
c8f94385faa9f07916ded37181daed46b2a252d089191f62fc2b88931dcbe944dbe17da7d5218289963890328a8735c7a3ffc44f4b5ea96bb119d2651cc43e58

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

Filesize
320B

MD5
75feb15f4b5c2c7db63466841a35982c

SHA1
31bba6a3bdf925e47934d8619fa49181f513ee02

SHA256
d59a8a9dc010d1864019be6fa4ad92078dd0fac3544df99500a507c6676b3751

SHA512
bc8e67427982e60169f0f09eed47777c580a8d16a0026347f400e79e0023c18b7ee23b4d46846b06a87bc462faabe6722e4bc9f73e2670d1c50463e3a4c0b3f3

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
7KB

MD5
ef2f9b0394477c189518fe97cbe2da83

SHA1
e5aed1f9c70cafe9665d5e4509bee89ab4952a1c

SHA256
052baf3ddc0ad457a60c8fff8f528b9b2970b06d96944a04a416faf33798ef37

SHA512
957ab963843f2097973bf044478b2880278ad508e68a01e1cd428a42a0acc5c2ba65d78437743401964ed03ac5aebe8266eb2db07b0ad96319b522e392f73ef9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
256B

MD5
70544a836ac3b55929828ac37cb77124

SHA1
0fcd29021138a086dc9b00eec860dab81b752f2d

SHA256
7160ac2b3542c352b1a39458f70402f30b367eaed99bb37ae24f75798a6468df

SHA512
afa3a0985b8febc70002164af37af3c75268d76b5f05468b797289c7a3516e2f5da62ab18b19ac49ac9519fcf4ba5c2d9e8ad31256e9fc980065870957492440

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
336B

MD5
9e7f09a3999ebe8232c26de6da754ce9

SHA1
08dc234d186f57a44a9bf63a42546d0a0f23ea92

SHA256
202beca3daf0d9603e28da0aa3897d5a7f09b8993331d8bc59b6d102b1873b73

SHA512
818422b9a65a93a862d2c5e2f6fd49c11db3361bcfff81fffc88872a0fffface532da50cd726078028be691b84aa61b5e4ef1ccd6c5d9d9e42a2f629c3385e1a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
368B

MD5
793d12ddade3a688c96bc39e591bed44

SHA1
7e093af1bdb7f3ae8caa56f5da2a8fb25061507f

SHA256
aff4a520f3c205b4a86a356d14a6b46e2d74234eced379c343d935281e93b877

SHA512
134d8ed2fc0e9053275c43bccd76d5d21bcdfb516c305a8474cc30a80f0bfa8b6d0d52502b29833296ff07c5c7b9dbad218dc5176a762312a8e3f4beb84a31a6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
160B

MD5
b43439cd252a0cccb0591d4c5ba9fc27

SHA1
dec5c1ef2cc8c3851f2d1a4b7c7a90da856476f6

SHA256
e679efbe1f64a42111707bf4315e249a49026f6146274f67f36c7bb65799fb79

SHA512
aa1c33febebcd11c7ef2d29306d25b0815f94cee9e594a037622955e73c366f9fc76723de52f9249215bc0f951d094c6eabd93e20514c65827fdb472e713f637

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
448B

MD5
a25fc42f95deaf66ea4e85d1c42d012d

SHA1
8b951ae10eecaa09f41a121fae043f4c180e0b5a

SHA256
9f13608429a471fea0afb502365c0bc1815031f8d08c5421180a6dd27f7f92ef

SHA512
c58a25db5050bde4381541020a5feb9893cd68fdd5c5b1a7456c2ecc2b1660b31f28218c72faead9b12f15fc157689e7faf2cb77143901718803e8a200e8912a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

Filesize
464B

MD5
18f70bae011b104710cdb507d2b738c1

SHA1
6409f1900cae93350eb56d514637715ff7c1aa4d

SHA256
df2cc0765087d1d4a7f12618bf49e3e144104cce7131ef59f0aa41f8454fffc9

SHA512
68b79c6335fd06153949c559c24260869f3e40b6152b2bd0a33566a775a63ccff4ce38317cb451de15861350bd958671b699e6469b0fe01e20e856fef636b0d2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
272B

MD5
fa5360954d799d71e14cea5749d628d0

SHA1
8bf6bdc3cf163e20b708efade03fa5f2431cd131

SHA256
985cc903d7fdce60d833a4f5d00e0e0c1123630cd3f46969b7fbb6fe71b12560

SHA512
581a1271539b623cd541b727bfb1c113b676e1ca12fd12e616039031e0cf3fd3f9f30368d298bae28d777e1eb60921074e2912f119d22657fb1eaacc17a5796d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
5ea61ce7cf80620739ebe48c492e4ce0

SHA1
a8dd6804260a178347b0adc81c44ab9a2d006622

SHA256
2f59e11f0b95e3914934538b54efec7cab2fb32df730957d7baf9f6470d385cf

SHA512
1b75243aa07c13a5442a1544ccdd9756ad9af60eda008fadadd78fd053fb09f612337aaac2c7858b60b4f4b72e6330c806113806f5db057d60879343bb8b1f86

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

Filesize
3KB

MD5
7b8bc3fae5da4251ac6236065036d832

SHA1
f78caef7fa9afe582edc89003e87fbc6c8107efd

SHA256
02c2b326c58b7aa286dbc2f69bfa7fa239ce912bdd0ecdb9edff660cf69d1c19

SHA512
41ea8ba3bd26c26c00057414b47a64ef46a8ec3d72253e7a3c114a4f3cf5485c0c5fcb6b7a0d9a885ea5621827b4b6dde5684cb068471e1d05e897fea01af6f5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

Filesize
464B

MD5
f22255b59daf68e0e30bb9083fcef475

SHA1
70f2964bd2fb32425d0c93e48ae80950f24e18dc

SHA256
3ef960802fe2ac06af98fc2257066a1d2b49b8e34a330686af914183de026668

SHA512
699ef60f34f3775bedb5c0b8bade4dc85f05f62c61ff60f6fe3925c1bd34c9a9511da48fdd2347256bebaf56f4b215bdcfc130d483b4d4787e8ef8bb6af23373

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

Filesize
272B

MD5
00383517a76414caf4db112e75fad6de

SHA1
6b35f1b5a29a66c13ea9d7f131a89eb74df480c9

SHA256
7d3a6dc41f8999139b3e5e3670d687ee618a1dd964e9e7cb6413ad75416ad754

SHA512
7763db87bec7f2cda22683397ff7df08cb28c916148af1a86941141abf984579b53bbbe4816ce57541549dc85605b26e53d41573bf46563e0ae24aa62c593fd9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
240B

MD5
6c28e8b8dd6a8251c8dd63f5b1039786

SHA1
6a73dd50661aa66ca583ee8cee6e2418e88230c5

SHA256
28068e3d71b62fefa3e9136feec370a408dad1e919f635bbae0090a06f55317a

SHA512
4c6bd01ea011f1e31328aa76f7c2bc08cbacf4c8084cc9729cf7d31a4c58eb806ffa7dcb14be7213dbdee2c8c1d2d1126593a21bca09ea9a9ed2389f8c6d870a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

Filesize
368B

MD5
a52f79c997fbcaaf2f26fbd7edaa9912

SHA1
17cb4e7bd9cbb93c028a693841dacf83358c885d

SHA256
484f0cb22c11e08b617be5984de0dfbdde047d669935613e66a91b6f07b93dab

SHA512
949890253a9972bf113888dd6e190b5d493f8a5359b9a5bfbedfe1fae0e6aa061f12b05b32da4f9c1c874c01574b59fde94009ca107200ff548b446b546a5843

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
368B

MD5
bb31c2e93e4c8038a47df54a8e79749d

SHA1
d86aa8194081c2ae0157cfcf0047751bd4e156dc

SHA256
43fb246b154dc9e77f3b811031ae0767bb849f3f866ecb36d614f99d28fa0354

SHA512
02e2391d8116ea384a926cec2e29e732d1c19a9f5d603b99f64d009358ebefa8fd0223d6938aa576b17df73d98d625c0527082de6de8ab11a23fa368e3e57c76

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
db081f1412071dfc7d4ae5fa554ecff5

SHA1
840b281e1df13106d6895a09d3ef3753f67a5051

SHA256
2f7c3aae257fe16c80830204f7b10a46b91c835efe7f3d78979bb1d0f910cdf2

SHA512
db44dd4c65ca8f725dd10114e3fcf5100e8d1b25c5e5805e2b9bfdc92cbbcf7428286a21e8f78677e434bcb68ab482aea76af8bde4430f754d4d1327745e3a59

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
432B

MD5
57c856db5e5b55523de1ba04d27a0992

SHA1
edca92e0e061786428987f9641020e97a2168cee

SHA256
289adef6f0231e464526c64847790c37e7df2e4e90c8c00ca5c70bb381c1ee85

SHA512
693318b79725234f5ef241f7e95dccf6a8d26f7cb27a6aec66fc27069ce1663ea145bf846e2bebca57c804ea4832d94d88d10ac5793d0a961f15905803dc6ecc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

Filesize
26KB

MD5
21be188b77d28c2b260e5f48a91bed7a

SHA1
e8aee7407a03b22deed0ba05d11f7973d641293f

SHA256
26ea9ed2f80612ee7aff6472ee2043282388365e15fa75023e0e7d4c2241a3a4

SHA512
d92620e38087d9d9a1e3b42504b135e4982d67e61e8d1fe11fc632d9f1b8adb32de4cf3579a2bed37b7d9dbbcd850ec65c6becfeed26af7290de8db9f6f8d100

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
816B

MD5
87179f6b8741705da44e64b36fd6ea6c

SHA1
33f00403c8682e191c8fc2c2764c358e440486a9

SHA256
6653384e4402264ae838302bd38d2af7e6c3346584948f19160e6be3b0a40e58

SHA512
48cb23059df4ce4156590bab475924e3c1bbb1b3ff50c2611a96557eb90f85c3e52a035ba16cfa42908dd5d08dfdba4f3604cffbcffd5ca1f5af62256e23dd3e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
880B

MD5
531378bc8f46f3fdde4f1aa17d10b6fa

SHA1
b5a6f737379a7e571cd8cc82ce041416b35ea50e

SHA256
d5bf8f6b2d54a9dfcf74b5ff9b9c2d7497d54affd4aa33a811039ce18be426cf

SHA512
be83b3fc59e3c555287879145a7d394602808569766e295e1ead1ffdf5d0c341b58289473069d19ed135eefc7447470099934e124be30abef1b4bd3756d172d5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO

Filesize
320B

MD5
bda801a6aae21a082b6ec9cccb80934e

SHA1
5e2843ecc094efcbac3443f2f01c39d275c654f9

SHA256
b8be65c2f6cc78b6c18afba3d4c62670023ab966bcf043f21b6fefbf1cded52b

SHA512
a458c1621754ef367faa6307c37aa478202ac9fb0bb49bf79e1bd586b357c1f5e3fb8977f972f5f13d9c5ce8b3e0287d0cb75db5ce28ab7287bef46c7687171f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
e914382633b83d1c654cb39ac17fda3b

SHA1
43ed5825a0ddd1c52f0373d2ea1517a76b949a0d

SHA256
aba7d18d02872d7f1547b576a15378c6d27778969d430a8eaa72068d356a3137

SHA512
eceba66b49f16be7659ab298d93b882da9df252fa2e67e1c04c0421b6fbb1a9b5b57083de6e7ada3e2dece732b55cbdf299ac2c4ce37acc63ed2932862d29d9c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
bfca97e0547c610bc185ffe5654e105e

SHA1
a8b805884bb6810fb31cfe69fe64399fffd4e9de

SHA256
092fe1dcdd3d2b4584864323b9061bfff9a6c295510e3bb6e4c84ae8c6ab90e4

SHA512
6497a0eeb2bc48608c6f0677cf892ec1bddb2a70aa5479d8d2f449e68b0b921f51e2e348ba4be89cf9ce0d5d2c97790bae99c1f7f10be0878cb5e2f481c9c3a6

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
a04f0965cb0ab0cb4d9da5ce5894a080

SHA1
333723792a5fc63fb07c6d307a60d950329149e9

SHA256
d64326a7f64e464f68a9843fc384e5a751e290b4c8140d538ad23fce8f95539c

SHA512
0d43a05303737d2841115dc373acb37de2d26f5f73f746b44ce7988100434816aff14f22a906510b2cddd6e512da08fc4b0ebd4fffb9ff05c5611e1b8e2e0791

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
896B

MD5
12b47e61fbe0b6f43b7d271752b427a7

SHA1
94cfdff89b7c26b7ec9e76dc0c92ffcca4b30201

SHA256
0858c4156a457ff829a762ada875515f72dcb7d1a890ca2e610a6eb37a2cfc29

SHA512
34b886e66f5cc79a0c931a9565f12456676b531b7bcc3be7a063d8a75e6c40c2073b4841219cd8e49f8beaf35266d074a795465558f660a89bb0213b8cfa132c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
864B

MD5
8aa1e9df320e608d71a633eee090627e

SHA1
636e24da93dab2844588c3a7eedae01a39e0d6ef

SHA256
e542e78051306bc2b4ca086498b6fdb7a99c214391ab69361ce3a67cb3ac9b39

SHA512
9f1faca3c830c8f71877d78caad37182ea2412ffe93fa22d3453a8b24451ed675a69c11b51bc9a0e5315435f367f511027ec067cce260ecc874409dd568752bc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
864B

MD5
eaa7561e0bba62758ffb0d2ff10e0137

SHA1
740074077642dd8b58143e1cedc851006ab4aa8d

SHA256
ceaa5e702881e4215a81de20654ffb03f7146df4ec3f4b35c3d0bed8e94f1797

SHA512
89b6512ad994eca0288fbc9808d52f5c1aa0f1fdc3ba3cdd12268e3fc7c94858ebb2d6ce28f9b5bfb9cc82fc62342fec88cc9d37480c0403054a794827658c60

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
592B

MD5
2e0a85e596a4e36148113344bb36f24b

SHA1
5e0b1a6eea7fe696bb409cadeac4de0ce7d93793

SHA256
66724ae43b721e265c243703a318f10f322f68ce0cb712139bbf9d790c3f200d

SHA512
635f3d4561a06ca437755555a18f856557bc6ac7e33e1e17ac247d14365c912d214faf553fa12cdd36708e30ea41a0f576b206f4f721744a62fc0bc464c74dcc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
912B

MD5
a64f3e30842c497dae453a44fbc85c92

SHA1
c844cf10fb3322e7663c89411b27932619e8fbee

SHA256
f824b27b8fd5739f32cdb51f9d8dd43a7f9b14101e54e51d7c6556e0bb84d6c2

SHA512
93f9a76a442bb1736023633c5fe43492077196d73c8798c0d33e14207d70043a6a5cf0cc39078399f9b23b0fd40927c390c6ebc481bdd4d3936ece81f7fd5126

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
640B

MD5
62bd22e263e7f3033989e6b3c1535af6

SHA1
240ebf1a4e07c7768bd301ff7fec8b76f8d6b99e

SHA256
8a19ec3a2da444eb47d2b0e5171d9b9cd880c46aba409f55695821f4e0d5635b

SHA512
a13aacdfaa0fc80cee5f48b35d2c9feefbdc678716d45fe413b0c2febe20319980dad416929be741c78d7e2580525164e3505aaf5928c85d1f4fd526ab209f05

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
880B

MD5
b6eff9abd95133c8b26cd006a798699d

SHA1
4ea2dd6500f2b8e95fdc2d596bded270a1a656c2

SHA256
559ddf0cb90d6fe29f9378fb871c3fe6645bedba434e048695e75a3805a03e44

SHA512
5e545f97fc10fd7b054cfafe05717fe8be5c60fd62540558b6b2424f49f1e995bfe4398d0e9bc37c1d10b71a7b8d766c4bf71ee854028e3ba20cd41491b6affc

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
289711a430c990a00cd9d8e68eb1d58a

SHA1
2cf740081ad11cc43875f845d411feef25f330c6

SHA256
cb397db281af2962f82f130bf5cad50f9009bad5ff0964a334b110d1a2d64c6a

SHA512
7a435c5e2e6cd51f4348b138e69e6664e1265b25981157f53b583c349757b7fe95305a9cc2049bce4a7ef98988160654f69caa3412104833e5cf5a9987ea745c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
207ddc9d62606a65836b57622e1b2013

SHA1
da7dbea0a42223b5fecdb14972e91c4ead9cada0

SHA256
fd1487a82c2af81841328ca87bf882524e177b2f33de2863c7cbf944939a09d3

SHA512
1ac28464a066ebb15d61d58bce4a7ab1bca7e3cb9acc70b0378a0dac8e274b2ebaf475e6a4f56e1674cd18b6014bb58afdd3726b5fd59ffbe2e0d64c1c91be4f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
624B

MD5
89d4e576dfc3ce97895944d2d43ad2b9

SHA1
a93338796cc9a8399dc67a62cdd247ff1d9b5344

SHA256
4d026f5f6dca242c7f368f86cefaa5c9724d107cd98ed5bfe27842a677a4a201

SHA512
4ca604b1a635ea5db0baba8297e7758d8e0ea37fbb60ea77ed59284eb6295e98dd79f0efcc9d2fd405b0069f5e70f0bdba776b09b30182f67e9c1552eacd56a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
864B

MD5
cbaa8f98b0b786e676347b83729fe720

SHA1
a9d283f06e36ff8d768c528aa23b6733d8f50162

SHA256
729b75de8b5a9207d64142761affdee10d45168d021aff4fed0a5361e221905f

SHA512
721d934cbb04790d78030fc4a2fa4a056aef82492f4c827bacc065bb22752f88a739e3bba21f4ba051089a852c9b6f4564e6d568f2c5b9176d21fd7a77e228db

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
848B

MD5
9244944a59ac5f715d7ceb9c145f2e82

SHA1
dcc291463396f78e3bfba382344f715f94f493e8

SHA256
9675b6d98a3b0fdf05fda08f48164da45c10bc16984efbc60306760d74d9e785

SHA512
189eef0a1b6794ca65f25be1f6c71a00bba3e90d9d7ca11cac0ab57cdd14a0ff8bd06113a45d56693a6ab5964536d2cbecdc5c71765d8f5c256702fe91dc0c89

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
880B

MD5
7711baf0008c47667acdba577fa40794

SHA1
4a37fec557d486f221975b11ad55c74d2850e296

SHA256
c8b19d5b819e642e328acb058c16bcc44e66fcf48f127f5b13eef70d71e8a590

SHA512
a779683cd8eadd79e7b262c23076bc4cae3cb2fc1ee47695a04d20b32a9ae2eeda6452b2f422f300efd243be14fb58e6ce036aebc3027209120e0264c0ce2b0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
848B

MD5
3ac855d19e5be9860f1a0d192aaf07c4

SHA1
96ce65cf08e0b8157c68579ba0dad18dbf8a3cd2

SHA256
d2168b7459ddbd3cc28614664d1e6a6aae0d846c4ff5e963639e2250c21fc8fd

SHA512
0ee96a45f1a632bc52ee8f414a8a6cbdafcaaf27a9196758b090081d2d783afed9c4934fac737666f6902fc779d88e53d569ad7966e7474d4c587166eb6ec3d8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
864B

MD5
1cefeb4923b0bedb16a7f6c690b72565

SHA1
be2efa6c29f0115c5d48a010c052c4408a9dab83

SHA256
bf554837caeb5dae3d355ced7edd5bc1ac8b8c46e96c5901cbb6127abac2ba91

SHA512
adbd46c6a1ab917fff3db592bf30f3b6b228e19eae0c15be5e2b5dd64b7ebf5f48a837cf34c3b48757d017a5422ce6b7b7b4643aeac3f44bd2bd5d90d13b0b48

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
864B

MD5
30d5a7638fc09f0e62e1d863da899393

SHA1
ccd4e464cc8046e49349d704772572a3e0cb2575

SHA256
cd6deedbd3b6c2c5daa1df641520d5a6086353e3a46ebc7487ac5d88fb5b114a

SHA512
e1cb13a0d744cb2f8d51c4cc1d6e6e4deb611662384dbab26e43f956b0776121d848682fce93f1ce114b2016f07f42827cb5964870df39031d11ec19c20724a7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
864B

MD5
38d8084971601ab9b4f6ea775b9c1b50

SHA1
b79bd7b1820288b2a13761c3cb97a56bca1df343

SHA256
2f7c3e673d107a93fdf6553e4c9877d1dbdb53a4c839aab27ceaff05c2c0c885

SHA512
1d379781bed08f861e8d5e07000f62723f7abf0e84fa68b5d64e125de892ee9d68c8a791bdf0a1a308feb436fe4110bf389f0bff04a359677bb511acb5127227

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
896B

MD5
9fba77396392797562da6599809fac5f

SHA1
553b1d56ffa80dc2d3d64d54a8b802b484d20ee4

SHA256
f9f4731265d322afb57b894bf7ca7e0deaa03c7d7ccce688781b70e556412db2

SHA512
42fbb9aebcac41799e88c48bef911ff4171498a409041fdb0340e3331d68f4e84b303858f51d48fa3345b5ceeb9d2df0d369bfcbaf24ad3eaa6fec84e293de69

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
a585aeac1d2d7e4cc7373a3fd3c0475f

SHA1
0049f587845a15458902337bd7929b6b18ad02be

SHA256
60da23edf88d75b5201e0b67aefc749f714173ebcc3f15043e3f583a9427c6ef

SHA512
9fe790639af3a44e1576a15d4f1203cc433e0c0a4e9676ae74977071b14b889fc409e6986e9cbfce00e8876538b706ffdb9594bbe766412e67e0fc27692a6b95

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

Filesize
816B

MD5
bd8e0491f41ecb48d6b9bfeef926ea3b

SHA1
23b135970039941792db1236a846017e85625afe

SHA256
4bd21c1285204803b369cb2d9e45bc8970933874fce283e6fc6e296dcde9a3ed

SHA512
c05319ee2ef7239fb9f04eb24b258901371f03eb650c6aab1e4396a34d84e4472510f62065b4a2f3c3c61dc0a19afe98e2933463289fb9e777ee94e05dbac393

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

Filesize
816B

MD5
a2739f1547b00bd85922a06bdd526c10

SHA1
70b2ebe6423994c71719ad33a93c3845ff52bd30

SHA256
a0d97e7918617d74f6e5cad3164c69429a28f9705e0efa119d2e5a35da34fd0b

SHA512
e31ebf4bb395fea8e8baf6d809fca6ad70d4ad4798d33a0eca03d5ecb9370a71f3e744a2959b0826ff364523846db8ee5a8d369a96d87241a5b7c7d4c92f71aa

Download Submit
C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

Filesize
5KB

MD5
faf643183107ca2f69aaf6bec863a038

SHA1
de2c474d69c1374dbc87dc16ab18fcb832e61da1

SHA256
84dfb852e475f2822feb31263e01fa71779cfb5937bdbaa753bf8d200b7b69bc

SHA512
e79f76eb7e59e5847a64936ec6dab49717810a2b9934f1f051e5c50cf53b667e2174731da003dba76cc8c6205bb4e617deccf6a25cde65b0b934a4c8206ae1e1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll

Filesize
809KB

MD5
8834762d41e30b0cff3ca81920eaa86a

SHA1
64ade7156e455194145216de301394fe54cc97be

SHA256
05bf620f89695eb88d80fcc5382df0e7ec1899e4585a3c1110345f3879943166

SHA512
328ea28a05fbd6aa2e7403267a50e5dc49eff24d96527a9d6629944fcd7865a7ffdec4f1a956274c03151c5624371bf416d49fa3f6f5e5b30a80cf433f012714

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
160B

MD5
11e715f3c54125ac5a6d468c297f4e4f

SHA1
b06779d91a9a2999826e819d1087ae42e1730b1f

SHA256
48dfe28805a7380ea11267eaab0540b01f1a9616a52d3cc6f0ab50853879165a

SHA512
cf7841ce817066d1bb7dc619493adb33a210d47c85523995b53a6e8d69f8e8fac06734e70a1a1230ed315f1844f93287b50bd7e59a9b1aee567097c6ac3087b0

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT

Filesize
32B

MD5
e7c776f09d31fb2c7b5a3d9910589cdb

SHA1
a1382925003cd8d52be7761f225e2dc16cef4806

SHA256
d7495214174b564d4d44a760bff4a97a33aab3ff9eea076f69f0cfe4e29cd217

SHA512
c67cef37d1b2b7ba68fd4f4ba2513e2033d57f32248a1eaf54e6b0ebaf23a80b36e26327104646d4ceda4476bf4f01a1f723fe0ff13677a2e57e378030e4ec60

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

Filesize
32B

MD5
2331cefd5e4b6d42d2fba7ac3eb7a02a

SHA1
75353194aa96421c4b3d9e878e1ef1de9119fa4a

SHA256
9d1d2314da4249404585ade13188aa7dcefaa46d6a400de786efe4e675b2d451

SHA512
be6ea081e71a1b5257bac7963d86a7f33a17a535a495a04d669d28eeae6ca772708596726daf96ea186475fbc6d03f71e76a68f4dcc19730f2f6318d4ceb74af

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

Filesize
32B

MD5
2a6a4bd7d4c4712e00495115ba70f533

SHA1
66221ec0cbfc4e9e368cb80eea8c8aa3bdb0fbe0

SHA256
363be6e882c83eeee6353a63381d70d959a937594c2e9d041bc8b465f18ce6db

SHA512
3457c359576a07142abe23085e454d5757d911fd3c1b1d004d90a6590bba615c67412b5be4055c51e616a0b410a3dcaace491694efe8cc8b3e495fa2b8343fad

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

Filesize
32B

MD5
7ca0d3efb15d7a9f30e26734c0987d13

SHA1
6b8cbeaa785afa7e154f12e968ce2b4279a83bf4

SHA256
faf71b25824a4de43b277f5a3a980e48ce5f35577e6a1e222e1aa27a4682db37

SHA512
ef57645665188f1d8705b59a55b38082e153b0c610e670381e7ddcc48bc0c4a0cf578ffa2f2e9cc77617042055ce4183cfeb5e710686f73e8497bc893dbba26b

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
bc309d1849860fb4421846a21c7f910c

SHA1
e93d88cdd270d240ec134c6c912be0615669e2bd

SHA256
4854bfb60ee1af6796aa6e4f359486bf234d0f9233adb0fda3bd88c6ce4f1e2a

SHA512
56ae5f3f324f693cf8b1e7691c98bf44addd27d05e54dca7ff3d4a3c20bfc2b8c7111b38cc321ae8ac0de7cb5d8df2279a086f0a8a52bec3381269afdf086549

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
50b208bfa4154c378a2f39c7c7a4599c

SHA1
8161e1c42862dbc53fa84aa0363ea9a8a1019467

SHA256
af53099ac57c36f535289c019f3c5f2704cd03648cf7d2b40606886dc7e847de

SHA512
d49b4eb6c0a26ec67e93cca4c38b48106507f93a26b6baa6c1f14b6ce7d502e079bfd4b25b7aae895264b093575efff1e0bb930f40bf2b4c1eb98649b2bba45e

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
5df56944668f6a91014186a60b55e25a

SHA1
a58832d76119f2c3e628b132f462ed97c9f77bcd

SHA256
60e8828f6d805799e8b8d5e641d459600f32d5b101ec75e7c699daa2afbe38b3

SHA512
7bf74cb47d65c7571426337e7a51bec8728eb45da35eb71f9e325e4cb968fd37612bd73f7db34eb1e7bb351014256f77767bee257d497510bd56e643f3aae147

Download Submit
C:\Program Files\Java\jre7\COPYRIGHT

Filesize
3KB

MD5
c730ea7302a9e0cce4039284ff488456

SHA1
61017569a2b8affa2f8f0e3edae7960a1fa3d25e

SHA256
0214a02f9390eca4cb3e4f8db7f8111e17751ae2a93f1e5d690041d5df584532

SHA512
92d4200996ca2843db2775ccd17580610960618aceafafe0fa93c4070798fd24abe153191e703b9ef2e69c17edf1e85d07912fead3d4c8c0202949854410f334

Download Submit
C:\Program Files\Java\jre7\LICENSE

Filesize
48B

MD5
5a945f6bd0b6ac66b8f6db92cd05921e

SHA1
193b1a2aef62d29e0fe5ac7364db07a2baafffe2

SHA256
6969c559651c5147afc9cca483b876dcadd22edb6a01b3a62b5970a68bb4cab8

SHA512
66386f4f91892dd7ae613b244e98fc57cbb5ad3a82f12c4ac6185b30df249073b71942c14eb27fce3ed813d200887295546541d36c92f5cc5baeb075761946e8

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
490fcaec508cefcdd7818fbd4c7e3eb8

SHA1
fb85370ab8ff20703d775f828a3ababb687ed203

SHA256
981af48db3c3f40689ea1bb27517ec16a63507d7c8da1484611758942f000824

SHA512
e60c78b7da1290c22f156eff7354ceb597726312744005125a6b7b4db606c6f4ce7752d18c27dcefdb09cac9c13684fb75ecdcbcbe4de51f2c4e60b0e0e6a82f

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
585b9a27a630f2a40c8a19c2f9953d4d

SHA1
8660b17e594a35be66426a1e8241ec443add7851

SHA256
36103662b2d7b7e18d9e9b5a876c73e8537f4ef2333fe5fed7920f5154294cb2

SHA512
a109c730d57f0687925daeb4259ff93c27fa6fc8d015705d6bb77055cef58bf9b966ef135c1f9cd2cc17f133a9ed315e643da87357b0b9b9efb93be8b880e0cd

Download Submit
C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia

Filesize
32B

MD5
3fa86dde0644f012e50eb2068de0f7aa

SHA1
b15462ba78e2ce4c5ba17b30d6748e226b281952

SHA256
e7e7350693458990bf4a97af7157d6f9a6818d5483a8862989e7d62bfb41a13d

SHA512
ca978d98778d991284905da7b0391acdc90b1b45dfeee6a49dab4ba6ff8dcf504f9d00ff7efc50aafd753b53271c3a5cf998b3cb45b20f9b40f6bffd5c7371c5

Download Submit
C:\Program Files\Java\jre7\lib\zi\CET

Filesize
1KB

MD5
3d0ce56b48ef71a23292b986dec0b20c

SHA1
672db81e45869c50bf08169198f16998f8a79fb9

SHA256
beefc3cd98ad314c02820aeb667d6f68de01f9e44e9778848581fb54524c896d

SHA512
5310b53e98ee1429c06a7f8f6df2d0b7140ed99c97872b7d3e79f78399ea5c8fc4dd71d6fd134b21e596a878d1a7bf100a93afbb60e7c6090d36677ab9f71a60

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4

Filesize
32B

MD5
703b8592e272d363d3fe54f410684b9e

SHA1
43c7353ea604ff31d6b3bd5c58174da512ab51a3

SHA256
1c2032d0bc1b4bdd4250d5d1e05a8e00985041df967e7fcd50cf0c84e9c89a53

SHA512
5096b27baa9570483d352ff365b66b41a4017167c44c0fb71bd670846f7aca4502b177840fbc8871b81c8d6b5e2d6b54dbb2c393bfb764847d7393fd564bcb07

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6

Filesize
32B

MD5
b07a2cf525fb3777ad4520ca5933335e

SHA1
74ea9986ce528a06b5a3cadc448a7caac77ff634

SHA256
b7aaf254109da07f9af37e9e7d21c033882f5d2c5358b3e879a2ddab71ad035d

SHA512
965ceba3b55b9212b6edb1830a1b309a074b0010bfc619cf4047725213e77dcab032f444511647cbe32c7478fd2ac7a62c66e7602c7c7412cfe1a5d04c4e623d

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8

Filesize
32B

MD5
2d426c7107dc394ac0f7b6c2e26c1da7

SHA1
cc64c9a2d799721d73005114fc8e2a514e0d2125

SHA256
78bff72dcd555ab0661755f9b6ad5b1f988b0e8ccf05b14e996f722be0d880c7

SHA512
6c5fc50c05305372acfa50d9f0ca60732a6cba1a8102e007daec3ba309bb5bd3ae81cfddd07cf55020ba4589d737086cda15583be857e5eac92813e953ba3ee9

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9

Filesize
32B

MD5
983938e54996c91ea0f814eff90dda8f

SHA1
257bbb63b9aef1fc1771c483e33d7b23017c32a6

SHA256
575c286e7d017e0dbf4dcd970b985b6231f9eddbe5ea9dd304af58b196714252

SHA512
ceba13816bf3507143335b728759d54b331ff72df12e06f12a2b2c000a6b3ccc545f3d9fe415c65aef758264c647d8797ee97a3c76a1570bfcd7e9841102f867

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10

Filesize
32B

MD5
b136c9ca30628c84c2ddead4bc276c39

SHA1
62b107ccb2314c3fcbc65027b26d0b4eeee836c7

SHA256
6feb16de0d4616b041e09a8cfad93677141fc255e8cbc79e6bcd8ec0cdbcce5f

SHA512
8ed6f586af6e8766d6c3a002d4bc7b12f1f77055ba1686fd09e60c3cac965fa84a677a67270e16e1c049ec54abf100739d04971f420d0d201eb1c5c81c3ea517

Download Submit
C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7

Filesize
32B

MD5
227d3f3adcffefe67440c81f57371111

SHA1
93e701bfc387a9577f9a47b8d3eebd6cc292d24e

SHA256
b44833bdafe327d0068bead757ae2b415054b87c57ddaf59bceaf806b6d2785f

SHA512
a86ebd8127985949b1c6aece286bf6dafc715f0922efe13ea43ca26da1cfb87f8573154f7e79087b85c401c1f9fe0023a4f6b6e1fee4ea9ee9e210d715ede5d7

Download Submit
C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

Filesize
584KB

MD5
d304b639145c30637ee976cf0955bc40

SHA1
124a2b694b3127bfb4b4f88bb6fed767679dd525

SHA256
1903abf67812eadb2ed6e4d3b6effd337094261e3fb9023691b6daabaff648c8

SHA512
98f48a4ccfbdc1e86f8f3d138d54bd503fd963a4a9c3c15779be04cc6d6bf30624b4901cadf599e452b7b8cf0810f712a2005cec4ad196ea446ea710cecb2976

Download Submit
C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAB0002.001

Filesize
16B

MD5
c520d5da7fd3e189474de92958232f13

SHA1
2c1481a5c36e0dd39f8a7ce204a9995d522afbb0

SHA256
5a3cac0be2525a1bb8e616f88392f64b4ad9c07d1c4cce1376bb0d4d63bba199

SHA512
e1bd3038e072536fa0358dccf154bc006e2ada57e61e131ba99d8eed97b6b7f8c5b38964d5e4407aa02ec734fe04e0c7f47b0668f2ad4bcc492d6aee719f773c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
7a2c7d57393edcea7abf20a863da0dd6

SHA1
5c4d97f92c8cca26b946806092a9a599cd6fc749

SHA256
200be375b09a17edfa5e7bf418bc5b579ea630591557c278f139d959f05d2aa7

SHA512
09b5e1b173b7470db3db1aa476c79e1f2d66ad83caefdfd1da21bfcc5d357de76570b52ff1724e1d6b73e4e24c81a4fdcce8b3e9b379c35f12847768bfb70106

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

Filesize
8KB

MD5
04d876989e678a0540c2880d5c88d403

SHA1
b171bd4a2beac3aec84dbbb1708b002a23b1c5b5

SHA256
c5afa9d90fa640040dcf20b5e9d6e185ee89e220b00cfe357bdfc8b5ff6b5c47

SHA512
43dd5ef0351ddb39b6264d5166ad19732b7188ed279b104818968e79ca2621095bcdbce3ec5363a0aef3d9e82502ed88861d92165690ef9a50e1ed72dd18d367

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT

Filesize
32B

MD5
fa9061a51d61ade6e49293e1e4ff034e

SHA1
a9c0c39440c35ada62f8f97826f45d70b605f920

SHA256
9fd6a489816351f25f6db0d015236bee67cb408db098f43aeeaa6074a17e519a

SHA512
39649ac86683ba232fc60cd9884aa22cddac4e26c8de66c309fe6de70746395454e82d9fa9eaa00428168683b53eac5d70f965d615a6da286b6a94f7e4596099

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

Filesize
8KB

MD5
2063b82ad0ef983a21137f516664346b

SHA1
8629a8413793326bec17dd191bb5f6f7fe9568d4

SHA256
e4f92abfddef0703674162bdde50b4a1fcadc4d5111b4fa527af021922978126

SHA512
caa701df3107a4efe249740095eed59e965bb423d23a70de3d52cb204889a57d7465108a5995dae5ebf8003199b0e273ae63045e9fb4cfac31026e77ee8bd8e3

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

Filesize
264KB

MD5
3960d76919beb4c8210df26695f5df4c

SHA1
807e72f8813317d96ebf8590760be9b32527b379

SHA256
5a13b2e32be5aeac5806641880e0511f9fc5a129079cef1eb6fe363dab16432c

SHA512
a76a3c2f6aebabf43b926fcd0e07de349ee0c12c8f35e3b61cc27fe1a68a4928ab1901e933fe68adac84e276bffe369baa253123eb45dd534eb3c7ca8582b3dc

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

Filesize
8KB

MD5
882f2b8682c00b1b8a4d682ab82d8bee

SHA1
00616c52fdba52cde3cb36cdcf5ac933089e7ea7

SHA256
b1d4b33d6e4166a2d00118126d769c5e99e99ec16ac5e2727a79240b99a0c66f

SHA512
04585ba3509ecfb6a91268444adc22265bd75ff8f5ef4b32143a66b18f69a8a6cc2697758c868fa21c3991248217960ccf319f9be8ceddd5c8a62a9e3884b6fd

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab7AFC.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Microsoft .NET Framework 4.7.2 Setup_20240708_163937712.html

Filesize
1.1MB

MD5
96caf402843847cf83b25e106448b8ff

SHA1
7d2fff24b7d4cd7ba5bd375f24aa9da7bde1ce99

SHA256
d1dff738f38a41e0424896cf7a9390f91b93bf442e115406d5d5de6a21872e68

SHA512
cade370556fea01d81873d33c5edca3c5ed8d10f6e018083dffd7fd74a2067b7a9066309d555408d4cf3b3ef08a4cdfbdb9adb278a004b04f8b3df20dc6458c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarC5B4.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmp1FB1.tmp.bat

Filesize
152B

MD5
64336a2c4dd4dab007dc0d3f4098f445

SHA1
e09072547a6ae00dd08c3d9b0c1f0a76cc402e7c

SHA256
1935016a3de45e2fce7cfe008e9301deb6272b3a892935c5a468a9a51766e068

SHA512
ad451a32f5ce036f9e18388d06c56af84543c6c2cc181a9c5813b2f476d9d3accc6d5d23fed8d208e7b9eb5e322433c62235ade224fef6de3aa8089d1cde5b4b

Download Submit
C:\Users\Admin\AppData\Roaming\Explorer.exe

Filesize
249KB

MD5
b8a6cc953ead13dabfef6854bfe65139

SHA1
51aaa0723d5d22c74c15f625e12662bf4aa2cfb7

SHA256
4f9494cf61c3c10656a3f8eed5798ab604c815c34472c42c18b49656fb71d73e

SHA512
9e7078acb76dd33b0811990b03b7e576eaedb75f13ba38f7c6457956d8c211231e86b02a6280e8dfa858b175003061867b0938e96efc7f9a2627d023983b3257

Download Submit
C:\Users\Admin\Desktop\DECRYPT.exe

Filesize
65KB

MD5
ee71b8c97fe4bdfd9008a38af3ae2e01

SHA1
ee9861512b832ce5678d29e61a0eeced21aa7fdd

SHA256
cd9995be15284735b939cc68dc2e5d0caa55da89216cb363cf0c2557a1b208e8

SHA512
aa0e8520f3120d1390b6559bbeb5cdd376b24003708bc7f60890ccdc01e20c51953475ecbb503729c06ee0e2e2d3cdfca8d209b753312a3daf2a1ffad8bd42db

Download Submit
C:\Users\Admin\Desktop\READ-ME-NOW.txt

Filesize
478KB

MD5
01ab003f107da09549b5986748d99c76

SHA1
e63eae96bcd5b1b46c6b99d7cc7ae1aa6b695acc

SHA256
57ab669a0ff862105769c343b982dc52396a4ec94a5146601c10f725dc718093

SHA512
4e4b3d9766cdfb52058bf261d2aa3e030968ae4300cce5f3b87685442182bf7210a06dc9a316a37ac773bd631708e515762f7167fe84160999d92ae0a0fe4d2e

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
a284a376e80349c6f891bd0feeb74d72

SHA1
4ef2081f2c48b6cb3d5a0a0e54701a98dfe53d43

SHA256
36da7d1458edf0be9959f673b134b03b000882f1ae6bdefc5382681da1042bc5

SHA512
a1cfa3161bba9ff0a148d25ab014691213afa6ae9e8999b72553d9d46dd2fc0fbcff54fb2f7fc9e421c39499282051d7df21852356782b15751a3661ed925796

Download Submit
memory/1672-12212-0x00000000001F0000-0x0000000000206000-memory.dmp

Filesize
88KB

Download
memory/1988-0-0x000007FEF5543000-0x000007FEF5544000-memory.dmp

Filesize
4KB

Download
memory/1988-12-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-2-0x000007FEF5540000-0x000007FEF5F2C000-memory.dmp

Filesize
9.9MB

Download
memory/1988-1-0x00000000008C0000-0x0000000000904000-memory.dmp

Filesize
272KB

Download
memory/2756-52-0x0000000000B00000-0x0000000000B1E000-memory.dmp

Filesize
120KB

Download
memory/2756-33-0x00000000004E0000-0x0000000000544000-memory.dmp

Filesize
400KB

Download
memory/2756-16-0x0000000000EE0000-0x0000000000F24000-memory.dmp

Filesize
272KB

Download
memory/2756-12215-0x000000001B340000-0x000000001B3A4000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads