xorist | 3d9a47a80e9022fafda9c5bc3e50155adb282395f50748e126a02a73113b625c

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
13-09-2024 00:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a2449e48a4047644ad84d4f00409c2d0N.exe
Size

206KB
MD5

a2449e48a4047644ad84d4f00409c2d0
SHA1

b268604e5c70f6f3add1dec4024d2935d3cb2da2
SHA256

3d9a47a80e9022fafda9c5bc3e50155adb282395f50748e126a02a73113b625c
SHA512

6bbd90299a583b42d41b3a3a8a4ff43f2eca16b67e6eb53800b883de36dadfe4404a62293368ba85410145f0c48ce3398f587ed1ab91594688942a6c5d222a87
SSDEEP

3072:qUQPGOzKv7Mu6t/+xwgHX+MB7+4TFY/ahEFAj2I4Nk:6eOmTD6cygDBa42FQp5

Score

10^/10

xorist persistence ransomware spyware stealer upx

Malware Config

Extracted

Path

C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

Ransom Note

Hello All your files have been encrypted if you want to decrypt them you have to pay me 0.015 bitcoin. Make sure you send the 0.015 bitcoins to this address: bc1qaxd0wz2zwqgzwmz47mucxjwav8ydw25s0d8m4w If you do not own bitcoins, buy from here: www.paxful.com You can find a larger list here: https://bitcoin.org/en/exchanges After sending the bitcoin, contact me at this email address: [email protected] with this subject: 0015COVINA-V28310290015 After payment confirmation, I will send you the keys and decryptor to decrypt your files automatically. You will also receive information on how to resolve your security issue to avoid becoming a victim of ransomware again. Attention! You have 2 days to contact me to start the file decryption process

Emails

[email protected]

Signatures

Detected Xorist Ransomware 12 IoCs

resource	yara_rule
behavioral1/memory/2876-1794-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-1781-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-3833-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-5779-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-9907-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-12754-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-14096-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-15103-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-16683-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-18343-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-19433-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist
behavioral1/memory/2876-20853-0x0000000000400000-0x00000000007A2000-memory.dmp	family_xorist

Xorist Ransomware
Xorist is a ransomware first seen in 2020.
ransomware xorist
Renames multiple (9181) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 13 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2876-10-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-1794-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-1781-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-3833-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-5779-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-9907-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-12754-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-14096-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-15103-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-16683-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-18343-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-19433-0x0000000000400000-0x00000000007A2000-memory.dmp	upx
behavioral1/memory/2876-20853-0x0000000000400000-0x00000000007A2000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5O9xF7mY6ylOB83.exe"	a2449e48a4047644ad84d4f00409c2d0N.exe

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\Solitaire\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\TL381H8Y\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-CA\Wallpaper\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\Hearts\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\History\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Link\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-AU\Wallpaper\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\X9WSUL7T\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\MX1BY2FD\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YFS4OGJW\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\GRU3FPRK\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\RYYHNCRR\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\Purble Place\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Recorded TV\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Downloaded Program Files\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-GB\Wallpaper\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Link\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Feeds Cache\EHDN25ED\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows\Burn\Burn\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-compat_zh_CN.jar	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Spades\it-IT\shvlzm.exe.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\fr-FR\calendar.html	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\msadc\fr-FR\msadcfr.dll.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bPrev-down.png	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\si.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\es-ES\css\settings.css	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1253.TXT	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00090_.WMF	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\ja-JP\css\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Java\jre7\lib\images\cursors\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382947.JPG	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Module.zip	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_zh_CN.jar	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\SpiderSolitaire\SpiderSolitaireMCE.png	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Windows Journal\en-US\PDIALOG.exe.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0144773.JPG	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\41.png	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15059_.GIF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099180.WMF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Windows Media Player\it-IT\WMPMediaSharing.dll.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Microsoft Games\More Games\es-ES\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WING1.WMF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0157995.WMF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\JFONT.DAT	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Stationery\1033\NOTEBOOK.JPG	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\Mahjong\desktop.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216858.WMF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsHomePageStyle.css	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes.nl_ja_4.4.0.v20140623020002.jar	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Microsoft Games\Multiplayer\Backgammon\it-IT\bckgRes.dll.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME39.CSS	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7B.GIF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART4.BDR	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.simpleconfigurator_1.1.0.v20131217-1203.jar	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\en-US\css\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\en-US\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145272.JPG	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Windows Defender\de-DE\MsMpRes.dll.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\VideoLAN\VLC\locale\cs\LC_MESSAGES\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\6.png	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Stars.jpg	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00524_.WMF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\SessionMember.ico	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\hint_up.png	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\Places\VIBE.WAV	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\file_obj.gif	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382942.JPG	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\QuickStyles\Perspective.dotx	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-editor-mimelookup-impl.xml	a2449e48a4047644ad84d4f00409c2d0N.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Printing\00232ece6fbf0584e184386c7ac94b51\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Boot\EFI\en-US\memtest.efi.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\ehome\es-ES\ehrecvr.exe.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Help\mui\0407\cmak_ops.CHM	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.AddIn\a7bc3b42b60c8eaa28b5b62900c9027f\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Globalization\MCT\MCT-US\Wallpaper\US-wp4.jpg	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\Help\Windows\ja-JP\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\ServiceModelEndpoint 3.0.0.0\_ServiceModelEndpointPerfCounters.h	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\a7a48457faaea5fc8a1e59b4921ac4a3\SMDiagnostics.ni.dll.aux	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Fonts\BOD_PSTC.TTF	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Fonts\mvboli.ttf	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\inf\.NET CLR Data\0410\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\ehome\en-US\ehjpnime.dll.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Help\mui\0409\sqlsoldb.chm	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\UGatherer\0C0A\gsrvctr.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Printing\aac5817d96d0ddcffebc1c45000e9008\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Boot\PCAT\es-ES\memtest.exe.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\diagnostics\system\AERO\RS_WinSat.ps1	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\diagnostics\system\Power\TS_ScreenSaver.ps1	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\ASP.NET_4.0.30319\0404\aspnet_perf.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\MSDTC\040C\msdtcprf.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\assembly\GAC_32\Policy.1.0.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\Policy.1.0.Microsoft.Ink.config	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Web.82d5542b#\d56e83822b7799e202533e1b84b3c134\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Help\mui\040C\reliab.CHM	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0010\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Confe64a9051#\29e00d9446b0496db6e145d3bdfc365a\System.Configuration.Install.ni.dll.aux	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\ehome\it-IT\ehrec.exe.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\UGatherer\0000\gsrvctr.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Fonts\serifet.fon	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Help\mui\0407\lug.CHM	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\inf\rdyboost\0410\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Servb00a6512#\ad984d55a4110a6602766230dad1b189\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Cursors\size2_im.cur	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\diagnostics\system\WindowsUpdate\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Fonts\raavib.ttf	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Help\mui\0407\certmgr.CHM	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Help\mui\0409\nfs_.CHM	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Help\mui\040C\perfmon.CHM	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\inf\RemoteAccess\0000\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Core.resources\3.5.0.0_es_b77a5c561934e089\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Printing.resources\3.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\b34cda03a984c515b31faf410e5b7e39\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\de-DE\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Fonts\times.ttf	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\inf\ESENT\0411\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\MMCEx.Resources\3.0.0.0_de_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Speech.resources\3.0.0.0_ja_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\UIAutomationClient.resources\3.0.0.0_fr_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\diagnostics\system\WindowsMediaPlayerMediaLibrary\en-US\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\diagnostics\system\Power\RS_DisableScreensaver.ps1	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\Microsoft.Security.ApplicationId.PolicyManagement.Cmdlets.Resources\6.1.0.0_de_31bf3856ad364e35\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\assembly\GAC_MSIL\Policy.12.0.Microsoft.Office.Interop.Excel\14.0.0.0__71e9bce111e9429c\Policy.12.0.Microsoft.Office.Interop.Excel.config	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\NativeImages_v2.0.50727_64\System.Web.Routing\b9977dd97ed7006f1d7968495c594bc5\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\diagnostics\system\HomeGroup\ja-JP\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\diagnostics\system\Printer\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\.NET CLR Networking 4.0.0.0\0404\_Networkingperfcounters.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\ASP.NET\0804\aspnet_perf2.ini	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\System.Web.resources\2.0.0.0_fr_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\inf\PERFLIB\0409\perfh.dat	a2449e48a4047644ad84d4f00409c2d0N.exe
File created	C:\Windows\assembly\GAC_MSIL\Policy.11.0.office\14.0.0.0__71e9bce111e9429c\HOW TO DECRYPT FILES.txt	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\5ac17cc5b92efda83e2925857f4fa655\System.Numerics.ni.dll.aux	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\diagnostics\system\Printer\en-US\DiagPackage.dll.mui	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\Fonts\8514sys.fon	a2449e48a4047644ad84d4f00409c2d0N.exe
File opened for modification	C:\Windows\ehome\de-DE\cbva.dll.mui	a2449e48a4047644ad84d4f00409c2d0N.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK\shell\open	a2449e48a4047644ad84d4f00409c2d0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5O9xF7mY6ylOB83.exe"	a2449e48a4047644ad84d4f00409c2d0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK	a2449e48a4047644ad84d4f00409c2d0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK\DefaultIcon	a2449e48a4047644ad84d4f00409c2d0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5O9xF7mY6ylOB83.exe,0"	a2449e48a4047644ad84d4f00409c2d0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK\shell\open\command	a2449e48a4047644ad84d4f00409c2d0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK\shell	a2449e48a4047644ad84d4f00409c2d0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.CoV	a2449e48a4047644ad84d4f00409c2d0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.CoV\ = "SMAQPMHIJAWGRYK"	a2449e48a4047644ad84d4f00409c2d0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SMAQPMHIJAWGRYK\ = "CRYPTED!"	a2449e48a4047644ad84d4f00409c2d0N.exe

C:\Users\Admin\AppData\Local\Temp\a2449e48a4047644ad84d4f00409c2d0N.exe
"C:\Users\Admin\AppData\Local\Temp\a2449e48a4047644ad84d4f00409c2d0N.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
PID:2876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-457978338-2990298471-2379561640-1000\desktop.ini

Filesize
129B

MD5
aa489b83b6186f445811a8d672a01bb6

SHA1
381e415e9ab6040fed08386f7c2a2ef6fc2da864

SHA256
1bb64d8b2e935f91ff4487f641d9363a3e0d4ec3ef372f9fe554f242036d98cb

SHA512
72637de37954d3a0df9d88b83b13b460655693eaba5362c23ed0bd2ced9fabe5096ef64ecd3db9e6984627b6844d1597d6e5e46e088d06444cba33cb58b7d194

Download Submit
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt

Filesize
774B

MD5
eb88a84fc72d1c969b2561761ef38dca

SHA1
ba712e02dcaf48105bbca51532e6b771fbdbeef0

SHA256
497c5c3700b83e2f3cdee5fb787ed1ce8b68279128f7f584ffa2df97a579f93a

SHA512
000188b5fa080228148cd520b174bb8c14203746b59e5490a0ac7c1f97e8057e94b9aaaed4a00ade89ce9c4a6a7d07d7e53dbc3168f1116388a967e3c345e0c5

Download Submit
C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\BRANDING.XML

Filesize
582KB

MD5
32041acb63433c80c4c1d80ea74ebb41

SHA1
799ccf0eabadcb68b7808caa884d8386a1737975

SHA256
9d2dc5eda40e1f27cdb93df440c1785086489602c4e3b04a53acdb88868cc859

SHA512
5979266dec75e8fba7332f88c46251e3e47d838ae02fd40ffbf20f5db7b22eab8b597afea82d2e207666d57583e37a13304306a7850dade7b73dceccfadfcfd4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

Filesize
341B

MD5
f529797d6740f50842677d6d219a003b

SHA1
00ebdec3a1bd4739c510bdcdd83199d56afe959f

SHA256
70c8a3091e1cb0ff495d1466d1bcf5fb966ab5175fde9bc8f37d25de446efd0c

SHA512
cd0898fe448a0bcd67a389fdcdda4cb3d07b2859394b302dba323792985a3cf581159d87797d48cde1ed93e5baf254b8ec306f5fd85b16bb069e95f5c2d6cedf

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

Filesize
222B

MD5
0c950a37773c7a8c902b2f5c61d092b7

SHA1
fe320a4976f1ec333c7965ea38b08e09e49bf200

SHA256
ab3613f202a0e2e4a644ca13ce0b19824f30ffd72c042fe6040cf618398de0c9

SHA512
e81f2deceea600daca59721ec2e74dcb43a7bcc3649c01755fd81119960ab355d6bdec402287296c817c3e12b5daca39c5cf81124c0ce7246ddf66af9d0a5a0e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

Filesize
239KB

MD5
78de20ce693fc4693c591743868730d2

SHA1
ff7da2c85bb8780f51d8be7ddf3832be0545aca2

SHA256
f755aab0939e72f6d86754bf52a08ac8d904c0fc9d54e61b5ced8b4e898ca5a4

SHA512
2e421d0e75b8619fa1e4552732bfdea44a7cbe6dcfed52f334bd0fdfe15775f85d1fcdbb5966e139603789929827599e29cf95aa79d56e3ed6b7febfb620a2a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

Filesize
24KB

MD5
a24f6b99c0c87012677be42ffd3c1958

SHA1
25dffb42264340af92492668b056ca70bf455f7f

SHA256
b08b7803e9a6de145021d5596c048563910324cf2891d13e0321281ef21a1c02

SHA512
dfd24a746bb20b506eeaa2a6907772a3e49efed171cc9d0603d0facf7bc94260655fa7ff93eaa19184dbf332ed1f99e800a92239dd064c6f851b9a7e2baa8a0a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

Filesize
185B

MD5
5894da43a78528b2f59996e86d3265f4

SHA1
0d62d0f0cec928a205a8c04c2772346aa2ee27ab

SHA256
976a462e05eaf8c6daca1285a46ee04ac33205153817b54f41e85ef5c9b1b4de

SHA512
93308489b94f05b440eb193c39be82c2df5dc13e86d80a4cecb7bac443919907f2996a27f158032bd8fb71e4e2fbbea112fe0f723c9248ca9b02c08b4a28d2ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

Filesize
496B

MD5
cb26d31580393472287dbce30225e408

SHA1
599b13efd066615c4f37123968cbf35f7beea49e

SHA256
f6c9635056d63f80af27c96c1c334ed0a5584224e660b763b08f2c9d5f0cb798

SHA512
d9337ad7645f278c8e1e108d03a03b6c723e18aea53d223f909310ae1dd2ca00c898afd65d70094cd75e020c16ac05918a415e1ada673488263f6400bffc3b2a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

Filesize
1KB

MD5
e1cfdd7672469a1e32dc8da8333ffdf4

SHA1
19cdd80300659934788d07717b2d0cb1aea7e273

SHA256
0e91ca69d207a364a8df860269730beabdc6a64939eb7a73b052bf113ba57f96

SHA512
c681419b9fdfdf9e8d8d666d491b2209b7293c1e8c36ba951d437940584e2db04aa205f9b6518b99b77e218c2683d63741df3fbf43993e783fcb31a1bceb1902

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

Filesize
5KB

MD5
88c354df0abe00c6c5053628f15d7e75

SHA1
d34efa89eb6e74277114779aeda619f224c74288

SHA256
4e4b605da739b22f31278ed4a5190bb62b7fbce74207f20a78601ca980d723e5

SHA512
ea28036b0b3cba8d9156bf3fffa695c2ab19dc6fdfbf3b058104b135dcfafc1bdaa0a3bbe5e13f25092e34f21bc3deed5268f19df86a6b850e8409c226619a14

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

Filesize
31KB

MD5
65579b1e5240bf6497c591fcefbf84d3

SHA1
3094da2192595ef2dc33f703e81e20add0f656a4

SHA256
6a04f1f11d6c0387f766a996fa81b4ea9e169c14e5d0be5c52b9316af668de7e

SHA512
f578aa7a144366644ab1b397c48b00161c82a973e3a06f4566b2a6123cb3b85a962c07af547a2930d9d38eb31adaf25302dda4a862bbd5e76bb642056d6d9e4f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

Filesize
4KB

MD5
4503f1eb0e27ad9599bafa486f784a4a

SHA1
27984146b90e65b8a7063942517d9d1cec2c8844

SHA256
c3bc2a2142a2fe01750b2fcd19753477076ae036228fee69d74b3a703d37937e

SHA512
85a09b5c126ed3d3aa9340453bbc6ab95d44e00aaac1fe3ab21c04e2b9e60e7f6cdcd88a9b2c8b6b32d8cec3443235c73cd6d14cbe94b71c52c822b10b9d9a32

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

Filesize
21KB

MD5
8ce91302334cb94b61f3ad6f8dfaad1c

SHA1
a3349cbfe39ae53afae434daff906a5399995dc2

SHA256
8a62f477f054db0e62683dd57c0e631b9554560af0d3134b2d37d0d6b0d11658

SHA512
913ef59220bebfeabee8b030337b5192afaa1f3e2a3d934d5b555c6edda958bb58e1c4d3b801f86198f304b09bc7bb761fdeba9ded08c6a5d712b250af4d6fbd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

Filesize
8KB

MD5
0a530aeb25f995e99ffe6c4e68cf3820

SHA1
acbaae6b121f6b69d01e207ae78a60916782f318

SHA256
bc9d066854d789e35f40326582877bda5ee6a81261d76ec3a9b314c127882f2f

SHA512
6d66ee903b337929f1b05cce14bc2ad68b85b39e3acbb37374e3a383ebc539dd90f96cd5534159e3f38ed688c90b25b3ab8d32ee95b5e8f2a365a4ba5f823091

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

Filesize
15KB

MD5
497bae6df03c41cc3564ceb15fd40c10

SHA1
ac86df18565279f84f10ecb3a5237f91297deff7

SHA256
41223c5bd1fcccaa29c937b074a1dcc675832d4f3cac0291b16e2604fd0a2e02

SHA512
836cd57fccd6fbedbb30365c261b81a660d5f8b04dccdb8882af2ad477edeab1500ed394c7d71d927b488d2998a0f73234326de37ed7daed2437629e75810031

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

Filesize
6KB

MD5
46da98260dc46383f0ec70d5a1abc448

SHA1
8c193f003c461e26acedab0ee0c4a5c5a434d2c2

SHA256
58443842258ed62ed5d58fe81ed59dc8498414fa1b2ae5388bc8624164b4688c

SHA512
eb7a9d58073aa0cff7ed63493d7ac5ce8751e6294b54060e903bb51472bf923cabf215339ad0203772dbb5a9ddb9d8fd82835e0881c4dd62b38938efcb2b966f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

Filesize
20KB

MD5
ffade89a1d56dc861d4123ac74125dad

SHA1
69366619276e5763c52dd70218409fc5d4f6efd9

SHA256
ad187411df43dabfbb8c736e65b4e6c04f7797e12418185b0cbec925c982293c

SHA512
710c31aa04ad247648366eb61b586015eeba23c4a471b4b22f4cfe03951b89bc2547e755ab2d7925c82527964700ddca7d6758695ed3fa1c0eb1630b256a0eb9

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

Filesize
6KB

MD5
f2c8746dc0f28a7bfcdb23c6ce7486e7

SHA1
28e281fe05bcf12edbf7b7557e5780e7c49aaed2

SHA256
1ab48cfe49bb93fb5050ef289cbd9eb0d123d950a1cb8a631a1a651df155a2c9

SHA512
084cb83163ebf7df04f45f8788c5cb3fa8bb34d4e5af79496126b41abbc5f026cca636a3848042f74d1f35e26c2f7cb97c7ce9321d3ae8128385027e2b10c340

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

Filesize
15KB

MD5
eda7e9d7ed432d2ced6496408489dcef

SHA1
9f7cd428b9a9d97153b947491081b5b3302bb366

SHA256
0c7bfce1999ec77405137b382543b8f4c289c77ab725fd40375dbd192ee4bc9a

SHA512
9036e9ce917c7fb7ce028f5c6db07d7913befd332aefe7d06fca1cd433fb00f1d3ea3704ab1549159f34e0ba0a94d7bc0124db5a237d50a043cc8636cb735f49

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

Filesize
2KB

MD5
daa5b4915358c2f075c82826d2a6e569

SHA1
c99f2a22d85feb7759a3508b3dca074415ffc244

SHA256
87a892914d3ee20dc330cf3b207e095a717731ed78450d23b4e248afb3b42367

SHA512
4ccfd23845554a5d753d88742ad2b6ab5291a31d627222a242384fd142c035a4ecd8caaec9651478304a645d0d653ccf0baee25d936b4b6c1c7248b53d13bf1a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

Filesize
2KB

MD5
a9686516d2fa0cbc6ac6f7a998ff2763

SHA1
c800b0e1e25f3be33c8473646204571a6d6a5d29

SHA256
0f6ab9369d9cc66e0266fdba23338ba84a676622472ed6d95109fd21e14e53a7

SHA512
69081911d8a7dc84a98f00895d08eaf69f9887735996255ce0a3b4c1b7a5d635f3b21e9b10ad3e419c7861cc4163763173fc4b8960f5297427b17eaea4b2721f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

Filesize
318B

MD5
6edbd3326bd16c712274a03af57ab4bf

SHA1
11d12308cf26a46419e6e63a4a26e2ead5e09989

SHA256
19011e4522f20bc23550d493572c910294dace53b978dee4da20215fec467ae8

SHA512
e6bc0107650468f42252b1fbf12d92c1877f5cbe5bd0599ddcc57ace347d401eb7040bba9517ee4b4f025352bfcb88c4f4d2976a6e05ef5e35b89d90395046c8

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
6KB

MD5
07ff6eb4b34405641e642730f20b9b55

SHA1
c88542901cb6959030d0e2fa00733b68cafe486a

SHA256
a3453b7e48d079cffb1dd8db7f7847ec11858eea551badab6ee681f05e84842e

SHA512
263779ccad07a4e8ad69f5aba631c119ee6f21e3bda58f0ce93bac98c2ec3491601278b0890c15a421e812e61b42b3c145e44b9e02ceb5c4c9fc76cae63f3bfa

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

Filesize
255B

MD5
072c23f0bdc509864270c441dfe09d42

SHA1
88f22e06d07cd2c2ceb0cb466006b04902571117

SHA256
67135500a08e0136d06219abc910dfd414fdbf72d2338fd5dedd8adde36db950

SHA512
782d532d255bbf9cb79b4325a030c03bd171f2c933fabf4bea4fda35ba386050b07b0ddd5e0a3f124068f707354c7f45935e3203f877cdc9ba0e5b8d87265465

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

Filesize
323B

MD5
eb6b18cd575796415c078286c42d4e55

SHA1
a54b8ef8c219de6b05e5ed277edc2b2b65ca69d6

SHA256
f8e1193dc99106d52f625118126c6e7670b30b9b66b540afb658a5f62e58c7f7

SHA512
0b7e2bc924f44ae32dbb0cb16d6b8f595f6c23af5b414f631599bc1fb493c3f34a35ddd30a3818f0a4f4bfe8a8a9f0a09284ce04dc8cbd24771f828ef70733a4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

Filesize
367B

MD5
2b4644298e3730c3d29f2dd3cd70988e

SHA1
5b1a09f6cb0c46fc20518955d87303544adbbd0b

SHA256
c975f6a7ea5a7311f369a26516e66e8d849e7bba68eeb27ef0bd1067a43ac25e

SHA512
1708ecbc1895ee0656c17644da425d21874b8f16b93cbd947ef4a4fb8e6620040d91d566cefb4734e3e6ce328e3845387745b2589b7dc877d48e8d4b8cf191a7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

Filesize
148B

MD5
9eb87b3ee6c8a5ed26ce148e884b97fe

SHA1
280786e341cd3cfb5b9a8c47becee2b5a87c0d63

SHA256
1d57944d6ca7fb9a455cee4afbf8bc79559eae3d3cdeb66eabc188ba81c73ae1

SHA512
6fc87689ed58f6fa27657ac8109d387d5b8986e0a1f1f394edaf7ef17ad85e27edd7a922325421041ad498ef90d7220e4cce9b82e3fe1264530319f64c9f7138

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

Filesize
440B

MD5
1d80b9c6d693e8e35394d79fdaa086a0

SHA1
5731a7909b0a5c9db7c1e30a438b300d076500a0

SHA256
f311b8828556481714e563d1c9821067c008d473203bb8f827b15e3444158348

SHA512
381e376f233e80e2519ef5ab6226808ded7165193bc5f55d198704e329678af6430c65d60c596bb4b3d010d3660cb629a828b8bc24d5e50170f4b5090ab79176

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF.CoV

Filesize
462B

MD5
7eb20a5e6b2de2987430dc3d027d2154

SHA1
a53fc75fd0711b373fe0cea956e2cf2116a1bee7

SHA256
3467c89d6ba57dc8dfbe7c31bea5aebf4633c38e0b50428ee28b714446bf54d8

SHA512
351487c0e0502a2919ab7961c0eaaa8d99db4248cfa3414ba9738ee142b9ef49b06526e35a1e5942bb90ffc4bda2dd1a48af65b65ecf6f0e12d3d6520f8c85ba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

Filesize
267B

MD5
41a59d141e679a6eadd022432ccb3854

SHA1
f5b0c3bc9ba833c55da86fb5431bd32959136a23

SHA256
7b8c7b6b60384d31bd0c40d605b20d7fc6e53860a7cc7a8a6959fb8f0b25efdc

SHA512
ad2f12060df9a37d99b1ca7fcc3c7272ed9fa02e436021e77e71e0f33d1c5d4bdf0bf4daa09e84bc9489d3f2310e9259c9de147228b28a4477e5e6e1069fdf26

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

Filesize
2KB

MD5
25efa5c40b4f94213b76a68e69d0c5b7

SHA1
07a3d0fc508f774ca2a2e9806e2cc1f6df142ad5

SHA256
064fb2f7c6de5fbe475bb3783ee08a49082e1a3862a2a940553fe5db794825f7

SHA512
d08b908abec84e13190fa370dfd3b81a91fcfab9df6224f61c5ddb90f2a3e3b4fd308d440aeef638ff83f10bd0b1edbf5785cb6dc539253ebb15a5ab645cb508

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

Filesize
3KB

MD5
9fa0cee7e46fab5c2dc97cd64343c94c

SHA1
a2971112935d7c01b264f4314976dec6b71a3856

SHA256
fbce8f2d6539636588884cbc029fce388539281137362cebd7853cedb3d84ef6

SHA512
455bb98f1257fe0e14b0f503394fc4f6b78e32d5c5e2b8c5596202b058a782cefe3162c06e7ab187987e43406d6da7a66c6c5f431058db05414c33c28be2f7ba

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

Filesize
462B

MD5
d731adb4d1a8183b024f967fb3fc1689

SHA1
3064de8fa9065940906fd953df7c22fc548d4f35

SHA256
6de85f693dad4de3f7d9df141a286b21e3c96e136967af502e75eeb61a4febf2

SHA512
d1361dc94b85fe2838b4b88fe8064c0b8133e6474a682886d0045bbbef4d8ef9c854b8e15fac468a8d9ceda2949020e255a55fd6fc32ba7d0620e49ba72af0e7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

Filesize
264B

MD5
f1e4fc43d880e11753c98b5b6225e50c

SHA1
4840611db463613d77d526f77dcb6e84a36b6f84

SHA256
c077cc46934c3bb5dde158e60d159d390621f82ce37a29affc1fa3fda5de5c62

SHA512
95a419b824b811ddd6f3ecfcc86449aea870ddb63bad5ca1e0652e6a31ca5cc878e7ebf4851d71f564520d52216267a29588e1fa2a0600ad23298a22aa36131a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

Filesize
233B

MD5
2fcf678ad043e5c6b098b9662f87d092

SHA1
30f06dd973682d6e4ca4b3853bef4a99766a3e87

SHA256
1a0ef5e900e80b234bfc765cb828b1dac0c741000c3a0dd15c816d2a39515f8a

SHA512
f36fa07b86833e75cb1b4b681087b2d8a1de92944fe5f48ed87d7e0de72acbe42d3cfc773c871c56637b3886533fa5cd8e8c7f04c752384252ef6b52e5a4d235

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF.CoV

Filesize
364B

MD5
38f61d97d20f621c199dcb42ae4ad266

SHA1
64e4fce895293543776caff172d74259805729b0

SHA256
62493b452eab80e53af7b8721b0a2bd2987e1f780298883d3bb77277935703df

SHA512
a8319d0f35dafa186536b155036267d8ed1df623dffcbd8366df9d2683cd2b189c233c223fa12a4bac47940d6fb0d0d72392c320919f6c28e783c4daeaa46fde

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

Filesize
364B

MD5
fc5e1e2c2473f7ec5cbd1a38e60f6a5d

SHA1
2dde12ce2ca155b6a331258b6b7a36bd429d06bc

SHA256
bbdfb456c18bdb388f51105e0364488ec189a7464d6c7b4183e99b963739b961

SHA512
785cb7e5fcfb5264dee88791ce912b440e31336f7e70b4070433aebe4acb2dfedb32f50617b79b0e4517979a6488b65fbd570914c7e74b4af4b3f86ae3a4045f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

Filesize
6KB

MD5
b90b5889a3cd54decd9780785ee80760

SHA1
f14300b5890601c73a8e3371c256ff069108543f

SHA256
3bb200cd8e7815c79af5b4d902fb8dcab66ab3105194d109e3724370ba266bda

SHA512
f7d7adfcb2701ef7dd7ef7edb6df9cd2eac243345c280d705c3ca02648ce9f65cfaa8ddf4b535c96fc7725dac896ff309bd3a4d9709ddd64b0fb522eca9b65fe

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

Filesize
428B

MD5
0d8c7492896f75294efd79d2f5dab828

SHA1
8470abb7ce555dffa34ffbf5326b6643bc4203a0

SHA256
c5e5086750259d6723d17c81e7d47a707ba55e3e1914d1a2a2a88962c204c9c2

SHA512
768cb4632d4a967ab6c2bdbd337c3294e19510bf393cc5fccb2bf5293bc81e5cf7a71fa64c445c3348a71ddfff4b9dfbc14089ff662632434fbcbaf1ba41d2d2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

Filesize
26KB

MD5
80f16394f6221748957a83bb37dbae4f

SHA1
cdbb926b9e7b370bf3aecb9819212416cbae5163

SHA256
a1b9ae2c7ea44ba59fa98e13797f053545989bed732027490f9f86968896d779

SHA512
c42560b43c519e40b2d658ec5e00f35566fd0756be526fb4972a37b3f1312e51f76bd81382ec8550e7d45a0de961bd18242f537841db26b1f98ee32eb3edc29a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

Filesize
815B

MD5
129167aca3447a114e3f50496a57c2ce

SHA1
b35d689ff156f5a6dfa78d377733738a92084a17

SHA256
48366d8e6a2cabdfa77a756cc1639c0dce155b29a8942e1016caee802ccbe669

SHA512
85db02b82d41da8c1291849b28d553c2109ac24696011f32fcd36e781ec38ffa354cb62808a2672fe77e93d25288421e7d5ae2b53193f7b4e4a80dfe840f063b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

Filesize
870B

MD5
019d034608851d79b85f32b0189f09f7

SHA1
078372282634d3c2a8bd3de106499428e726dc2f

SHA256
daf1653b4ce96a2174a7bdacbdead804a445e269fa914d5d039f9c31e371e187

SHA512
9e817b9220e67738ef4dd2fe2aa26a1cb50d1b471180c7137e030baa486ec9bd016593c7c6c5e2c4153fccfd433f7d91b430e4956ca1ae5b6eed33be8078b1a2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO

Filesize
318B

MD5
71b60a7cd29caba6a9cf0234a2ed4438

SHA1
b1d1f0de7dedee9af365dc7bb6351c61a559ccaf

SHA256
2a1db4c6959d33062f2459002feaa9592288b95e2aefa2c216655332bb64c2a2

SHA512
f7f4de94725f4ef3a38f30ce240bce52d50ca46abb46c64213399453bcbb7be7a3a21519ea47ab7718f1b5f42f1ab17c753c5c32e5e34d475c514743f3f68ff7

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
d502dd00005fcced36b831382566e3cf

SHA1
443637676eeb8d14c70c01fb56ed7cc9fdea7915

SHA256
265e493e1075bca348f0d6280a3a2dc5222b2e40f190dfbbcc2a5b806e29c6e6

SHA512
5cb51bd8918c88092064a10e801b07ac239b258972d76a9cccf0112e31800560e3ecf06f553f77271b5834a57160b82b5a6f128b1c128bde9696f76edf71a342

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

Filesize
2KB

MD5
2fa161e6828635dfecd0df0e540f628b

SHA1
900b601ba13a5048832c84e6bc42f2e486fef313

SHA256
ba684c36f1477921e1ffd52c4e397954de62b5810e6fe287213314aabd6dbef8

SHA512
ba2baf6c09fe31bf471de222f36cd07d2c30ab13f2394956c9236b7a90506b97b0c11cbd986f0467ad6ce0f3e222fe048229b772c0e8edb56d524790f4483619

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

Filesize
19KB

MD5
c2f9188aef797c16c154b6f21af9e565

SHA1
e6bca80075a5a7e0d4a9d6fa2466ff416cc46b71

SHA256
fe73e606531e0f1861c0e88f538312405d957afb3583f21d0c5f831f800eeaa1

SHA512
58067f4d1e4e263df699ee9fdc71610c9e8a3c58b7b77da181b82218bbe7554e52742c212706cc7fd3990035e966b6b61b258b8b23b67c39f9841a719ca93b26

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

Filesize
890B

MD5
8a3746948168230d04520529027349eb

SHA1
cf3ead13feefafb0fab9d85baf5b818e535b808d

SHA256
9156d8ce7eff95491c88557ae9307514212c6f4fba8fe700c988e6524e1bca56

SHA512
649ead18ef4da4dc7f974e85f61db85c353ce98ebb3c637b390c176a6642b9b8e490c7002d67d1706ba1a1befe5ed4f8297b8f85bb73b682138d8046e806701b

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

Filesize
852B

MD5
d90b572d400e1d9db24405a4b33792d0

SHA1
06ee8a69fd26ea21b9474915fb1db30af72a646a

SHA256
74f0b97db89ef6dc07e31b872c473c6c2af872789a0354845bc28b2b1a0b8158

SHA512
4c9fd1f05f9ac165c75f4b62e66f4beacf99c8aef5f71bc5bdbd6da0b0810457458ae2b53382e3492a1740c81143897e89d6ebfcb096dfc9bdcfab23404c9b65

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

Filesize
860B

MD5
0e9b0d844c1f7c7de9316ed96c5228f9

SHA1
8e4c3dab298c8cae5a1576d6fa30b8dc47a074c5

SHA256
6ad50c672ac1599431ba03ebd67e67f7f2b2aa57f7835de248ec4cca65673b37

SHA512
0a648c30e9b9d05ed7129bb3ef25d167a662a60b4b9a6bc1b5980d82dd1faee9fc7c565ea68be87321803921df7e9178ec0838042b2daab63507a591f945fc92

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

Filesize
580B

MD5
87a50b599195c7a9e496fff01268f968

SHA1
9eec73c7e1d142af7221cb3fc96c1f0901febacb

SHA256
8a8c1811c77bb3a25f4b7896ad797a4454022761175dc4a7da6a8d5ac92a1a40

SHA512
4094a975056ddb6c29d9c6e3e3ba8ee48a9f656bb2f89ebe29d8eb6712a2635c6f458a40325179c9933a83608840e16aab6bf8258e2d30d0e40615032e76e4c0

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

Filesize
899B

MD5
bd5483141307dabf5c85ed79c1512a28

SHA1
7229544ffbf83c628a31f8e9b125d0e203c23567

SHA256
a8948ba0bd50ce9af44d24d50272075ae83536a69ef1d65b112f79150e96f4c5

SHA512
e7a5acfc333d264975567fd25ca0768df41423da3392b4fc3889b8e088518db22be1e99d920be04a354819e5db82736480be37bf7ea5e19c4743c7fa6ca29f74

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

Filesize
625B

MD5
2c623d48e20db4e9da22e263dae76e54

SHA1
a3c7ac93260c80a8ffba0f6cb007798770077c96

SHA256
e013d3500aaf6d05ee49a921dd1dc0d3afce01c649b0afecd0708e62bf7ff86a

SHA512
a6cb267b69889348f4889aec5c3eafec5505de7fb2076d608f56d3234d6878d3fcdc8497f4eeca557cf0b1e612798dd09da3f8736e7e0a8da61d942f750afbfd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

Filesize
873B

MD5
736495e6aa6e99c3257525c31f9b7267

SHA1
95b7f78eae7e733a3124e1b9a046dd4e54821c4e

SHA256
077bda01bee719c518eb52efdde9d76425389eb3cc738c957f6fb608a6904dde

SHA512
45d6be9713b3afdb0d70bb086832ef47b8ec8ca9e0c3a97fe58564e8a099c6f09546387dcfdc52ddb72705f4e0274986042ebc19d2b5cefd274b60a2086786bd

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
5KB

MD5
13c2625e0ec9e23358d1bdbb92fa94e8

SHA1
60a6b630119b4e84c7a5e4ccb6b335bc2a6a4285

SHA256
fa136be3e0cf887a6adca81f86f69d99d318663c0403d60d9367fe6c1d77308c

SHA512
0c6e12de8d01910ff544c4bf9f56ca682768ced3d11fe5cf32d683e9b9e22b8421712a9e6c565009a7fef9fcb77f15ce90d524a35bccd9dd993901a937a5815f

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

Filesize
1KB

MD5
ca555d18a72a7a16b64b0159eed1e751

SHA1
4260c8950fc71fda74464bb1e71f730ff8a15390

SHA256
e224e243b059b4731032f3a81967f22f0a8c308a6da78b0960dc222cd1ec0df8

SHA512
6d2a8b1131d1f8cded18cdefe77654db2edcb2bc80350590b79e22111341a478ef897eb1099c9ffc1f6359c7ed1554d4980d8c7320b90430afc3b5004dc5ca18

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

Filesize
615B

MD5
4b48d270b1677d58fd7e54825bf76044

SHA1
f69a2e3847826d0e466bf6409186111d4463ec0a

SHA256
91105a6fbce936aabf660a4c1f5ce8c00d7da2ac771c1174b66fcb327fe830a3

SHA512
7da485458b41c44d0fc7149aba1ac81985e7ba8e812bbed5b5fc4c5eb9a22f6690825083f910e08956375a73aa8dd129f4264bd64080e988268ed6b0dea5d5b4

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

Filesize
848B

MD5
3b137d14b254a69d17d2c8bba8d48fbd

SHA1
2e392f5c7446a4081924963f4c79b4e5ebf7f696

SHA256
e9c2799eb0d437930ccf765d361eb3a294994cec203a388830e574cd27dd981c

SHA512
29f8356cbdecfdebb97ae7879605dc9b422cd3d68887df249669568e0c89b6385772b72d3cedd923532a37ac1381a8f8642770b1a8217167e95790146704b6e5

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

Filesize
847B

MD5
15e1e2eb182f3d2486e636989baa9edd

SHA1
32425a8a18ae445303d980b547f64c676236fc8c

SHA256
44ada55b015cf7a7f8b2cfaafd8180ea03685098a27f593bd8d1eb1bbbe93467

SHA512
c8c29fa2d46fb383a05c7be2c15cd6d4f820a36e3abefeb99e1011168e25f5a0fac84283dd8323f63c36763c3d98033c2e9b25fcbf55981d37295f715b03213e

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

Filesize
869B

MD5
3b50abbd91178d51c520baef4550e17d

SHA1
213a1fe0656f8b6572f272e5fe294e7d27e30512

SHA256
b235822c4fe3a37f07b34d09c52927ea0ab063d8ef1e3cccb988672494b24a53

SHA512
8a9ad814a44cfbfe9953436ac58fdfc29d33b0ab29f74bf16534d9ac6a41a65f29e6aaad0c165f264dcd597ae9fd149abcb6cf21ce7fb45cb6e6f49c4d742a40

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

Filesize
847B

MD5
fbb0356cd404c931af413c5b5c89b3c8

SHA1
f69478b34412dacaad77c3dacff681c521430212

SHA256
a453893bc25dbce8ae4cd44c69275b6773fb75753b06d092a234404d2be6eae8

SHA512
2cb44194bd88fd3839e9ef46f6635eaa0b675c610dd73ced243516500eac28e13033202466cc2f3e475842960e2784830c0e26a94c83a140082a3370cb5a7f14

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

Filesize
863B

MD5
0268ca4cca980cde394e23684481679f

SHA1
b8828f88f9684e8a8202f191a9a5dafe3160aa46

SHA256
702fd09a1b8e7f5202c9e755c4fc69ea2f97a1cf84c6c1eea52fc30b6bdcced7

SHA512
9c31dc3b1449fc39d04eed12834bb0b3fba6b1a5da8a7c3dcae3968e7794bf6f5cc9313ba55a6462e674ef460453fa8350f43ae42469851e60e4fdc54e4a465a

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

Filesize
861B

MD5
1b7c80acaa6686a89866e75e9b9cb383

SHA1
73bda623e9ef22d1f610e2b1c7f73731f8b90521

SHA256
00c409e67deb5e3440deb1405fae4cc1bafc9a41faa7f781858be9cdee2c389f

SHA512
1a73ed041a81fd235e77a02e338cdc276b3bf72605750f19c5968877861fe9c419ac42eed61a23aec15e6d0fd54a0cb21f18140e8bd764efc30b75955b65ac15

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

Filesize
850B

MD5
d766734bd374d573ba782e9843183937

SHA1
293acd88926d13ba74b29db8e8ab0d3a33e32c4d

SHA256
4bdb968a482018849ded7bed4f708f63670710ac53e720d8b7a4c6c6d6f4a0d0

SHA512
a4f650e5b3837808264ff63044a4d760242d75d18e2c9472f404200e41b036a526304af7c6deee2c4a756f4a2b855e516bcd97ef5b9342cbc65a77ac193ba22d

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

Filesize
883B

MD5
0f4585cd36ecad4cffe49e4ade90adb3

SHA1
75d42190a9bbc675d05940999b7e5b01d558d101

SHA256
be6a3a46b41d5b9ef7114d7d27da73e7f5af0dbd598e02bf6e942e060100c082

SHA512
26661274b1ccab00b4ab7e166db3599eed46d96c443aed33b156890ddb74a6f475936d1cd784460e226a8bf2a9d9b3695ca3d098e59b1b0574b9322e35fd3311

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

Filesize
247KB

MD5
392cd5696df756e63276eb41b35ec4a3

SHA1
cbe83ee31aaea14b5be3a0bae21a5b1a5372e280

SHA256
89ed5e9a6c8deefefb88b7834bda43a709c9136278f843730b855f641d1a533b

SHA512
6944336485f228a7383195d772b28d3e8874b90c9e0e6868372dc53156d5fa5e2e4d5dd1225b2c4bb76cf3d4f224b049fde6576403ed8daaeafe14b4d39da4ac

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

Filesize
807B

MD5
7474ad43868b3c7b15a9d10cdd559542

SHA1
bafb27b07a81f73929a47fbc5bf61c3af50b8767

SHA256
931b34ff7c2259580e155e052ca71c1bf567babefc54454382d1a0331a2c4a8a

SHA512
19f0ac877a0748927c1e61a2eb2f3ffeb708ca53ecb614f6abf98b9a75fb7ed9fa27c7dec8b87d789611870e06e7e6d5d3d55b1cc7e15a0da679b6b36d4c08b2

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

Filesize
806B

MD5
26bfca88d43065f74bbeb521a8aa3207

SHA1
4e116a219497f9670051a42e107c29a359a7e21a

SHA256
31c92c6f6e214f5be2da5c43dd0b9e15bd37a1df6bdec66cf6858afdf992e6f4

SHA512
0909f1eff61caba398505d3e5215f09840c82c74ff4e32b6dadf697ff54a4c69e2822673bb26e285ce5b8d10464c8fd28d88c13cd6534a3cfc655e8da9b64ae1

Download Submit
C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

Filesize
153B

MD5
228b63ef5c76ee90228fd3edabccebe3

SHA1
6226140077e93f10a9e35d74ac3ab0556e852d33

SHA256
11b73e6808b34424619868d062a407fea115db92fb1ef60cf5409ec4af7e92d6

SHA512
6fe2c98ad7bd8a308ca0c97393868f37530b706eca5a34e88147df840bafeb014e0106b5cd934b93d1d06e04a536e2d36f8915ec9fd4338e1be52f811327ad50

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

Filesize
12KB

MD5
7ee872c1c537175cb138508a706555c3

SHA1
4f997d5e6ee9c7c4052006c374e289c349d66698

SHA256
7d73ae0c3dc6b5a68bf2034c22d5e0e7672cb773097042bec2ead005c33d5f60

SHA512
a40c2625e2ea9678cb925f40e24482c7aec7cc3f23ec0c538815368857288bc6be225df53b0a6c1f2c6cef2acc8a3ff4fa570e8adbae8202890878676ab5e8b7

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

Filesize
8KB

MD5
0c36340dfa05cb484cf2f10bc48bcaa5

SHA1
7a969c7f83c107d94845103b769bafd5010cf1fe

SHA256
dc1a8d96be4f7af652451610d756359ecc01eceaec6e0a9b9fad8c4a103ee61c

SHA512
15746f3c7ee23c1cf86ac221e0b9c6f84e43eee8f69a466d84cf2ac3eda3612558f056aa75681d8d3be301212dd371d18acc2bac3270bb1c4f0d47d71e5320f8

Download Submit
C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt

Filesize
11KB

MD5
a1eee093d422c569df0b62d4e7e47c44

SHA1
6e671fa38bc8375d3d3e2b94ca4283dfcf322dce

SHA256
2b2341346a15d122df3a1a959676215a5699a65a618f576ea37a86ffb242aea3

SHA512
6b9ffdd3979c3c2fded1c23857858a2a6cefa2a0061e55fba9189082bd1c302d497522385a281e0e108c45348a05b270699dd5a8d68b0a93d030aa45d48b82db

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

Filesize
109KB

MD5
bb0cec949e796d3301d5ee42e92e472d

SHA1
7be80da55188e4439a10f5fe316ff1ca6f3542b1

SHA256
f3ff83cb7aa895de10507944d164d86b3ebf770433e410aeab6753d45ee0c994

SHA512
d376278b309ec4ea808c8162a67f93735178926f82bc350bfbff685c807dd71ec4625f358fabce1f8b3fb290a7bbeea6bec65c7a3d4fa1a71e0d75749564ab33

Download Submit
C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

Filesize
172KB

MD5
a5ec362094698245abb20d980ee2e0cf

SHA1
d3693b833904da9eae7fde897ae402bcdbf34f9c

SHA256
db5bee7389c96955608d4148b7a1af03b24106888e12045d41cce67dcdf56cbc

SHA512
3c36b2460165be5591cd223a14a3b00ac6d674654c63704fe348c53cdd4ac026b720c399137f4fa9d35d628cbeeb67e481f0b1df2abc497b1aa75bafd50cc377

Download Submit
C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties

Filesize
3KB

MD5
2a1a93ec2ac16886c57dada23fd3004a

SHA1
8409d082aacb190b35d2906a8dbff28413f42da5

SHA256
ed8985deb4fb5165c1c6dc3033a5dc71af974da450b1237e02360254c40713ef

SHA512
484f0850d362797b75e09d6a275f0f82e465268cd410a90f45406a829714aaa6bc2d047ab9d621a34469324400ffedd8d3655d79f15b16e19175efa9a43805b0

Download Submit
C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

Filesize
180KB

MD5
1745200818f3a979c32b9c0e6517898d

SHA1
e4e25b128cb2543b7ef803d9fafbdec74c83aa99

SHA256
818f345b5644cdc4f31b03287a76aead6278a7fe6291d382a6f28339fc928a07

SHA512
66a2033387e8cf9ad47730f6456f1d54476feb99e2e3e3ec6db75e8528da28f55cbc5077bdecf7aa1b9268df556b5888d76215f22562ee40316cb2f648d2c028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Stationery\Desktop.ini

Filesize
645B

MD5
841c2a65e113af5550daacad9d57552d

SHA1
0130df73acdad63bd69183e6984080d02209e3f5

SHA256
09d5a3fc41400e89b050b645213d20a88424e00ec10a277572ff28c4c32d8772

SHA512
02f79951b035b4b8663d94651ffbfde380b91babc0f08339fe54d432e3b14a955fa7c38135e44c8dbb59cfdbe245f0a084e939f2b35bd94b9d5fbf98e1e90d5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Filesize
512KB

MD5
d9c5a05b7c1dca784b34f6aef3075a4c

SHA1
e4b5577c47c7c9a6f73f55b2816ea7a3c51231ba

SHA256
bc93db85f9e4b432db7dd341395c08b857c5df016343edf922f81bdc57c4dc65

SHA512
681caf72d79f91fc88934eb9fdda094cbff0aded5a1834a6e9bc63fdd8a54de28d99ce0974ce5be83bc5181fe335569f597a2765c68be518abfa18ca75931faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\homepremium\license.rtf

Filesize
35KB

MD5
e33026272ec5197e97634c1f073723c6

SHA1
c9c8c1477cacbd6a17cb5778f5923fe99de06cb3

SHA256
90631a2509c1e18364d437f2fd6c5b5a86b3a5bdaac1deb377b4f43dde8d415b

SHA512
3349156f3541270d031a15e8becb552d5bc42f5d35bb2c9efc6c7b763d75830b3e8ac73b95c529e9e31a05166dc75d6736ea6f38d6bb747cfcaf190602497823

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sources\license\es-es\eval\professionale\license.rtf

Filesize
28KB

MD5
36e45f8b1c10a61af26094f2df936832

SHA1
2f9c9e65c0463e15e5e32a2da3ef724f09fb372d

SHA256
6e056b4b2f2bb589b6e77d858e5090db38494da51dfb4ad53e1f8368f82bfaf6

SHA512
b30d97489fe245f32ee464d20c9f706aa2809a3ebefd02fac8b4e4c5631ebbcd00034ae03e7a0b3e57b3b0e0d29146ae69151df1339ebc129795370821865e58

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\_default\professional\license.rtf

Filesize
221KB

MD5
9dd6fd8ada9eca25a9b8510871af7c90

SHA1
3e56c813c2907fbc1ebecc7e7ac5a5ea122f073f

SHA256
f81e2e6b7c0407b2ee33f05d8180447e8a57588bd2c0c8963c5cf96943460156

SHA512
dadd1ee0b32211f025d9d8ce70c9e35744dccc7d3c5b2673e577b4bdfda6b9f3077e8b7520f45ef8cd083473eaf94c086cdc38e9b42f6ee6bcc9f460ac11f822

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\oem\starter\license.rtf

Filesize
174KB

MD5
abb05bee223e7acb67eb414638601157

SHA1
27bf58174e8b203b77ca809c4b2a1322ded34c70

SHA256
f5a2e5228cf0b64395d0a304aab0c713a4e324aab63f3710f758a120da0d5365

SHA512
23ca22f988fb477b2a1f2700b253057f9a6aa81de083ca4e5a0cbbe0d2af6dd1441450caabdffe0c87aa11ef5f76524e8d37e3825498c9bfeeb5bd7f07991911

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\sp1\sources\license\es-es\oem\startere\license.rtf

Filesize
41KB

MD5
007bd047624a22a8bdcbb1e1f1ff392b

SHA1
23cd60b241ba4df267018bbbb62ce89804711ce0

SHA256
a0e7b1fe9d22c8dd34889321202abf9c1bd3a5bf16f5c97a603394c19a71cd78

SHA512
680878fbb4eb0859ed6cfa3fddfd312611084a22fefacd2bbd9f00077b370e2f4a216f408f41cb251c6ffdf3b60013a0e56ee6b8670972b483627a12d3ff623f

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7600.16385_es-es_fc29d5bca5556a09\lipeula.rtf

Filesize
9KB

MD5
3be52cdfceff24c9aa2164f546c62e13

SHA1
66da5f7e4259817f3a468d7b73d5592253d12e5b

SHA256
bf2454461424b37752706d56366280a86bc936a0035f70be530e55ed96768944

SHA512
1dc410750cab4e479e89822b761fe8f7fa8906adc0d38d6e8367a736c87d4bae4f66dcd50373a1b34e3dacf2103c11c65fdd2d8e94549a394bd4b48d28ad9084

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9a71deeabfc0d8da\license.rtf

Filesize
39KB

MD5
2c7f61133b8bf76458fcae4dc581d65d

SHA1
3ad2d6a9603d662d6d125ed6d2ab5f4c55398c20

SHA256
5515f402df6fd578ca773cd94f8aaa22ab106e85446e04c8632a13a7000e6e58

SHA512
bbcdbefd2c6c12a19f443fd5f38b38e2410494a8496dd3e45bc445afae68311065ac1c0acf122ddf6bc4157d7f8c2999aa18dfa12428caabdf54c50074e4ce73

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..m-starter.resources_31bf3856ad364e35_6.1.7600.16385_es-es_30cf7a89f238525a\license.rtf

Filesize
43KB

MD5
bd9a2e9549549de8091a9b691d461744

SHA1
668d2804cb1c7cddee0da6d91604163c5cde6339

SHA256
1b844035092592f8f69069f9ec52de747082c73bd2943a0bab8685a190b71018

SHA512
d3ed7a26f352fe7ce5ca7f76379e3bd38678042413d39ef949c7f49d2869ddd811c431ad4b28c1f3945e238ddd361ced0600a0d27fb822f57f48c25c44ccad05

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7600.16385_es-es_16d3f6301ae8cff8\license.rtf

Filesize
758B

MD5
fce254627e63bff572e90a769fb51dd9

SHA1
75bc6bddfde14b75bb0e0905de4f84a25feb4696

SHA256
4d072cbe7cbd9ee7f1acd37253c4384afdbbaf4697ce9cc1e95d952750769b94

SHA512
24f7a558f190d3c1bccd38230a85d2af2d3bd54332b10c89f08599b24155c340f17450b419d67542cbba4e242bb98dc1f75bce659835246f89f3243642c41074

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..priseia64.resources_31bf3856ad364e35_6.1.7601.17514_es-es_382fefd2e1555940\license.rtf

Filesize
68KB

MD5
0bd01e6077ebaa431e58e57f5fddbdb8

SHA1
71008a4833e698ede921b88dc80c7b13224b5ba4

SHA256
f22be85a6689cdfbf4040d42f2e2602f5601f1dc1acb87cbf92d06f93b395694

SHA512
56d153b9dbe8eff5f321777f2f615037e70ffcb694ea765f1e91d018e07a667baf4c386d5e5224a204cbd292e4da6edbc97db17bb315a484f99d16d22cee526c

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..rverhyper.resources_31bf3856ad364e35_6.1.7601.17514_es-es_b990ce545164c82b\license.rtf

Filesize
62KB

MD5
9f2a08a55a3586a8948ecbdf2547a020

SHA1
e219114b04bafac88054c174e66431bbf859782c

SHA256
cf555c9c56112c46ad69c31c7eb163fc90e04e34bca13ae7f69dfc00c7211b1f

SHA512
bc04d24953e245c40e3b3ed6f8696dfc487d7a3bb0a1d3bccd58c9939eb94cafea1311b01ea7100ad1349f013675e44a45ff4713b7325052b62f5c34d2557b91

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7600.16385_es-es_b1cda3731d74e249\license.rtf

Filesize
780B

MD5
276e61656172cf6103140ee4d22af44b

SHA1
17329390c4727986b3971c7fd3cc5fde559a81ad

SHA256
03aed20a23ac3131d99a429a745dae59df4d7f1baf95c3b87e80ac6317df9cb1

SHA512
3573221f811fd6b925122d8148721754e251c9c622ce7554df182f0d584d887be9570aa04df4825b04f259da3f63e923185de79cc4748e18177825a425a84631

Download Submit
C:\Users\Admin\AppData\Local\Temp\lpksetup\lpk-tmp-00000006\x86_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7600.16385_es-es_18649662a3c65f12\license.rtf

Filesize
780B

MD5
ffc3a66e1ad5a133b332435a38c48646

SHA1
5ac64b8d3805cd036d873598add40866130271ba

SHA256
e388fba43269a51eb11dc7262818ca540aa62636dae4d71ddef268e1a7d773a8

SHA512
45bad9d36d2e16a530be5b3d9b11225fc58e380d0c896441ac901bffb1aa584472fea744d0f9300f546e6824928f8a8d83d43b218a1fa702f60eaeceabab3ef6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\dt6wk0rq.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Filesize
48KB

MD5
b4435b8bfb8910d10e7b90d9c79ae4d1

SHA1
d943c41e9692f41344bb72ab3b5c49a827924764

SHA256
b2e02567bbd4c4f45539f76ba50a1c4b3b6f50f6c30c1424fd4bf6d9853b63a8

SHA512
4e0a1a28df2bccda09a746270ce6c386ec1666d4192c5120e246b24ed06b7fcedbd52e998f326b80903db9d0c483e7163df52f0f4ae8da0f8856dff1689cad2f

Download Submit
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk

Filesize
1KB

MD5
a4c2196ca2c37d01c9af78a51b92a30c

SHA1
aa272d862c127403f6bf584ea64ea0c5739fe619

SHA256
259e9a62d754809afa78e770af74a9ab7c28d7477f5949202d8b55471199c05d

SHA512
d6c80d7f9373cb2445340ed2e0b2e84d80e41eea3f67a100da7a79672c35fea8c67d2c33e83548741cf811af74d4b7d690c590e71ef6d9992070df1e74b1e28f

Download Submit
C:\Windows\inf\.NET CLR Networking 4.0.0.0\0006\_Networkingperfcounters.ini

Filesize
162KB

MD5
9e41d855a28449c156a9a5f1904b0750

SHA1
0282a9458030b884af192de796a5ea0e6179da75

SHA256
1129984382f4a68b27a2be00ed0b8045174b9898a561b7cc9cdc2ff673f418a5

SHA512
3ddbe4dc287d125a9f43b706f6a221e8b06e117e6da9238427a46f3c4276cbf20b4e420066f9d01ddc51feae987b4ac5eb48ffe0e6988b10b9eefe71ceb40c18

Download Submit
C:\Windows\inf\ASP.NET\0005\aspnet_perf2.ini

Filesize
972KB

MD5
9f8462853a960ce8e1c648d78b072a53

SHA1
1d54b24b45ae74bc30b9db02df9f211769622e30

SHA256
60f8b861855a45dced06358b86f40fcc9a93f9aafac0acb9d87893e27eeca44c

SHA512
9beb27660207d1c59f92ef98ce5f902bd97442bcddb391e819a0c6d3dfc619e1b949003a8286e5990f12ce0e0fcad0b714d24744ffe4d4be777d29085feb73bf

Download Submit
C:\Windows\inf\ASP.NET_4.0.30319\0005\aspnet_perf.ini

Filesize
974KB

MD5
b7ffe2864fd8ef4511040695576f32f1

SHA1
516ff34e93adb5422e71c58e5978e4b54beb7f2b

SHA256
375adc01db3f630fe87539832bcf9e50ecb631e0b69553aad429db41da5625e9

SHA512
0530e517597fff5702608d6fa70dc2bf5acf3a28d7393d73a4dcbe8fd18d21860626de1c050e4eb6b62a76d5b2fef4ab29ea7830f3fb8af1b7d5fb468d218796

Download Submit
C:\Windows\inf\MSDTC Bridge 4.0.0.0\0006\_TransactionBridgePerfCounters.ini

Filesize
132KB

MD5
8fd966eb4d66de16bdeb129db8893f81

SHA1
e488058a223ca70d59d293ba04a8f1e0fcb3eb6b

SHA256
e93a8982d64684b4c745b91b2c48287ccb4670cdf2c06e5b2dbba6c2d9f15fdd

SHA512
e200e5c961ec7f91cbc714c04acc00c077785d8a2428faf30a8626e01818ecf12cbaeba27a21e4e2156453fcaef816733a69ebfebd70da64362f2c2a1ed5305e

Download Submit
C:\Windows\inf\PERFLIB\0409\perfc.dat

Filesize
30KB

MD5
a3764097574710f25571c37d051ebd5c

SHA1
8c727ebd2e7a8053a30b1afd1dbf165a0a61c460

SHA256
a19a85cabe82973dbedbebf46b089edc3714eb569806bc33130e3e4754ef9a5e

SHA512
e18ac24c9638836642909d81ecee2c65fe13f5fa7d60c7d1ec883698925ea80fa85529bcae5becad72e06e2e3547215f8e1828861fb89377e7bd94ff9807dc57

Download Submit
C:\Windows\inf\PERFLIB\0409\perfh.dat

Filesize
284KB

MD5
4dd3d2aceaddac1a3ec5dbaa76d8c782

SHA1
8fc8b8892daf90dcd22892c7692061e0217ffce1

SHA256
834aabd33f4a82293e66df637628606eb0b99b9c88244d398fd561d6f68b9c78

SHA512
cd2d310a46b12094a26c295f3f525eba9d2e5e53781d2d106c13447d06b053ea4de50fca5e3bbf3a32a6220c836f6b8e9083c58a9e3ce956f3a69344d42e02b6

Download Submit
C:\Windows\inf\SMSvcHost 4.0.0.0\0006\_SMSvcHostPerfCounters.ini

Filesize
130KB

MD5
b7c916f25377c35da99e87dd5204187b

SHA1
3b16fa31ca23c584736142b5bcd6b7a924f34beb

SHA256
188c4c6b96179a2c804fbc0f3d93e6736b4366194ea79644b0726be3345c099e

SHA512
c64a5c27cffd634547ac7b47433ff0fb72e309281ccb36b86c50e89ba555e9dab400b23003934cf7a8ea5bea521e6b59fcad2c8fe306edc5924f000cd81072aa

Download Submit
C:\Windows\inf\Windows Workflow Foundation 4.0.0.0\0006\PerfCounters.ini

Filesize
150KB

MD5
7f6de799b3486e22681013863de66b49

SHA1
42ed6cb707ec091f7d273e9a409451cfe0fc2aca

SHA256
5235443d578afbb56aaa2e983b7372d26c214ce91583085c2cf547f92eff1e11

SHA512
c546fc185075581c9c7bb84e77f9f28b840059d57243c504a8386a1d29cd17ff01d1037b398db726e6da164c6dcb7f9aa729614f490346ef2726cc7751ca8e30

Download Submit
C:\Windows\inf\aspnet_state\0005\aspnet_state_perf.ini

Filesize
41KB

MD5
9fc218164fbcbd25c9011a5f2a01834b

SHA1
75b658edb69c3143430b69a9200665483b588442

SHA256
21e65a7ad982be061d90421c1eb978881a34eb56833649f074a2fd473e3cae2e

SHA512
75b485ff5b2c0ed1ccfe788fdd26f7bcf31701fb4e7f9afd2928e7220d7c1d125dc621f3062a93d273e2f79958a6e178519752f14f13e2a072eeab15b457da1d

Download Submit
C:\vcredist2010_x86.log.html

Filesize
81KB

MD5
793650fb2e9ad4d2b683ebdd96f77fed

SHA1
d845a1b3b2e61e6caa42c5f86e9ef3658097108f

SHA256
be971b8dd8687426af831c9796ad4b8e2daf77d09d541af816880fdbb1e70700

SHA512
3819555f65b345bb375cf37fd964a553835375b3d9b29347e0e850e17e30a257c495f052a1a4380e68f1ed3c6046015c3375b3c07be929edc43fb3f32017c19b

Download Submit
memory/2876-3833-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-5779-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-19433-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-20853-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-14096-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-15103-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-18343-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-9907-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-1794-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-16683-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-12754-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-1781-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download
memory/2876-10-0x0000000000400000-0x00000000007A2000-memory.dmp

Filesize
3.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads