Overview
overview
10Static
static
10IQHGV07FDy...2).exe
windows7-x64
3IQHGV07FDy...vn.exe
windows7-x64
3Junk)2345.eml.ViR.eml
windows7-x64
5PC Cleaner.exe
windows7-x64
10PC_cleaner...ed.exe
windows7-x64
3PC_cleaner...ed.exe
windows7-x64
3Pizzacrypts.exe
windows7-x64
9Ponmsiyyks.exe
windows7-x64
3Rlesvxamve...on.exe
windows7-x64
SATURN_RANSOM.exe
windows7-x64
10ScreenCapt...er.exe
windows7-x64
1license key.exe
windows7-x64
malware.exe
windows7-x64
8mamba_141.exe_.exe
windows7-x64
1mamba_152.exe_.exe
windows7-x64
5microsoft-cleaned.exe
windows7-x64
3msiexec.exe
windows7-x64
10nc.exe
windows7-x64
1nd2vj1ux.exe
windows7-x64
notes.exe
windows7-x64
nzpuHohZGP...2).exe
windows7-x64
3nzpuHohZGP...sr.exe
windows7-x64
3old_14b68c...0d.exe
windows7-x64
7patched.exe
windows7-x64
9pclock.exe
windows7-x64
7pclock_unpack.exe
windows7-x64
7pitupi20.exe
windows7-x64
10pozhehgxml...co.exe
windows7-x64
7ransom_50....0b.scr
windows7-x64
9ransomware...20.exe
windows7-x64
9safeinf.exe
windows7-x64
7schet1074....16.rtf
windows7-x64
10Analysis
- max time kernel
122s - max time network
123s - platform
windows7_x64 - resource
win7-20240903-en - resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system - submitted
22/11/2024, 03:36
Behavioral task
behavioral1
Sample
IQHGV07FDyQ5u7bmNAvn (2).exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral2
Sample
IQHGV07FDyQ5u7bmNAvn.exe
Resource
win7-20240729-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral3
Sample
Junk)2345.eml.ViR.eml
Resource
win7-20241010-en
windows7-x64
6 signatures
300 seconds
Behavioral task
behavioral4
Sample
PC Cleaner.exe
Resource
win7-20241010-en
windows7-x64
21 signatures
300 seconds
Behavioral task
behavioral5
Sample
PC_cleaner-cleaned.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral6
Sample
PC_cleaner_database-cleaned.exe
Resource
win7-20240903-en
windows7-x64
1 signatures
300 seconds
Behavioral task
behavioral7
Sample
Pizzacrypts.exe
Resource
win7-20241023-en
windows7-x64
17 signatures
300 seconds
Behavioral task
behavioral8
Sample
Ponmsiyyks.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral9
Sample
Rlesvxamvenagx @ZL@0ECpw@ZL@ .xml.zyklon.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral10
Sample
SATURN_RANSOM.exe
Resource
win7-20240903-en
windows7-x64
20 signatures
300 seconds
Behavioral task
behavioral11
Sample
ScreenCapture_Win8.MalwareScanner.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral12
Sample
license key.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral13
Sample
malware.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral14
Sample
mamba_141.exe_.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral15
Sample
mamba_152.exe_.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral16
Sample
microsoft-cleaned.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral17
Sample
msiexec.exe
Resource
win7-20240708-en
windows7-x64
21 signatures
300 seconds
Behavioral task
behavioral18
Sample
nc.exe
Resource
win7-20241023-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral19
Sample
nd2vj1ux.exe
Resource
win7-20240729-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral20
Sample
notes.exe
Resource
win7-20240903-en
windows7-x64
0 signatures
300 seconds
Behavioral task
behavioral21
Sample
nzpuHohZGP2RNfMTp0sr (2).exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral22
Sample
nzpuHohZGP2RNfMTp0sr.exe
Resource
win7-20240903-en
windows7-x64
3 signatures
300 seconds
Behavioral task
behavioral23
Sample
old_14b68cb9f911ce937f52ed8282ef4395f2291c0a23f14d33f731a15572834b0d.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral24
Sample
patched.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral25
Sample
pclock.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
300 seconds
Behavioral task
behavioral26
Sample
pclock_unpack.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
300 seconds
Behavioral task
behavioral27
Sample
pitupi20.exe
Resource
win7-20241010-en
windows7-x64
13 signatures
300 seconds
Behavioral task
behavioral28
Sample
pozhehgxmlhobpvwlqco.exe
Resource
win7-20240708-en
windows7-x64
2 signatures
300 seconds
Behavioral task
behavioral29
Sample
ransom_50.00_dol_df410f19157f591860e1633b85dfb50b.scr
Resource
win7-20240903-en
windows7-x64
8 signatures
300 seconds
Behavioral task
behavioral30
Sample
ransomware1061911a3e0a74827a76bbd7bfe16d20.exe
Resource
win7-20240729-en
windows7-x64
14 signatures
300 seconds
Behavioral task
behavioral31
Sample
safeinf.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
300 seconds
Behavioral task
behavioral32
Sample
schet1074.15.03.16.rtf
Resource
win7-20240903-en
windows7-x64
14 signatures
300 seconds
General
- Target patched.exe
- Size 1.3MB
- Sample241122-d54ddstney
- SHA256 eaac4bcbf42384c31cc4f1e217e7becd9217647aa693e93488d2d9559127dc3f
- MD5 7d2af690ad89d53ffc070f066a778edf
- SHA1 29d212d55c2d41efe96ca384132ab935d6f80861
- SHA512 ebb6bf66361fc6e72f463f61b9eb18f7fec51e1551eac78b1cf0fb4a900568d5d99ca34517f90396a08cf5794a38f666c8affb28a136232f459237ff9c82acda
- SSDEEP 24576:R9WQitvyUilzOUxaOWk01G4fbu/F41jen6KXYzkEEknJS7DFN4L3GmPA705sCvsF:R9WDAUozOUxaOyGau6I6WPDvlAAoefk1
- MD5 SHA1 SHA512 SSDEEP
Score
9/10
Malware Config
Signatures
- Renames multiple (2223) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Drivers directory 8 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\en-US\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\drivers\es-ES\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\drivers\fr-FR\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\drivers\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\drivers\gmreadme.txt patched.exe File created C:\Windows\SysWOW64\drivers\it-IT\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\drivers\ja-JP\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\drivers\de-DE\HOW TO DECRYPT FILES.txt patched.exe - Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\HOW TO DECRYPT FILES.txt patched.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Alcmeter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe" patched.exe - Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalE\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\migration\WSMT\rras\dlmanifests\Microsoft-Windows-RasServer-MigPlugin\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\UltimateN\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx00y.inf_amd64_neutral_977318f2317f5ddd\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-COM-DTC-Setup-DL\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_remote_requirements.help.txt patched.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\en-US\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitsTransfer\ja-JP\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnbr002.inf_amd64_neutral_db1d8c9efda9b3c0\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\ProfessionalN\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Ultimate\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnca00f.inf_amd64_neutral_777b6911d18869b7\Amd64\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnge001.inf_amd64_neutral_cfffa4143b3c4592\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_logical_operators.help.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Throw.help.txt patched.exe File created C:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicN\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\angelu64.inf_amd64_neutral_3d6079dd78127f5e\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\keyboard.inf_amd64_neutral_0684fdc43059f486\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\umpass.inf_amd64_neutral_e3be362bfab667d2\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmairte.inf_amd64_neutral_0feacd08cb9c7fe3\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\Enterprise\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\it-IT\Licenses\_Default\EnterpriseE\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\es-ES\about_script_blocks.help.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnms001.inf_amd64_neutral_9fe8503f82ce60fa\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\tsprint.inf_amd64_neutral_c48d421ad2c1e3e3\amd64\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_escape_characters.help.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_wildcards.help.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_objects.help.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\lsi_scsi.inf_amd64_neutral_cfbbf0b0b66ba280\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnky309.inf_amd64_ja-jp_afbb421e3dc1cb6b\Amd64\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnlx004.inf_amd64_neutral_2cf95f307381e481\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnkm003.inf_amd64_neutral_48652cda3bb15180\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\spp\tokens\channels\OCUR\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_Variables.help.txt patched.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasic\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\ja-JP\Licenses\OEM\ProfessionalN\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\averhbh826_noaverir_x64.inf_amd64_neutral_2fe3b14136d6e46d\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtexas.inf_amd64_neutral_7572473d88d69307\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtron.inf_amd64_neutral_1121c7f92e9e3001\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmtdkj4.inf_amd64_neutral_c150a510c4b85ce7\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\en-US\Licenses\_Default\Starter\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Signing.help.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\it-IT\about_History.help.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\brmfcmdm.inf_amd64_neutral_af49d2f3ffa12116\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\Speech\SpeechUX\en-US\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\de-DE\about_regular_expressions.help.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\cxfalcon_ibv64.inf_amd64_neutral_d065aec3fcf4ec4e\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\hpoa1ss.inf_amd64_neutral_8cae09a2238d64e0\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\prnhp002.inf_amd64_neutral_04d05d1f6a90ea24\Amd64\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\ja-JP\about_hash_tables.help.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\scsidev.inf_amd64_neutral_a7f5d9f34b621dca\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\IME\IMEJP10\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\fr-FR\about_wildcards.help.txt patched.exe File created C:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicN\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\it-IT\Licenses\OEM\HomePremium\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\ksfilter.inf_amd64_neutral_86311fdf78a07678\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\netvg62a.inf_amd64_neutral_5817ae5135655364\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_modules.help.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\crcdisk.inf_amd64_neutral_d10626d1f8b423c3\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\System32\DriverStore\FileRepository\mdmcdp.inf_amd64_neutral_170c11f3a6d3f0a8\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\Speech\Engines\SR\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\SysWOW64\migwiz\replacementmanifests\Microsoft-Windows-GameUXMig\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\en-US\about_Comparison_Operators.help.txt patched.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\behjjmpbbeggjmbb.bmp" patched.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationRight_SelectionSubpicture.png patched.exe File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files\Microsoft Games\SpiderSolitaire\en-US\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bNext.png patched.exe File created C:\Program Files\Windows Defender\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\CPU.Gadget\icon.png patched.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382957.JPG patched.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png patched.exe File created C:\Program Files\Microsoft Games\More Games\fr-FR\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files\Windows Mail\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files\Microsoft Games\Chess\es-ES\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\144DPI\(144DPI)greenStateIcon.png patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115835.GIF patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR12F.GIF patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif patched.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Peacock.jpg patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_MATTE2_PAL.wmv patched.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\logo.png patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\babyblue.png patched.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\THIRDPARTYLICENSEREADME.txt patched.exe File created C:\Program Files\Java\jre7\lib\fonts\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\spacer_highlights.png patched.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\novelty_m.png patched.exe File created C:\Program Files\VideoLAN\VLC\plugins\visualization\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files (x86)\Common Files\microsoft shared\ink\1.0\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD10263_.GIF patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15060_.GIF patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14594_.GIF patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR51B.GIF patched.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\en-US\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files\Microsoft Office\Office14\1033\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_blue_sun.png patched.exe File opened for modification C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color32.bmp patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01838_.GIF patched.exe File created C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Currency.Gadget\images\add_down.png patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_SelectionSubpicture.png patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR35B.GIF patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIconMask.bmp patched.exe File created C:\Program Files (x86)\Common Files\microsoft shared\Filters\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21323_.GIF patched.exe File created C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR49B.GIF patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\TAB_ON.GIF patched.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\info.png patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv patched.exe File created C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files (x86)\Common Files\System\Ole DB\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\HOW TO DECRYPT FILES.txt patched.exe File created C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\SpringGreen\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_m.png patched.exe File created C:\Program Files\Common Files\Microsoft Shared\MSInfo\it-IT\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_SelectionSubpicture.png patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png patched.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp patched.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01292_.GIF patched.exe - Drops file in Windows directory 64 IoCs
description ioc Process File created C:\Windows\winsxs\amd64_microsoft-windows-fsutil.resources_31bf3856ad364e35_6.1.7600.16385_de-de_1c2ddcfcf9ac26bc\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntwin.resources_31bf3856ad364e35_6.1.7600.16385_de-de_2dbeaeba93256e3b\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\msil_microsoft.tpm.resources_31bf3856ad364e35_6.1.7600.16385_it-it_24501f4296ed154c\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..serverbox.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_3fd4c32af4340f91\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-n..nosticsframeworkapi_31bf3856ad364e35_6.1.7600.16385_none_2ac806ae0c716003\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\inf\es-ES\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-n..orkcenter.resources_31bf3856ad364e35_6.1.7600.16385_it-it_9bc9029defc7db8c\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..g-jscript.resources_31bf3856ad364e35_8.0.7600.16385_fr-fr_6d28971d0a166941\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-fsutil.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_97d05fa8ed72c0ab\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-msidle_31bf3856ad364e35_6.1.7600.16385_none_cb5832fe03fa7bbb\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_ehstorcertdrv.inf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_7d2956179d3f73db\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-vssapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e5666bc434880c14\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-alg.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b09e0ee225f9b48e\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-atbroker_31bf3856ad364e35_6.1.7600.16385_none_2b95a17838063e9b\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-g..shell-exe.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f3c927a21fd447e6\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\wow64_microsoft-windows-smss_31bf3856ad364e35_6.1.7600.16385_none_128443f66743685c\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\msil_system.web.mobile.resources_b03f5f7f11d50a3a_6.1.7600.16385_de-de_6831914153c5e881\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-s..structure.resources_31bf3856ad364e35_6.1.7600.16385_de-de_f5e4fcf2a8f283ed\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-p..gssystems.resources_31bf3856ad364e35_6.1.7600.16385_it-it_44a14691bcd69ec3\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..t-tracker.resources_31bf3856ad364e35_6.1.7600.16385_de-de_d8f8d4788c6f4969\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-t..ingwizard.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_3e21ff68e3f3244a\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..mcore-dll.resources_31bf3856ad364e35_6.1.7600.16385_it-it_c05f98e10db80260\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..sh-helper.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b0039ab1e26e1a3a\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-h..-bckupbas.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b804f6a281eac43b\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..yer-wmasf.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_e5b75a510b080a6e\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-taskscheduler-netapi_31bf3856ad364e35_6.1.7601.17514_none_67e6c3074ea71107\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_de-de_7f0b185800a159c3\about_data_sections.help.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-recover.resources_31bf3856ad364e35_6.1.7600.16385_it-it_efc42da1d580cfbf\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-weather_31bf3856ad364e35_6.1.7600.16385_none_4db0b909695af8f9\47.png patched.exe File created C:\Windows\inf\MSDTC Bridge 4.0.0.0\0007\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-cryptext-dll.resources_31bf3856ad364e35_6.1.7600.16385_de-de_22769c28e109cca7\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-m..oundation.resources_31bf3856ad364e35_6.1.7600.16385_es-es_ea6967d5d5c25c68\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\inf\aspnet_state\0008\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_mdmcxpv6.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d07101ecaa44c4af\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-o..iadisc-style-sports_31bf3856ad364e35_6.1.7600.16385_none_c1c84490c211896e\SceneButtonInset_Alpha2.png patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-winbio.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_269ffdbfc2380290\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-directx-direct3d9_31bf3856ad364e35_6.1.7601.17514_none_c454d690bf084f04\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-w..consumers.resources_31bf3856ad364e35_6.1.7600.16385_en-us_bc0f773a38ccd97f\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_prnsv004.inf_31bf3856ad364e35_6.1.7600.16385_none_622bdff1f27c66b3\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-h..trolpanel.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_505df2ddbfe9837f\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-mprmsg.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_2738fff0220e9aeb\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-w..eprovider.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_91f48c032f4d488b\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\assembly\GAC_64\BDATunePIA\6.1.0.0__31bf3856ad364e35\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-c..lter-html.resources_31bf3856ad364e35_7.0.7600.16385_ja-jp_a8c1454c420eb64c\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-directx-dxgi_31bf3856ad364e35_6.1.7601.17514_none_98a47dc2352c4409\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-i..filercore.resources_31bf3856ad364e35_8.0.7600.16385_ja-jp_0907d2ca42255393\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_ph3xibc4.inf_31bf3856ad364e35_6.1.7600.16385_none_9df3f03bc8c0b681\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_netvfx64.inf.resources_31bf3856ad364e35_6.1.7600.16385_es-es_9c60c2c0fdd2e5ac\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-hbaapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_9074a1cbc57f4f5b\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-s..pertypage.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b2c2c45845a43e42\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-rssfeedsgadget_31bf3856ad364e35_6.1.7600.16385_none_ab6782291b0ca7be\drag.png patched.exe File created C:\Windows\winsxs\amd64_61883.inf.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1e9ce6e4917186d5\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-sechost.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_0bc9003d4dbc0917\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\msil_microsoft.security...t.cmdlets.resources_31bf3856ad364e35_6.1.7600.16385_de-de_22ed2f326f533b67\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_microsoft-windows-i..o5-codecs.resources_31bf3856ad364e35_6.1.7600.16385_it-it_8bd4797b4dbcc883\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\x86_netfx-msbuild_data_files_b03f5f7f11d50a3a_6.1.7600.16385_none_5111c1c5febc8960\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.VisualBasic.resources\8.0.0.0_de_b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-bootres.resources_31bf3856ad364e35_6.1.7600.16385_de-de_94c9843d817470cb\HOW TO DECRYPT FILES.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-diskpart.resources_31bf3856ad364e35_6.1.7600.16385_es-es_2c57e9cd579f2d2b\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_c02a16e1ae17ab94\about_functions_advanced_methods.help.txt patched.exe File created C:\Windows\winsxs\amd64_microsoft-windows-raschap.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_b97ec357ecf98240\HOW TO DECRYPT FILES.txt patched.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-p..ll-preloc.resources_31bf3856ad364e35_6.1.7600.16385_en-us_27fbee50ef7f6588\about_Line_Editing.help.txt patched.exe File created C:\Windows\assembly\GAC_MSIL\Microsoft.Build.Tasks.v3.5\3.5.0.0__b03f5f7f11d50a3a\HOW TO DECRYPT FILES.txt patched.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language patched.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015! patched.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.CryptoTorLocker2015!\ = "PRPASCBHJSZLMOM" patched.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\ = "CRYPTED!" patched.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open\command patched.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell patched.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open patched.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM patched.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\DefaultIcon patched.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe,0" patched.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\PRPASCBHJSZLMOM\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\w8i9eHkHOwWwQlX.exe" patched.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2780 NOTEPAD.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\patched.exe"C:\Users\Admin\AppData\Local\Temp\patched.exe"1⤵
- Drops file in Drivers directory
- Drops startup file
- Adds Run key to start application
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1480
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Public\Desktop\HOW TO DECRYPT FILES.txt1⤵
- Suspicious use of FindShellTrayWindow
PID:2780
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\HOW TO DECRYPT FILES.txt
- Size 939B
- SHA256 a2ce2b6c9fc04d26e595e45849916efe01ceba18159013171ce44142830aeffe
- MD5 6468d057d7cb30ecd6283ea01e6ab5fd
- SHA1 df5379d633e558544ebfcb88b6ad3f53e6df09b0
- SHA512 be080542f286df5cd9ff126dcba0057ef0ecf2d8b7767911035f419fc5e8dab4f1a055c04d07e4337af8fdebfae6a254337ab20ab0309eaa1696a1e14f87c10a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF
- Size 341B
- SHA256 9ee38814debdd2d38f3c9f6363d5f7fa77f423bd33d76fd2a074a7fb6cb7a928
- MD5 85ebed08c41b43efbf4a4f555afa2d0e
- SHA1 eed2e36357889c9295ba65b12aed733515eed6d7
- SHA512 15be03f2df3bdd6b2a0a355924b1024947e91615dea1be1309e791db18ce1c33a09173d348a6c14edd8db6784439927946d6b2c4377919105012b537fbfdbd1c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF
- Size 222B
- SHA256 103f9efbf111ee715ce67f81c3fbe566f93c1e71cec4bac7020ca0eab7c6cf1e
- MD5 06df8edd89154d68c49af15d65720af3
- SHA1 be179da8a60543d3e0bd828be6a9bd3401ed2664
- SHA512 b13a57147f34cfe6cc7728f80ea62e4cd31f734e4f9d5b7ae9d45f9e4e2e9704a93292342b0ec45bcde4e4796f74b53722a79ed31e5a8c00f1ac1edb28e0229d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF
- Size 24KB
- SHA256 b5648a7bc06ac614a32061c53f70c852df9f09d6c634a2494bb5e5d81d6216ba
- MD5 4ef1096e556fbfc5fde3e1fa06304f73
- SHA1 461f0c5affaf5efdb569e0e696579fc7c993050d
- SHA512 32c1db24fd9f823431c14935b2623262f100f33ed962dc1faca7c28cec7ba25eb8b31cd12da94f7763e212d50aa454ee2f389776c9b19f20b377dffb8ad35d80
- SSDEEP 384:sFsZ9cYqTB/W/mcJ07J5XkDK60hyDqetXNnMJsyfzKDgwf0F9APXuQRn61M40Ec:shX9/mmL1f60hEZQJsy7MgV9yuQJ6T2
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF
- Size 185B
- SHA256 64a56358c52fc799a001e3a565b1606795e3fd72a5364512ef23c6f168b3b284
- MD5 97596fb884501ca1680cdf19ad5418c9
- SHA1 0017139a784fb05c7cbc2286492b233ce9dfb909
- SHA512 d4517e46db786e811c1ba8710464d379a9d6b70df7ab29bb78e1f9d366fc61bacc39991c2423194560bfca2a060a1b04c5b02dc25164e765a288f880c1d33da7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF
- Size 496B
- SHA256 caa9b95b19cdad10bde5628a9613ab9d93b3943ac9a2a28d42eba1f2b2ee429f
- MD5 110879749f7228ff0ed850cffd64b0d1
- SHA1 ebafaf8a53fc98c7cdecff5e70890681102cfa78
- SHA512 46c0379bbe55907ae3416ce188b5cf86982af4372e7f2ab4601ce731f4c3a111b0923e82f941186bcfcf04ed0cf0f78092d276b157484463a24c803c66901459
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF
- Size 1KB
- SHA256 85746c8ae6da83216af31569503c86b1011055abbdabfc5a7c98ccca56626fea
- MD5 a3fcdcfe734d663c003ee6d2b4cc1c3b
- SHA1 3f6297c831b3611f403a878cb39680403d33c603
- SHA512 1cf3c313c446c16d2a3af3041bbac7a6be229b9dbb95c0b48ab2841e054fdf6da9432b87ffe4fc15e35d46a138ae3d3eb0e01e5aaa1ebe110404cc176460b616
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
- Size 5KB
- SHA256 b046cef058bd43d6afa4c5d4eb1c563edb6c7dfee97dc25e77f3cfe25c888aab
- MD5 78b05b567f3d91eedf537e28cc382a73
- SHA1 56631473dc2ebaa4d98307b8966f102822f79f3d
- SHA512 32aa999092d8d2a7cb67370f5c26ea3ca761611cbc841d49999cea3c0ec3ed91478eb1e3cae0bb5afb303931a5d59c09189eb85ef301a634d019d5a4ea79c2cc
- SSDEEP 96:stTOMnu+xGl+XEpNJ/LBJjHFO+s0USBmtZUYK2jBbP0/qbn2bcdhJgKH:siSu+xrU75LBJ5AGOTVjd0/M2gdhJjH
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
- Size 31KB
- SHA256 b7c60fff09733bba301054964fed0f63cf71b8f0f603f8cbaf17a60ef8a61a8a
- MD5 2aa0238eab9f40d5bc0085e061580fd5
- SHA1 7737b425f04dd4ce9bf886b031eee19ec56bf41d
- SHA512 6e125207fa57b4b8922ba2c5aa957088af161987b7764ffd6415eb26da5cd6b9657813b457a83c53364acb4dfd984c02ce0c6040326b78052b77816db65f25e6
- SSDEEP 768:r6SNlStLNmNmYSomfkuGaiqiKbGyz1VKh+YH9hl:r6STStx5lF0pqikTJgh+Mhl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
- Size 4KB
- SHA256 59806998e738b31094776810ed6122db03abf45153fe0f8c8663a7f54edeb32f
- MD5 414d995c962bdbd37a8a5df57c704973
- SHA1 6d9d2d9c7bb60f32b3720a30d92957340791d473
- SHA512 49063e078b5e5730f95ae3ec203335e15787b5c8245e1d5132f6614d66d1b299b83d11a62156ff27a3d20a700e43a00d3afd7c6a13f7a55e22d0b628343bbe6a
- SSDEEP 96:FcKgTqtaQQMi2gfNSoyg3xrr+b8f5MrNg8q72ESLpkCFi8FIEw:j8qtfQV2gFLyExNf+Nq72S98FIEw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
- Size 21KB
- SHA256 59caa5c4066cb8d3c54140fb9db47db9123c7d0837f3544804fb4429b75314db
- MD5 3f10bef3b41361e23f49bda84f4400c3
- SHA1 8078027961aa7d96cef0a8713ac54156fae463e1
- SHA512 9d152df2453d741ecb7aa34c53e0c4b8b424b19cf5b3010a1fe88110b90a87fbb4ffbc469fe47b0398214d60362f44590dabae3c98e174d649097a9f33db4e31
- SSDEEP 384:Cf7P5UKDw3OkyNBTj8YKeud8cIOS+92vj/PJkRfJ7usSXmZmDbitHJ0JUE0:I7xUKDwS38YKe8dRg/mMsbEDOL0Jo
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
- Size 106B
- SHA256 d33de678a555b23d52c3665a3b2b455e5120c9670992dde7e21693a07dd1339d
- MD5 07370fcad2acfd6ad45e85548bdf2ea9
- SHA1 d649a822dbc04308b827ef611bc994856c2c6b09
- SHA512 96dec13b7706fc8c43acb3b56d056950d322f5c4d56105a6be4011416f75c34169defd364bcbbbca2133ead6cf4cca3d535edacf173d3ca4fa764a24135759a7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
- Size 8KB
- SHA256 31847c8af31e9f1775c56204275710ed642ae1ea55b8be38d1b82bec0d9d0d37
- MD5 11f4420064bd9c612e45770ead5c6cd6
- SHA1 bdd3c907ab0e9b5863e2ea552499369987b28b0b
- SHA512 f0a25fa5aeeb04f333e4adf7f21b38694e6b305192eb9a2897c6f505f1c63aaf2a09cb65cffd52f8181a627a4ba16828f5d03e063c4f2ba86b4dc5026a057e53
- SSDEEP 192:c8888888888888888A7vWlGlGRxYwdjYRDQbnYvivMjqCi+qMyvkh4x+bW5vPPo:R7+MlGvYwJ8vivC0RvjJI
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
- Size 15KB
- SHA256 c47ad452ff99b20576c6c4baa0a4c4620181cfc668d66c487b3f70d5fee3c12b
- MD5 d262f8f5b77ddbdea33d04ad91525632
- SHA1 c7206787efc2ba5ade7b24a38a48ff9c0d7f0057
- SHA512 f027a6a81af7f02459285a33937f777090de33d36b075cc407c9ae2b5ba9587439de5d160134156368273f35ce155cbb380b3a80146796a8e3bbc11cf8f31c8c
- SSDEEP 384:C5WB3fOEd/jetudSwv5JGld82F6kx1CxpqsHRHBQv82y:4Qxd/RdHJGldSkx1CxRFE8B
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
- Size 6KB
- SHA256 446efb2650d61bcce3c1de99c83d3e85bccf9967b80908cd9fd40579552ab88f
- MD5 e65a7bf78b818c4d661ee2c411cfc9ec
- SHA1 22d21964b9ce666c0b0bcecf42b635ff695732a1
- SHA512 3903f1f67d3cad27c44140318abf3df1f4827f49f6c39da1bc4bd56ff1ec3cca401bad7b8a173f4e78979cfb3ea61f1d2e9dca206e116a223e7b9deaffe40a02
- SSDEEP 192:vClZKGQHHzmUa3KQfMD8pzjOjZYLnO/veJB9rT:iZB0y5tf9pzajGnOeJfX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
- Size 20KB
- SHA256 f97eb632aaf651e0c326eb3804165ed9fa77dbf0e47ddaef99f2b6bd12e7b275
- MD5 aee3f1890e967d09b48762e169dc9caa
- SHA1 c9b41f9841b7e943f252551a8de2930e569b7698
- SHA512 6af301f811dd3a6762f12627805e82121a348c510f6af22a180a9be841c3e499083be1716aea7acb78217d85faf5516d83511a4a6c79877456a20562bdb95082
- SSDEEP 384:mlm3m0yDstjrhj+5KFzIBKawfkiNEKhaIt3OrpIyuHXbb6zh5:onPYtjVj+g8DUt3epIyu3vW
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
- Size 6KB
- SHA256 42d7c219c08b92feb8e137bcfbab6d0ab51bf163e571a613cd6fa22abbe6d777
- MD5 c4f38f4a65aad94cecdec9b0b3dc735a
- SHA1 2937507381fcd367ef767d44589b8cd25599db1b
- SHA512 73cd9f5576fb8ad65accbf5144ed7f60fbaf60fb2299caef10317cc7d21ac041610b8bd0dff902559cfdc886c03be893fff3b8a78cb11309dba5cc77fd9a223a
- SSDEEP 192:kvYdg4FL1ukT5RO/ojafRLTsmzMnW6mVSX4vRUCcaABfeO+:k4r9ds/+6BwmzvVY4JxcaI+
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
- Size 15KB
- SHA256 88abe1b6734cba5e42a6a2746673beb8a8e53f1029036bf4d3705bfeb7a66670
- MD5 50b93896736d7b1f45aaa17d64d8e73c
- SHA1 bac863b6e98c4a73a4042a0110ebc81a7cfa41ab
- SHA512 37848c90e46a2b5c425b3d27e4aba046a580f3789d3723db0912b81a0e81527bc4719e1d45b880b010e9d942a54303199eb40eb5f5241265306634b5db3a0f40
- SSDEEP 384:shuzH16zGN+6GOgVaLbA6N5TbPnKaok9BaDC55JdqBuKBJbjoWe:4uL1zVxgVF6jbPnKaVwgqPBJbEWe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
- Size 2KB
- SHA256 e1a77275c763af1a236351f1049188341d3d92a730eb1914eca88e4be9c8c193
- MD5 0be8122e76ea7bb9f76f64fb52241ba7
- SHA1 ad86980bb0e8a9cdcfb53f35d5a42d3447312ac5
- SHA512 9897be38f0b37a22c8811ad602c252400c966fc49206be9a3e9448c9f26464fecc8d989870b754ae56e3389a54dd8bff78cfb9e45b3a8e89af4c3a561d536ab1
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
- Size 2KB
- SHA256 9164bc45a2095376e0cad24bc592397bcb9f7f6467f1a90116633cdac5b1f6ea
- MD5 00307c5fb3ed1ff4cb77d02709af2bb1
- SHA1 1d7d4e097cdc915015ed67b56bbf1b08e94cc8b9
- SHA512 8f8f34fc01cb4eddc1c52209a722cea609d46136db2efb0c011d7e6c0c00d7f3d6b943f5f92598ac9441eb32862f57924e21f58ef5744cbef8f5667b91572664
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
- Size 6KB
- SHA256 ad6c168f14426c50cfa40581e597f1ea4415ed83f4010c79ef31d0e030109037
- MD5 e671f7d67f6c4242c187e673a7ba4b4d
- SHA1 024b1bca6a8650805111789380babc2e6b84514b
- SHA512 96ba50c21b6508af0ef56f2f4e49e23a7cc4cff54ff7a299afa557bcad70a4a764782cd559393b362898499e745cc8299368d3b41b137fe0a7cde8fd6cb2e141
- SSDEEP 192:/iCk+kAls4iuEIpdD28u88885AknWkH5JO6jd0IF5y/Wnh0co8dq6V4SwS:Ds4iuEGi1+Ad0dOnVsS
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF
- Size 255B
- SHA256 8e425e4507452cd0799eabb419c39f516a1674b228389626ef4e9badb1d51497
- MD5 4c69c0b9f117ae040c6c16e06ac1afb7
- SHA1 4844368ca95d4f7adbf5a1f01b0e8d037ab3f39d
- SHA512 cb97e342d4bf9f917160b9d0c7e3c66f685e8dd09685a472e052d602455ce6aa5d49df82ad91519842e2b07c7ab121ab862f48bb33a4268bf65e4f307557602d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
- Size 323B
- SHA256 13615109b28319a104e9d540fbb7c985f14c6fa3c0b262890c80454ff82eed2a
- MD5 2e9631742b55152f741fcdc5e3664c1d
- SHA1 88bf82a74807f3ce9cd3d86bf4d175182a1695f5
- SHA512 2439c3dcd21133485482b6df08e4582e70e1202c933484de458c786c8d677a5309939c7abc8f57b1d52a0a802249d540d9cd7aef5fdfd81cf007763792d97d84
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF
- Size 367B
- SHA256 a5962a6b16f418a369e456371382cb2b08a6771d42cf1eae474cb8e64d2a6810
- MD5 72d06fed69eed57661bae8c3bbfefd04
- SHA1 d8599ddfc77ee9b9c051a5b002546817c22fc69e
- SHA512 56da9a579c7b0f8e260b959d9aba7a8cc9be79fa6b043ed2d5349b94264500108c16d91494c26bdb6696fcbf258cbc3fc8d66a2ea321ccc5426479cb34eec165
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF
- Size 148B
- SHA256 b5d6eecd24fec2abdd3f55449c7c94d779124fd4f185331e22c73ee29919c062
- MD5 e4d869711060bbfef18f42718fce3e31
- SHA1 240979c151dff73c0d87358ae7ed4fac3fcbe9d3
- SHA512 17dd2b1004ff8e54abfde3d5cb8a42a80173deca697bcdc628f73db3717b4e56d6f3751a21b98442cbe4ca7c82a52be8f079c445d0804001d15fdfc5a2986827
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF
- Size 440B
- SHA256 ea037008037c7650e0afccf8c53baf133e5b801cd1197cf8238cac25614627bc
- MD5 330c2d3957b6bbdb274668cc9263058b
- SHA1 8ebbd5b06438d785849e74c9397a0a8bbcd43027
- SHA512 668f5dce08b1cbe6d8b202b9e634fb0db75b4b12378ab4da21c95bf68d954a50c10288a01928ef8d6be5ad707334403049f0723126415e3e2e9fe213d9a957be
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF
- Size 462B
- SHA256 ca798f18c844fb08e6bb0c808cbeaa815a56f176a6cdf0c622b68a16e96a14ec
- MD5 cb665ecfb83e74d2bc2df27cb64254f5
- SHA1 7506b136ac4d6b13c83a16d55dfc0fab81f459d3
- SHA512 b3462700c30201e546b709d7eedf08644a10616cb9a235aff283da38983f53180ae4597b28703a8555fb52e0ddf34562667a70467127b612e60529882cf53222
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF
- Size 267B
- SHA256 e5f1a43ed89ce695d6940b8db0f7424cb59660fe39bf6e018ee6447658d1a25b
- MD5 24a23f721835e21129f3e73de5d8395d
- SHA1 a258e5a3b4d6238497a91c9f3e5d7de1ecf1ce82
- SHA512 74cc65549104210768523acff171cedd705a0f3e3a304db2c334a8d8025ee7978f6f9f073037c730a43b93f33f8187ac9c854a90385295523e073c5e5c7f47b7
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF
- Size 2KB
- SHA256 8d788af57c7b6fd639e519629b2a05bfe2581c11db61744b05a9c945abb86da7
- MD5 601c8c0f6bfede21b01ed4344284095a
- SHA1 1cd1848e970ecdfee35764d848a61bb5cbcf188d
- SHA512 1da63b1e701e3a0b3366c58721e45ae666a45a25de34ca0414267fdcd4081fdec3949e07137422fa36f7ca4907a17ba5d1c31d7eaa75dc820b903c9f77a54542
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF
- Size 3KB
- SHA256 c5103963ca79d2f435a123068ba47158a7e707d1d2697c3a6ab84ab6af532210
- MD5 55cab7182de4fd36efc7d4ce15d4fe1c
- SHA1 7e88211f750a91f477a37a1fb3f0fcd7d56e1dbb
- SHA512 94135fa5bba99c787dc6132cc63aa2bd5602a084f2d127f89fc3b1c971f3d80529e48569be349e070e68e8f138755448034faa3770cd07b190dc43d1bdec856c
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF
- Size 462B
- SHA256 4b577e3b8197fe504fed3e099ed24f95fdd141320e98d72e84205328c6efcd75
- MD5 1a4f0bd5cb939a9eec70c861f936d778
- SHA1 e16903427a768abe86a87df09830ce29d8e8e74b
- SHA512 e1f76e00cea2a153fb5ced6f02332dc3f9ef92067eb2ab73e388622a2c1a7c894ae64bd9f2aa3d1e010a442e17fe015096b5b78387161233d4109d75dcad487f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF
- Size 264B
- SHA256 c1e95f9395bbde24f4ad0a54f57762cf6a7fba4624b0e2c8401454a16acaf4b3
- MD5 c5d679d9abf2a699dd621af3d5d9e217
- SHA1 c0dbec0f4a42606a37125d167f33b3bcd6de84c5
- SHA512 fcc3d89c9804d4110539020c3b478a837d95664e0001d03b6794c3e11e987cdd72a6639fd96d5842b92c8bd05d85ba63b4b764e08e8d9e08cce89384378ddd9b
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
- Size 233B
- SHA256 d77b6c5cd6a20e9731016c7776dd86639e3d2b2f67d54a2dab0784c5c5d10e78
- MD5 783f900cdbf4d3aaf8894fa783368dd8
- SHA1 40331ea9aa7302b90d1515b438b514adfdc5d8f8
- SHA512 11bd7e4ba37d4fdbba7c1693d1453da59ef6bf54b90c2a92a05b2aa9353a0b494e2298d47ff7173042a1cbbdae83b01307074c9b39c48c5940deccd7da790ab0
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF
- Size 364B
- SHA256 973cdbfa6d2fda416a934d8bf08e6c2a61b0709ba9f85f93b2777cf5a685de36
- MD5 c7d1434ee4ef56ee5c80ce71311df3b9
- SHA1 fb7ca26ee7b342031698802dd008d0ad84a3764c
- SHA512 9c09f0322ba5d82c6be860767add2fe8445a6fae86a6f05d93bdb42977747cb3523d7e555fc336373b196624aa8d951f30ecb021783591417ee7a39c900b5b5a
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF
- Size 364B
- SHA256 2beba5a928a0d465d702f6bdddbedc2bbd7c61ca885a08653d23c51810520577
- MD5 35d0bed55b4e646415eb5bc05459b36e
- SHA1 fddd4e3879857b638c2fb6f32af44ae7e64ebf99
- SHA512 6eaafd46a939a46436d60b74b5bae7fda3bcac42847b48e60b0717501c524481b55e08dbad8cd98ef2a3cc9ce9a46c2b41ca4531f7bc9e890e7bf39fc7c36219
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
- Size 6KB
- SHA256 0dd4f48edd4ffbf01263177343bbae522259cdffad61bc21b66c131c16376ea3
- MD5 f85c835ba9c5223d4df2a663c14b25d5
- SHA1 c872280ef6c868b863d6846a98dfa5094e35a41c
- SHA512 42ed2b673588b49533bd72397791937b1913bcc84af549b3c7de697a854e94f16b366fb4720499eee19b3911af868ee9fb265b46c09aab9ba692d8f674958fcc
- SSDEEP 192:XO5ika6HP6EUKXLtNF32wFV1sHJ5HpZR7yNbQPwRSSjN:egka6HP6EUwXmwFVyfpZdyN0K5Z
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF
- Size 428B
- SHA256 e2d09bacfaa958eb4a6d90dc49abf96b8fd159d4a958c237703fed6bb4a2e53a
- MD5 0f7dcdb64958c58343336cd65da80a8f
- SHA1 73db8500cae99d767fe8955127d1a02662e582a7
- SHA512 5a4fd3d2a729d498853e7401c91e1b8d90cf5bd10d4c8128cb36f43ed5eca23ad4f5dce5594fc66400d7202e208fa2213c45bc0d9b2916ceec0ecd91021dc311
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF
- Size 26KB
- SHA256 6951e417b74f21133940d769800b3d64ac2d90f5a827809f9f06208849a6c851
- MD5 348b08106f2d11747d35009ffa4a302a
- SHA1 ed1bbd38128a361b4f43f8520dd390aca0994116
- SHA512 885fac5c4f40711ee96063e36c0579026c17c0368539e7c25b07358bf36857c09917d60197543c9afd7f128c06cc2f5169afbc7aa51765b53891b97ba3e4da5f
- SSDEEP 768:3k8N4TBZD5qIu485edncoYvtV9GOn/XJoJ57+RjNOsBb:3k8N4DZuR5edncoY1V9GOhCV+3D
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
- Size 815B
- SHA256 8e0110d49fe7d17d37f43adf685644300e240e9d7fa9f6e1044d462710e8234b
- MD5 ba9eec5044c8570f7bf4780cdd9f3710
- SHA1 238bad4b1c6a4ec381023ba5aa0d2bcfd82888e7
- SHA512 4ce8d2f85b9abf6ce7fb8704ff3b572658aa8dfc2c91c846bc600d03c74ab9b6e38e67b3e7b2fb26f011a1585942ae2170e89313fe75b8d404a94162d9aad278
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF
- Size 870B
- SHA256 41b657e8094580be04228f8b0fd66a7aa028250e7ee8b407189ddab16149488e
- MD5 62d91a112536741cfa95fc82bb79c123
- SHA1 ce4b05523b621bb159fe17e221c94f07ab66fa39
- SHA512 a4f73ce203e316d34317cb2e003c34349bb8b2e2087467750d8e376b72679efb389473cb324699c225571c8f16688d4f708244f99fef214d7ced65fbebf95932
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
- Size 3KB
- SHA256 1dff6485394ca5667c7512a36f4d4fd2ea9efa11b5f774f4ad85a2d9a3246e11
- MD5 7f3561bd3eb3b1ee30e49001a0e3a49f
- SHA1 d0c0cf0838b71723d505f741cd187db0550a5780
- SHA512 9a2eb3398d72180c3554d77eb433ab1132d9c6896c7ecdb1ae3f2e3e2df281a91a1552e11b4a6289420ce13f114e94bda1da20241090cc02debe14ebc8ed1f33
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
- Size 2KB
- SHA256 8a3f4ba400b38c8b7d72573e4427c6b6523cb6d4dbd1e44ba654ad7c1cb9214f
- MD5 a511bdf17358095494591f8d89c1cba0
- SHA1 2109a6215c7a977bf8cfa8f7dc4b84e1e6970ff7
- SHA512 7438e9273496235d53b85967c01457699bd64c5237a250781e7b1550d29b7f3ead8275e29641960dcccfaf283ac294b5f960baf9b1c511b2e1e4ab21ab03b554
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
- Size 19KB
- SHA256 a414577665e2c56535079a9b85bb6e52e72225e64cfbe1647f4f82e658753ae5
- MD5 0355f9afcdf5e2fdcc2cd7684221402f
- SHA1 7746da91b7a9fb1ce14b9626e08b183e0a30c064
- SHA512 69db12eb398351d5cbba494469f3c8be11d8fbbca1cdb26b064400532d59f118c56ae904cd51e3488992c27aebe307267690fceca5dff1560410eceab2657dd3
- SSDEEP 384:fxlmbckzUYslnW0a6EExLCSa1goco4ZmYdUJ/uCGMCuk2onED9ai0ZNqe:e+Zva9EpCrZ94FdPCG9nu91e
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
- Size 890B
- SHA256 35f2ad5bc40328e0e54e8a28cdc9db9b5a7894cdf1605c084e108ad34a7cf2ef
- MD5 8872c401c1a741f01714c7cf617bbf1a
- SHA1 0276f6f8dd460568fc3d35834535cda7dbf6ba63
- SHA512 71cfcc3165d1931a399db085873439440f6ec71918a717359984c948dd0d769c2799adc9705bf1345d216ed38b62cc917580952036783f718759ad9d12e0a56d
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
- Size 852B
- SHA256 4a204a0eacee1d54eeaca9fe5ef123a594f5918380a46eac9c976bee158052bd
- MD5 698a4ce179742cab953ea3bca2412c30
- SHA1 325b7c16532938d8b9286e8d9032911ce71a7f79
- SHA512 1fb6681bfa26c4e786e173561ad7dce2a25419aa2f57dd5a5b53b3206568df44935c378c87e43102bfb7e4832c68a5951ada698df630711bc3bea6a881337543
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
- Size 860B
- SHA256 0d2aab0ce4daaa2007957c181c5c32b0e96ad48c4be926816ce714f322f8fd07
- MD5 7e048a9114a0f85728134ba9eacf2814
- SHA1 8c39061dd59b692628e058e9ba233d8b5ccd5983
- SHA512 05a0c9e0213e77ebf90671aba894ac74e9cdf758313dc7defe6ff8dbc56927c5972f658430b8d26671708e7f6f69b17fbf1589a54bb40eaaf9269e7fc9bebfa6
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF
- Size 580B
- SHA256 a024e6bfbb059d76b9431c3bdb0b2412de383f7301885e5fcfdd4762b312bd9e
- MD5 0573af8f669ac60864445130e2c96051
- SHA1 d4ba91692736eed627206527fe2239a99db40817
- SHA512 80dc941d215a4edbca7a6afa798c2361ee690cfbbf8dd4310f510d09259f04b66634fa0cdaf85946c002d68f1618e95acab78a393ff74447c36f540d9cf35bbb
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF
- Size 899B
- SHA256 d88b7acbc9828f288eb9023458384177f266ef604a7b0c1c94e8015438733235
- MD5 bc7ce4d4699be659e16769b76b4de050
- SHA1 70f315423507a7537e7899acee17dd27bd39115a
- SHA512 868777f1c9b95df1824c086a9b193a450460d134f5d8aafcd59827266910c4a1bc2e46e50d09c64d9716fe58266e4afae3bbae6971d0bef00877105f533abc83
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF
- Size 625B
- SHA256 be2a746c980fffb44ac812bfd1262ca6eb08374a90c93d2120a914543819a6d6
- MD5 bf3042833a6c246a40c37165ecc83e07
- SHA1 fc37eb744eb3c584109fe691190279e52d2c8781
- SHA512 8a30613747cd23510d5645b60196cc61363260e92806c2ee91f36039d3278147aa759029b40c7f534314e5782f512ffcb7eb8d684fc1285e31387663f6e4dbc4
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF
- Size 873B
- SHA256 40ba19323849f52b653c8278e2c20267a212627be5ab4cb0200b460293575f5c
- MD5 2624896ab25a28ad930febeb917d8356
- SHA1 6c67fb1208cc2ae20c4279f65c9a925354a62e82
- SHA512 d58652cdb4289591c0403b8d6606e3132e0b1e733c4ed9a3585a981a24b49f482a5e9d42c26f9d02f590e9278cd4b75cbc8aaeb5312f19f3996d342c4ad74150
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
- Size 5KB
- SHA256 0aaddf2b0721f5e7fc3aebdfaa18f1c45907009a4befda5588ee4a6dcdd738c4
- MD5 79398ace538244c380ee5af41e53dec6
- SHA1 df7bf220aad89c7531a8bb9765936070f75682b9
- SHA512 6cf9bb01c4b43e42992eac1f652cfa4973d6e6a09371f71b98c3620c870d292640c92e6e4a0b28eb961bae7c1c49e45c78467ff58cab1557b2f549a666b2c02a
- SSDEEP 96:Za4+xjDX97Yk08AdTKA68UiAHb+88lJ8BzBqlFMtapZ6XNNsC+vESkf7ZCJ99:ZQZX9/lAAA68UiA7+88H8BzslFgi6NuN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
- Size 1KB
- SHA256 f38b3b88e91c00291abc7ab31bd1aa046db6e2b2d14494ac7b13a444666ebb48
- MD5 c92534d067368b0756a0e3355ba7d550
- SHA1 ba5068978269e0a7743a8fd358109354045422ab
- SHA512 6ccbf9bc704fa9eaa1de4bf040c8ea90500174529c5a37de6578460ad05a449a5bf4782b12be91f644c6045f66f201c8fc86b5be3b6d9f7d0c561f5a4a567165
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF
- Size 615B
- SHA256 08b6e5c543d64a6548fb153253f85dcd54dd0b5ed24e68cc984fa04297b74a1b
- MD5 d9f49b6ef4f5d29c92c9da5db52cfcb8
- SHA1 88ee2da39af4c7611cc36cd0b1d7f3f4a671ddcc
- SHA512 dcf4d9ea54fc9be582294d06d275702ee6c09ddf5b2819489933e93cd22bba27b3117b2908e530e5a075173db9957c3418b9d98b435944e9e13c359dfb440974
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
- Size 848B
- SHA256 c8aac5d4ec6b53c8936618b353e7bcaa7bee9d5b2a4b5b334f701d97c0fa48d2
- MD5 ffb59178fb577673d7cc5b79401245a2
- SHA1 e3207356c84daeffeb45cbbf23a08b96c4e0caaa
- SHA512 813d9a716e5374d714aaff5b4bfca88a73d1bcb4196b8103795d9b47a88490063d2747140edf802aa8fcfa8a3110de8a87987a010f3ee9aeb75b87bfa34264a3
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
- Size 847B
- SHA256 f07e502291c9672738be28658f4b12c1afcaca26bc7b3b610876bc79e9307f03
- MD5 c780696ea1d56ea928df4681b3435609
- SHA1 31f71503b00574927839d25ede949dd126031225
- SHA512 fbfcd4a1b2e8bd08d211d59978dd51e4deccf04991e1670ce33b095564e93bde2220bd97c7e29efa5480e389220d45c014a7f61ee066cc182a62bae2a5726e29
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
- Size 869B
- SHA256 9186ddf05e65ff27c19a459fa2dfe0e38d9573ef1faaafc603f2713e0f5f64da
- MD5 ffbf2bc658cf1a8a9901ef9f192c094b
- SHA1 817cf647561fefa2f6f39abefab5b8e11632fd6c
- SHA512 3c030b0b790369f0cf6b6ec0542da403d633798e08e8821489458a17f9354b61f428e7becaedc0927151a06d24c3f7f03a0f25e960d5e7e5af210b661a3b0d70
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
- Size 847B
- SHA256 d0beb258c8490c65bb8a4424ae1730bdb24df98eaf37b1d52a891f5c9ebf5bac
- MD5 83862cb6f7f99055b15a6ecb369e6432
- SHA1 96f25e347571a8bdd00ace4873927037af54e4ff
- SHA512 ff0cb7a6f6eae76e50cf1f6983325db257e45529fe80cba329c1162420942bc3c47bd64a75879dc0b541feee03c935602fc0ecdb8a4e7c624266fb78e81ad170
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
- Size 863B
- SHA256 21385b8f1297e4234f1ad530ac0318c4948d33e7ff433540b9d51f042e5e6018
- MD5 0b0c2f589feb7074554034433a027179
- SHA1 6dbe93ec5e2b22885fefbc4517b9310cc80de348
- SHA512 a305b7b5cc13a22b1c563ea623970118d4eb0c7ebccb453c2a303f7e666278151925de974777a047c14995d15f76eeca9709d68290c29ac5eeb975121b9a1cf9
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
- Size 861B
- SHA256 f8acc45e319f4a8b2bb53a60584bd532e886c1dd744d077e072b42475ca7758a
- MD5 fda667f798405c756c3b8ec49efd9f88
- SHA1 e7230deb0d0d041e773a0dd314e7885a781d7875
- SHA512 704ed00051faa510d767fe3f6c386c511ed8ce8f1d8c4fa51e1c01815c545d9c1518a55f7d6730b5def1ab0c6b33faab880678848261452baf5ae0c50622e07f
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
- Size 850B
- SHA256 271e4df641f1cabb33657f543c929d1a191d7ccf9a27ee4d15e27eac44c6b7e8
- MD5 f24d95737e535d5bbb72168c479b9c35
- SHA1 061a1a8475464581e62f0feb894e2377858d79c8
- SHA512 f5960ab758c7952b5686a875f430db165f2c94ac0602a68c822e0276a0aa04a8dc21432e2535450910d9a372224d69ab712505d6eb9da88a20d9159adbe29b50
- MD5 SHA1 SHA512
- Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
- Size 883B
- SHA256 8f32ccbee0f1b3c6255c9dbd0464081d52924281c7b8fecf0426d08b13107f97
- MD5 2faf4026d11c512bf28c3ab14b57b0bd
- SHA1 0c8a5d2ce008b92a88eb87d39e3364ac698ffffc
- SHA512 924d6c3d96cbe7e96d916f05adc4ae04b25941ec7b6022cdc304aeab10c1f30adc76ec3ee706cfe17968607df2ee17054b635209736f5e4d9b4c57ca0cd1ca60
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
- Size 153B
- SHA256 90be465df45b4eb86ea75aa898ab375201ebde5fb2fadd8f4643f5060c7b1715
- MD5 06837df93346f96cf67c02d0e5f56a21
- SHA1 12effd49c886693c9d5a8f36f529896166428932
- SHA512 2cf0baf215fc192ebe39c009a7ca4bd2d259af9eb4f7f42d209d8880fc7c005cbcc27163baaf2ab0d6783584ffd63e9ce8f49b3a0e422a6331a57ac50757b611
- MD5 SHA1 SHA512
- Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
- Size 11KB
- SHA256 3064bb8212089de899a8927835026dadfbd1829c08adf6ab246f3d266b4a04c1
- MD5 67cc2591cd0966981c2d1d411b84ab1d
- SHA1 e072c8275405370e43fedac40ea8256ba76cfcec
- SHA512 5711d607410853c6527be11eec48fd0d2a1500ebb0b4ae6cedd5617c00f2c15c7c7e150b9328db51596d851b1e3a0b07403a80890c5a51c13613271748d2cb0e
- SSDEEP 192:rjvRMCxIAl1ecgD/KZzn6RvwS1KbfpBVoD4QijhzjqF1hsv5KLSryKr5g36cBhFf:ZNxZbe+ZzqwJpAD4ZqF1eELSryKrTRA
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
- Size 109KB
- SHA256 373cde86656ea29dace5ae73520e03b5219c07c6a7fe470f48f236134f9f2d30
- MD5 e0810a82160a9a61674e219e23dab8f1
- SHA1 c4778258a53c37f39eff0058e6e8bf0643a4d35e
- SHA512 af2da00dbab75823e4f3707871c8062a5b883fbc2f73ef979b942128dbf195a4d943a5023ff1486fc012e3d67d9cb55e9c42f0ef000e842b47f27dd29d3e3521
- SSDEEP 3072:WZy5o8AVFGiMng1s62rU8aBV/Ea7hNo+q7DlJoODoAp087CQi9q:tqFGMs9rHX+8nDodaCzw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
- Size 172KB
- SHA256 9e129676838b8a4cedaad9dac0663d6a51b836bf2852801c837dc662915b8107
- MD5 df2bcda9628e5a8f6256606660750cad
- SHA1 11d18ed36d04e894f18a4f00e9d6314a754e9425
- SHA512 2ba71c9bd38f731ea4a2fe3efeb194661c62d853b9dee4c9f24660069722635f1d2e0ce8620a9089a83d8f36bd27479f984b3515a3821aa52501baa1c47f9e02
- SSDEEP 3072:E27suuqSQWyibpTIttxmchPWafpFTEzySFaFBY5agQgaeaSJIpS07bb5oC7nm2v4:SDqS0/FxvnQmSKiOjnSCpoWny
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
- Size 1KB
- SHA256 a43375940dd257f3559e1d62f6994d3c4d8180fc72e3c0eb2167aac81e9301d9
- MD5 2912209d9dc1d26bfc91bf9b7378fdb1
- SHA1 423e308dd510393a388ec555fecd7e945c6d9b88
- SHA512 5bc6d5b90d028fa502327ed240e76393e182a5d66bd5a417517efd5e5ecf110908b165f226025cd717f9e2c1603f6695957f204fe6691ba1b5ee498677a980f5
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\alert_sml.gif
- Size 49B
- SHA256 b0bc617fee418d963710f34df57703f0dcb1fda45584c6e5743c31dce185c4cc
- MD5 d0a40056de392086ddeb11198a2cd45a
- SHA1 34f48a6f8228699de66701d93917808d9657a41b
- SHA512 14cc4e38afd80b2884739e6baa10c4fffdb1410b85489c6fbd57c151850d8ae3f37fa44971132798267c0916e2470b3230be96a5aa50b6f016908078fe50eb48
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_leftCorner.gif
- Size 65B
- SHA256 6c652ffb36e75f0560415f1025df6c3b965e1f989d9732e4ae679663f167831b
- MD5 1d03a1f18ef9a8a9a774e50e52f036ba
- SHA1 75cb64635107b64c57e33f99c92086cec70fb787
- SHA512 fd6d7e9a0d74979132b04273734dfc5fa379dc10ed00afb3a9838b3c52d25b254936199f0fbe9bdffb381f818e658e67be9013bc2500b81c606729ddeb6d34aa
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\selectedTab_rightCorner.gif
- Size 65B
- SHA256 a15345b0727c230ef2605019d9cec357a2cb289e60afe6ce0df752ad6d92c42d
- MD5 f2838a0de099fc5a69ee87423981db36
- SHA1 80fa32edf46e2abf90877fe49a541d55a7dd9856
- SHA512 72df16006dd8b6f69a037a69b615e7e49a6988211f200db2313ce40483e7a3072d5f4d7a95b990e18d47755f5ecaf05dbdd2e2989472f56e1918f20b1959deac
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallCommon.sql
- Size 24KB
- SHA256 39c70ad8de8bdccdccf160b4761329796c8706ca027321c3b0a81d5dd03b075b
- MD5 7bbcc9e370638d22394f6d5af4486d39
- SHA1 f0ee969e729e765b8001687da04703ca7b60a8ac
- SHA512 c81f53810c16cadbe8339ae2750dd3b2c2f463388a9a3aef8d16ce91b2a87821fc23f63625ff85f7e668e784b5ef82bcff53ff49664e89b2421decaaa95511d8
- SSDEEP 768:U3KjybvSRrz1G9rpcu7yXKh4qs4Wqt36Xq:rySRr49K5aYqV
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallMembership.sql
- Size 54KB
- SHA256 bdb964d432eda80f424d0e9febbf188024503c8ba107de8fef1e52fc1bd4a7f9
- MD5 49102c1f3833175a241d83338646326f
- SHA1 cc88d48f5a37cbc913d08c13da2ae2a26c009976
- SHA512 c0d5d05747321e5ff9b7e29d0e3ba0f4eb3f9eeb53f690562f31eb8941f5d9046e8d4a0e501fca05f6a1879e1f861791931d483bd78b4886c24afeed58a5541a
- SSDEEP 1536:NA8CKiMVEipFqZfjIHQ9iJ01eqRO4dbwX:N7CKiusdjIw9iq1vRXbi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersistSqlState.sql
- Size 51KB
- SHA256 7c3293547320e3fa293d6b57c76174d4d04da277b31c05caf887c163dc61c890
- MD5 9c46db1b49c7049a34ab3e7ad8e56a2a
- SHA1 e95a2ad382cc781733de92c32da83cff0b6cd82a
- SHA512 3779bc01288b1e90e78ab84b24a1fa6b7bba703a9adddcfa7c59ad080ac49a80f8862b72b44e22a7e0c6d17213e618f830b4c5d0c0003c3179f70930c6f4b21e
- SSDEEP 768:mqbGuRKyPTNNv5mPAN0h8Ctv2Fwbsa5ro3oQlbevDwsQZ4eTpi8PfrudSGGEh:mHANN38g+bsPeDwspwudSGG8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallPersonalization.sql
- Size 34KB
- SHA256 24530a88a2612ed21750a1c0449d3257d4d006f96c9b83454b7ac92e509a6403
- MD5 e646010552ad2ffaa95f9ebc107f6969
- SHA1 337dfa04dfd4c80ccdb1ce1c6c0c8c12e0885034
- SHA512 cc1c2794501d9b5dd0f7c2742fd29613d7ef7a21a5db92e32fef7bc0529c5980e941440fc480c3bb92c7e82686b497d10e1deb4aaf8e6ff17226db64e9ddf941
- SSDEEP 768:8zpcBU4GX8kxQwurXyEtNeeD7nJQK+1kTOKLOye:8z2y4GX8kxytw2gKLOye
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallProfile.SQL
- Size 20KB
- SHA256 d45430cb1c408d5ad4e095e3b4210bd26716a97902f803086401908685973edc
- MD5 d3da1aa6ad0360382f77f2230c23425f
- SHA1 e42e68f624c661fecfd3ef91d9e5d6d27a216563
- SHA512 c9b509c40b4981c92ca71f68d14279674d210c3cc99d42c1f4787a11f1f51573d43f605cda9b687e24c17629f9be49b19ad41a8837e477213e2925c1ed883ebf
- SSDEEP 384:ERMkxml9QUMBDuUTCfLBFmiT7hxAS1zWLVjMIRka76R:ERMkxmPQUMBCUTCfLBFmiHhSS1iLxnNw
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallRoles.sql
- Size 33KB
- SHA256 aa2f4128fee770f74e9325e6e72abce59dcfbb5980d38302f78f7a8e44730211
- MD5 55dbcf7109b0551263273ee1a8ecbf66
- SHA1 b3bff2f3415d4f1b5c2f610254b777cc9697a393
- SHA512 b20037cda73253418f527434d42260655d6940c8bff8fb15ec204ac16c35f8d6f190ea2d2e4e863228e6a5a3567a045c9f07ef810c582d61284dbfc79ecd03f3
- SSDEEP 384:+zg2SBFDEeRe33Cim9Z08I2W7yFERPgaVX7/eZENkhMDwxFKXx12ixc83d7:Ig2S3DErGpW7yFERPhXNkhMXXmcc8p
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlState.sql
- Size 50KB
- SHA256 a5d7cde843605d6c00dd704f2fa83b0d1295da8b18ff666954a4076e2d2f4c83
- MD5 432ebce2ad3517d6559273dcb484cc31
- SHA1 8981951aa73b1cc9305f35b09249f16b8a079196
- SHA512 871a04387a475e581082253181949381020310819827c1065b45627ce9ecb2514b5a915a410330f62d508e71c19cd8dea830631ddc940fa860babb1acda72d0e
- SSDEEP 768:DjEy/q0TLCXZdYL1kFOl4WiDX3cvlKdWtSmBsswqvGK1Ob29ZgD+40AHREptc8Pj:DQ7dsaWyXOlKUS1qhOpk9P40H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallSqlStateTemplate.sql
- Size 52KB
- SHA256 36c0b0bea0a5fed39d267fd45da2e893d26105b26517ff2ba0d144dcf7ed3d9e
- MD5 88b8a0ae0536a61974f7dc620f195357
- SHA1 abddaa82434ee348aa27db91ef6cb68db3125d91
- SHA512 16aed64af5160e67af8faa4d69d92d53c2f5f9651eabfa1fd0ffeace87ec60902e97361ac348c72a75b4536b89dff20a3a64e5925764fbe2beac58594b4b5e72
- SSDEEP 1536:VsGF2/XbXapheWyAceYSIAGY7CvLFu/Xs:Vs3DapIAceYSzG3vZ0Xs
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallWebEventSqlProvider.sql
- Size 6KB
- SHA256 556581a50779200d96628e404d1551278232f2eff69343111b22089dd3b47fff
- MD5 88a662680c6f3b060a7e533977da2496
- SHA1 c400d61478dd2e8108eaabbabcf183ae917060e9
- SHA512 1bf5d2a36c00670b5104422657b0272612c416c88ab617129ca926b9d9b878d34f6f388204df5ac6725c8957c2bfd117869cc153f3e45b3d4611ed421447ad96
- SSDEEP 96:55QABU4YZJabIrROTXRPZzTTIE/6Ws8tro2RqkuXpy8:XQABkJzOTBBTZ6WLt5ey8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UnInstallProfile.SQL
- Size 4KB
- SHA256 af17ff4d876b3c4e552cebd655de2ef2efdbdafed87ba50a3b21dd435a2c6dc5
- MD5 bd542f02309d968a131ecaf8dabf4248
- SHA1 de6fed00901f41482e06ffd99a50be6a2aaf601e
- SHA512 29048553476745384de92248e3b76b4b47dae03c213c08313118b41620e9fc58a063b2cf74869300031898c1d09252908a9364770baa0e1b591155f2dfa4a908
- SSDEEP 96:o3g4m1JqPs8mQJviya3aIy3eP/GeMxngy2XbXhtj:KgvI9qKGMxngj7htj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallCommon.sql
- Size 3KB
- SHA256 161dc7b1ffeea541cf7c64763dde828c7897a84d0fa5bb909c25e3ce07f6576e
- MD5 fd26d27364c388f7dc184be92151a166
- SHA1 318759750c9b417becc7f745c3510627f63ffd5c
- SHA512 cde50443a9ee9225a9d392e56f3ca36f11809cd20a290fcc9638e5135b1cf06cdc7d60f8db3407efbe818a45fd6bf6a010e7e6bc0961b3514a4eee3e5070b6a1
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallMembership.sql
- Size 6KB
- SHA256 735fab538a59f998bcacf4e2d1c5ebdfd9f35d3c1228337fad44f1c9d3a532b1
- MD5 11127becf9e03e6139b4c61e7a6988c4
- SHA1 96125b570233a39c70ede901c13c9e19d1d76e00
- SHA512 1fdd8c8d04a7bd709c598db48a371d6328eb6358edf47f334986f317970f89c6b87520863776a1c15783d8931fca7d89750aaa893e9c294f5a279c46c95244b3
- SSDEEP 96:Wd3YMQaNJ1jKCLIt7+OBolslRwo6+9slrhMslp7ju2o+3H:Wd3XECL4l3Ru+Qlx9Fo+X
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersistSqlState.sql
- Size 9KB
- SHA256 4af963694f3b52e54bc85fdfe16afa1390758a49d81cebbac16c905804204b75
- MD5 dc0639ae3c7ba18e3c74168abd947859
- SHA1 8ad8d8c81178ec7d2b0fa81ccb26d406a902eb7e
- SHA512 b5ba393db0db4906493f02a26ba868a86a0bcbd81cb3a7b20f22d0e221782745d9e0a2d49ec4c2b6f1e9035aaf53c6de3bf3024795b62963abb068cfb53ac13f
- SSDEEP 192:V6gNY7+tZt94+hjKkVWHNZiZNAcm0kNXA1O4kNDP0kNZDkNxe1:V6gms9vjAV3XQOjDP38U
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallPersonalization.sql
- Size 7KB
- SHA256 cc18fbac0b58c1505d360442abba2cd53e884656124106f2f5a020848b290e68
- MD5 dfdc85253f49c283cc75a4b128d017ba
- SHA1 359b7da4e4e413e99d3b3773caea56edf7f2073e
- SHA512 495c91c04daedd63716b812c4403ec23f5f56f6ce0c7b8789c75e81be0d52bf8a5d6ef531f664ad83a6b4c4a3b6d9eee6e121c9058afe6572e305795aa2002bc
- SSDEEP 192:sT8oAF0DCLqEJZZMSI855uQjWay1Cm+CURC46v:s6S0vFX5gQjuC/CUC5
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallRoles.sql
- Size 5KB
- SHA256 3753635d468f56a7f0adf62387498ab5aa03b62c11046d19594bf0e1625ea3bf
- MD5 52118b1d50a0f8a47194c8e191003359
- SHA1 4a55194b437f573e5ea865c42ec0743f31d0b2fe
- SHA512 e9f3f70fcf492ec7a36418c7d5c67315f0a16f11435dad28cf604e3cc76d505c18d0352d94365ed50676d9eb6fb8edeed4bf2bc0ea7e1ef900c94fa63c8b2e7c
- SSDEEP 96:B8oVm8oUtYg50viocTMW7P9slZslJslhflXGumykHXTvYZrc+eYp:K8oAF+8TMWjQUEhFPITv6cC
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlState.sql
- Size 9KB
- SHA256 6db457a40dbe262465057c8389013d015d0122dc062a2e72cecb7662b288a147
- MD5 38272bc4b3b0fa56e414a184770f5b17
- SHA1 f378ee08d8ef29208f35d0c34ec0b08aac276974
- SHA512 98f7cb86625e1a96641af580c67a97e72f035913c5825863a64a9481904650e5b9e2f66ff74ffe7b0a185da1b41dc23827ca37d69ded09f838e635bc16ede915
- SSDEEP 192:wXtKVWX3IWZu0QScYwynZhjZFIZRlAHZiAVy2BW:wXtOWBQSvv3al6ZkF
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallSqlStateTemplate.sql
- Size 11KB
- SHA256 1307553006fc66e44b9c4e508c3f40d6917ce110e33b1d34ab2a93fa6ff6544c
- MD5 11737d5150b81522646f47c76eb10c84
- SHA1 2708148d82dc07a0363b40cf8883419512cc80c4
- SHA512 d17ee381a2ae454dceaba84bb997f5cee795f9eeefd5f7ae6fb139fe28e84150207e5e33a320c2a2cc02afd3fd67f8e96ddb77d13131a46b174b2c9dc59aced9
- SSDEEP 192:a9bJ3xXuNgLWIm9ZgreEKXLwjLkGUkrkNkpz6JuvhWLmGgZgrylVNxhp:YJ3xXueWIRreJ7K3wcuJuvCmKrQVNxhp
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v2.0.50727\UninstallWebEventSqlProvider.sql
- Size 2KB
- SHA256 80e110a34d6eafd0f248b2814808f6e3572895a88ac24357400fc940c8986a30
- MD5 4678c5820a2a886b37a54c6c784b0590
- SHA1 c574ca8ca213c6419ffa19a1f3692706f7bafb89
- SHA512 45d2fd1a355e520bdba01bada794fe5a0ba19f9827eb249548b68318f8daf829eca302482a383c0e054042c61435af5f5f82a6673808865f8d8d8e11916e927b
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg
- Size 21KB
- SHA256 a1dc4745ed60a0cc8e495d16d7005f21629bade44653cf5a6a934483fac1e9f9
- MD5 1860e720ad4f55331d7185c1fcea579e
- SHA1 c766092f230b2a378bcd3ab4aedb7a1776ed8467
- SHA512 635ef56ee98305109693a8e46011b6484bbc81283708874b97814c85564ac3cb9a701eab9dd756a54b0ed3bc48794c7723b9ef2840560c2acd46b1b9e8ba226e
- SSDEEP 384:6aNdoqvuc3Wb9cGEeHXIhFH/aqCtJ6vzl0GOeEZ1b1JRZsj:6aDoqvPWb9cGEe3I6quJYkLb1yj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\HelpIcon_solid.gif
- Size 1KB
- SHA256 e45af1dbf1a19c97cc59126c7af75ee2eb902f6a826eeb2b70708f1d9fdcbcf8
- MD5 0c9fc5016559a418b1193671d94dcc73
- SHA1 6961962aa97cd1de858a84aa5c5283e65f197f8d
- SHA512 63c84e618e252825ee5f6da974255b3e590c1c0631e74ec26c5cbcf859139c4a8954b245021fe08656974181bf4bf3a48ef1986cc049310f61030a572d56380a
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\alert_lrg.gif
- Size 952B
- SHA256 446dcd5add9869593190a1001e5790e8048f63ed76e28477caa1e11b206dd1aa
- MD5 29c7210bd99f766cda8f375d1a16f9e5
- SHA1 e7e9530b66ce631025a65423c250f2bbe3a86b29
- SHA512 cbe7a6796c4da760508e45a248ddb8e1bfe1f3e759bbf2a9b746828ca3cc2f57e242c2e5cdd96d4d7f44fd830d1af4bdbb6a11b37b24f4a69e9e53d2a8510c2f
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\aspx_file.gif
- Size 121B
- SHA256 c324d0f461cb7626337ef30f2b8634a70fa537cd123367c2e7e0fc9707d23fcb
- MD5 ec9433d394423af45f78c39f8cffb0e9
- SHA1 7a7e79dede9c5c46c2dcf5878054f704272b8d0f
- SHA512 9612c4142e00cf09d9137b6eea419498e91563daef0decf9f5319c48d29471b0ea5b66281b64afe122344996305fb91b1c470429ceac854a66c096589409bcc9
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\branding_Full2.gif
- Size 1KB
- SHA256 962cd3769601dad0d30f17efbd3da51f0b261b46df6819f9947cfce6a16ddd30
- MD5 5910926f4e261b75d4ba178c15feea63
- SHA1 61d3457501baa06269845b55206d3fe0995855c8
- SHA512 26cab0578b7e55e9675ae4e21b1f52ae492396e7d879e93180da57c2b0d2e0b2e36884dce6372681ce96550112af8560db76dbd3a7bd6a3aacdcff19836aeaef
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg
- Size 8KB
- SHA256 ecf649e5ee1c8f3212090941eb0b1ed7ac76b246d31777f861873f880c2367f0
- MD5 e8ced8283051f0e9004c1812d6741d40
- SHA1 4b2506ede93a47ffe96dad06d1263e1bc9322028
- SHA512 5d4431870d1c878164ab38c0a85d1190d03eb3ebf9b1e85cdd7501e7a477cbb8878d3fe275df6740591c3f01077047461d9b4e9f3b013829c528e452059fa640
- SSDEEP 192:yI5X7gCb8tPlampLfDldzPeYAArS95H0N:358tZRw5y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\deselectedTab_1x1.gif
- Size 61B
- SHA256 fd54935c228763e3361d78994d3b41b97093813d6db600b3b555661a00d07cff
- MD5 688f57468dc1d6c0e1dbe5f8dcde5f2f
- SHA1 576d7d044dd95da5c09f341004f791d5bf903346
- SHA512 c21ca4f75f4c0bd8cbb50d51fa4ba1406aed7def20dfae12f76c6bb832e5e3e60db0f89c6c910ba251088dd4c79b11389c48bf818743ad193af4a8b15574d414
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\folder.gif
- Size 914B
- SHA256 9bdc777e5f160bdcf8ac00ebc9f7c63c8df280fa79117da28065c0abcd247c19
- MD5 197a93447d7d80d7aeb738acd9e4c099
- SHA1 a0c74e4a4db335a5230ff4f58e98fbce74497555
- SHA512 d0d3c86f7b903159f2056107ea7d663ef804e62ff9158f4f8147067c6a0f92ce7b0fb81f7744dcc496d841cdcbe1d025f0960c57711413eba83ad98134d9460b
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onBlue.gif
- Size 90B
- SHA256 668c93c281a6611418c7ec92ea5b21e24bf100771399ccc513661f3f114aefcf
- MD5 ae125a3f947a11f69cc225425d095f50
- SHA1 e32bf922f60a7f4bd65c108269ea371f57943925
- SHA512 782bbb8dcc4422108d184dea69619449ff3d82898fcd901deee665dd68720e93fac62c3481be0093898074e6fc7cbd123411a8355b5c7671bcb88245cfe4608f
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\gradient_onWhite.gif
- Size 90B
- SHA256 ad4ab21e70bdd13231185c353a955618666c1a7c9e30b221cb4ac84f29371471
- MD5 ab8a70700c7534c5f9af6e5f7e2c23f9
- SHA1 d0eb007b5d05134c664dffac14c086a4e6b6714f
- SHA512 7594e41b679bc1a1891725b26e4de2e20e52b8ee7d7d7a6315c0aaf618daf2a64500ff3563409290686fc2a4cbdc5c18cab48ace9668c14c53de057a80e98917
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\headerGRADIENT_Tall.gif
- Size 328B
- SHA256 1bd9e586889696c25d28d6a877663cbb34fd9412d9cb351556cb69bfc07766a0
- MD5 fb33ab93bb78106e653fb65334f0b0cd
- SHA1 8359afddd03557fe0aa1704771cc5870a9f67d15
- SHA512 80da27899bde451923f66eb1ba99e0b15942bb6e544d8915d8a4aa346fcf23f258c62d0d4273ae7c996cfc450a879f818cf54e6fef84d5a30a5f78efeb73dc62
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg
- Size 1KB
- SHA256 c70aaf3e31365a34d6d6b15015dd1ad377f7012cd7db0c5bb041286c7f9fa747
- MD5 d0aee146540c60e81f1552e31b028898
- SHA1 cd1e8d9e21610aa2aef9584a9e64901f8b0d9b3b
- SHA512 a388d8907e56602b518de1fd44e8d397f91e92620fea0d1a05ccecf3815894aa0495833bad9a0cd1de2a0db935eb6880eb214757885962109dee96bf29833d8a
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image1.gif
- Size 162B
- SHA256 48b4c8aa92decefc8b8141cabfc31ee63818c0efed792a4ff3e00cdf5199161b
- MD5 1afa2a66dbe507bc31d3c453440f3faa
- SHA1 4f30bf7b9dbb514c1ea424a05327d618001a5b6b
- SHA512 e7df46d9e6fd806017d5ba97dd4cd7562f92e478299f311c41ec8c06be8a2e7e7ec88b70eee82b8cb476606738a1bb0fd44bd82aac9148e24893820945844daa
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\image2.gif
- Size 586B
- SHA256 020402772f0a9f495f4d3f12569f19f67db4178286c84426f9138fc75f9cd6f2
- MD5 0043b6c341916282f5e1d4e49b478e9e
- SHA1 9b1ceaaab5b4a8ffd2cef0a84e6dafbdaf4a4e42
- SHA512 57611f68cc27f7aa7a202566496dd119a89e6e3e94a83d3154f209ecde122b62368e7504ff1c04da589aec2c2b0ec3783e689e5107371bc7fd92eec98384d467
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\requiredBang.gif
- Size 124B
- SHA256 8e803a851c782b6ae92366e726f0d41dcb12cf87cad7395c4e33d3043eaf1a1b
- MD5 c84707819947eb41bf6b4b417334075d
- SHA1 f8edf1a061f64dc931391df2ef10bada6f4cf835
- SHA512 19fc44142ca427b26278375f1083f4c68b49db1004d7b7aade34c270e58c92a4c86b5121584c54690367b6a25765a46ac46e5e20b4b6b578fa94adf7a6e10504
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg
- Size 8KB
- SHA256 90c09c540a971540d7c6841ecad83c1d261ffc6ed060f699fbbf4f6dd1cfd59b
- MD5 61d22b09b14e2b0875df290398336dd7
- SHA1 61df1ce2502d7891edb10389528cddf80dcab6e0
- SHA512 53ce76387b3e88019199486b93390a1e0259f0de75d923a1bf2f1411927623556f014184acb316386ebcb34bdc33e8f2a2d8f378826e6d2991e2bfb213408d62
- SSDEEP 96:kxlocI5XCNpc6VvSUly4k5a+1/+vm4UfDkdAAr5SSiEKgUH0S2hHe5A:aI5XC3c6Vv1k4k5a++NEYAArA5H0/J
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\yellowCORNER.gif
- Size 880B
- SHA256 45ef4a5652a2e349cf18ee81b92ca1a817b6ea27225470da5815bd4796360b15
- MD5 7c7b5f3593ebd5d669611d44118a6e31
- SHA1 8185c6a29419736054aceb9f2e761d4d733896dc
- SHA512 19e4d609fc7cb17ce7e0840d733562df7268a53133602a41b451fb571fdfd2bf976c727c28be953fe13e1ffe04d3edc119feb5d35fadb3773b04167d48fc9f51
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Logic.sql
- Size 23KB
- SHA256 6959c49cb5771cc8bfad49f26190b21ae6bf86b2d1c2bf81e238ab55a48f7ac6
- MD5 f4f057b604bfc6d1343302a4a4ddccfc
- SHA1 b6d9381af5b7db4f3ef44f55a4dfd9ec5b5c2427
- SHA512 7d3244ae757390e2a5c2203e93bdc9669b97f4b57809dfe224e99b8b6dcd29e42a150731479a3a05cb1c2a55dd4590462319a9a9af1927b580935dd7783fe3c8
- SSDEEP 384:CMwILlxSkB1nDh33Ivyzww8XdxKwJKUkWhdDL8mpD0jMmYY+F2VmMGfomHOB+5aC:CMwI2M1nDt4vCw/bKwJHkWhd/80D0jMh
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\SqlPersistenceService_Schema.sql
- Size 4KB
- SHA256 8f29e7204e665f2d8fdee1e1172229c0603f99b8b74d15c159a0af45d3c19948
- MD5 928658def675b7fffae606603ffbe9bf
- SHA1 12b94cdf2af8345e095e0aa37d63dda87d2d6860
- SHA512 c242ddf88c30fa5a57bfa431e973bbb2b276fd647a06687edf13a37997be45879a22772bb8b611378de1c5aa7d6e6fb9b5f69aed67fadbfaca4f254ca0ae8906
- SSDEEP 96:8esfOIstYn4JkffXYKRK+n0plidlFOIfEhaiq5Nf9gAbD+SnlzrUBf4lu:8dOIstYnJXYKRT0lfaf5NmklcBfv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Logic.sql
- Size 372KB
- SHA256 5eebdd2c0677d4ad8e1016fd5fb8755110d4a496ca2f076fe143a42237b65776
- MD5 171fa7faf74b283427aaed33f81ad96c
- SHA1 6c4947ff30122834af18f4e37ccb292f98fcbef0
- SHA512 55daab525b60660efbd5d8618fc5540770c59259bc5af5c73b8da46672fbbbb25f814f1c0472398016f65c008f0c3da85d805b297ffde1423e3708155c18b653
- SSDEEP 6144:xjZx+ghMB+BY4EC1ys4V8MDBTjFN1rlwiTuKwv40q:BD+ghMB+BY4R1ynV8MDBTjFN1rlwiTuE
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SQL\en\Tracking_Schema.sql
- Size 49KB
- SHA256 f8c483d0f29a5c3060cd26c197cc633abbc22c3c52c8f98d803570e92e8150ea
- MD5 c582741e0f6f505437bbc7982a0f701f
- SHA1 e4f8a2db91ff77bd7b76b1bf3bddaa87ed0f650d
- SHA512 66536ecff57248cad71c1a6813656ca1a65800ab133f33ee92283d91777f50168f8fd90fbba0c99aa696ac1b5166fded2448094710afa8eb4fee8a3bdfbffb75
- SSDEEP 1536:+Y47PyUg5Se4aQSgcplKyfJdJvFIq1G3vsmQlqi:X5BQ21M0zqi
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\DropSqlPersistenceProviderLogic.sql
- Size 2KB
- SHA256 c1f7fd5463bffc264f504f0d38eb82515954b6d8267389bc7337f2b449bc8457
- MD5 4124b6a8cf8da0712e490167ae10d72c
- SHA1 4eae836c779aca8d078956505ca8a95b049e8d9b
- SHA512 4c04b8a802c1774a2d838dbfddcfd8cf02ebb1a7c3982d3afde1f58610fce9502de4ebb7fc673c7e5440a18f248bb4f65e9e12829416e8e062145f1d7d16305f
- MD5 SHA1 SHA512
- Path C:\Windows\Microsoft.NET\Framework\v3.5\SQL\fr\SqlPersistenceProviderLogic.sql
- Size 13KB
- SHA256 6d3b6e8b3c89eebad0d01ad51e62fe24ae9ff7a4c234efae6b8d0057dddfdd8f
- MD5 ada07201ac1c8365f196eba4a4dae9c7
- SHA1 349ad3652210ba436c2c1f4eeb463117e3dc070f
- SHA512 d99d17594d4624c665b96d403d2c5e57c662d7f91b1a74d2cc6f2e7f685d7cdb75786b549dad67ae37beb12e557cc0ff609b8d5939a4970621cd9578b3c9e6fc
- SSDEEP 384:JzoWY0bPOBJYywZ8Lc+/ZqPCSdTlwn3quYg0eiCDT8:JzoSi3g+/UCSFlUYeic8
- MD5 SHA1 SHA512 SSDEEP