Analysis

  • max time kernel
    117s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2024 09:49

General

  • Target

    0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe

  • Size

    258KB

  • MD5

    54465f04a6075b8e68f272d09b243e81

  • SHA1

    49bee4626e538e0d7a0e034e36c04e5949ccddfd

  • SHA256

    0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de

  • SHA512

    e177d2bd9fe7722a582e3c93ed9ccd25d9b0ebe0818b425d040088744aade3ae848f9ade3be28d70651af08484a9245b1db8fd2fb897f03c1d4c0332847dff0c

  • SSDEEP

    3072:cmTn8N2QAzgfJkP7+TPbPT/vn/Q7rF48D2W6yop7+TPbPT/vn/Q7jF48DbF62Ime:cX7AYkkT47uC2Wno2T472CbFzXV

Malware Config

Signatures

  • Renames multiple (6813) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Drops file in Program Files directory 64 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Kills process with taskkill 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe
    "C:\Users\Admin\AppData\Local\Temp\0811cf7c2702af79720305f03bb4945d63bd4052d4d6df4aa4cf8e6418e5d9de.exe"
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2412
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM WINWORD*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2296
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM EXCEL*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2180
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM 1c*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2140
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM 1c*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2864
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /F /IM notepad*
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\!!!Readme!!!Help!!!.txt

    Filesize

    77B

    MD5

    a3c6f2b4f7aec77a399743eda259c316

    SHA1

    4177bc9d42fb215dc8492b0ba3ffe007a96f674d

    SHA256

    8c83d1a1ba9fe4937984a9c04d6d79362045d8a4b81556c93e34a18ff3622525

    SHA512

    e2970ea1120e6d02227865f6c8147944cb67e810f4a4ce52f9ea3df05146eab97590707af8bc1ed665cb35190a7915868f3d4e38adb64151baf777834833112f

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

    Filesize

    341B

    MD5

    eaa77b30b2a43b4070e595ace3826804

    SHA1

    7a13c0a56dc49e1e2db820eff95575e784b5380b

    SHA256

    6dd16f92c2ef1ed5d56ebf528b94999dbf330d4f5fb6acf445dc7c518272b9b7

    SHA512

    87627e924ddce2bebe66f7b51cdb5fb0038d7f0cb14caee30a084a6206edda0118c40fb8d2e7f08e168d180880c85b5f27dac66965b33b5e7089d95ddc110e66

  • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

    Filesize

    222B

    MD5

    b529ebc23ae83e693b8da382f64ad27e

    SHA1

    3c53c8cf5494f31d44d4398743e40f181a1b9b54

    SHA256

    9ea1e4011a80e27384b425d2d1634ea48d873b2ffce1075018348b5847806835

    SHA512

    50cee24827f71e3e847f82e68b0bc86a6e3be5e4572136c1acc6c4075e2e57172b0fb19dfa53b6d5e6a0c6e35a17187ed28ecafd63bedab363712fa5968011a1

  • C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

    Filesize

    239KB

    MD5

    5d4860972a83c0e18426d3b7c84b7086

    SHA1

    d352d60f93b6093c3675deb441044527cd8680e8

    SHA256

    d2c2e9d4dbb013acde877c2b917d4eb4aac431f9bdcd19a7ed0726b8205a78e9

    SHA512

    60f176ac9d3c5765ee182ad0ba5d1e98fc9e9d1709189bfd7b9cbeb49b352a36e836c12d5619fb0329f745297e7b3005ecb838495625169f09d6df7ddedce466

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

    Filesize

    24KB

    MD5

    d20e0365cc65b256af4b553b6b61710f

    SHA1

    c36ef8343eb6ea1ed33189c35a1d7393dd2ef397

    SHA256

    9d6097690e018886fe980fe9d0039ceb1f1043d8ef9b8bb9b791f28134e47f64

    SHA512

    eb78b17721ba4ed4f1fcaa944102aff3fbcf9b24c7e537f4cbc8c695d302adf080dd0dc1da5873bba2cb4a79f0536048d0f9c97e8a471fea861ddfe39b95cb18

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

    Filesize

    185B

    MD5

    af607a6651c3585b2b99c4ec09a0b96d

    SHA1

    12f51cf4a4dc8fbbbb924500e4dcc529f8d23760

    SHA256

    f501403166140af3377a3f8926017d7fe7d1975d061cb596db2062c09e087e4a

    SHA512

    a0a702cc786cee9a4896d9b2764af533e98b898bf9734e6be9d6dea48aea335f1816061f7faefcbef6a53b0df9e32431f956d4b48db50b1fc9ee9492ce78cb9e

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

    Filesize

    496B

    MD5

    e60d0c0b199b0041c8c2d8b6eda2542b

    SHA1

    c4110165cbb1983f31aa01b6b240454b3d9e0cd1

    SHA256

    3c2db50a57c588b84f8704cc304883833cdbc438d58f9624083a0121bc6ba3bf

    SHA512

    8dac19350ae19287807a7abcbcc3faada5252c5fa3735ff02e13830d23ea6c3b873d4a79dc713602f3d43e8c16d6dc821ae11eb3a550fc4090c15a69f19f9234

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

    Filesize

    1KB

    MD5

    2864e45c696d6f7ddc732df07c6679fe

    SHA1

    3c26d61a3b6b7be437d2c7f846c008e4dadd83a1

    SHA256

    47e7e3779e22a14ab395971dd26b7853a4300670b98d17ae902a53dee10c6dcf

    SHA512

    884181997dcc932fc1193b87a308f5bf176f85492c5a14efb3b7fbd7ffc0c73d822db7fb03b7296feab5c357cc4ead84318ecbad1e40fce2a42c5dbe7c9dc4ab

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

    Filesize

    5KB

    MD5

    6324ee9f7b4d8c8beabcf670702964c6

    SHA1

    0d08999eca3805524aa7bb3278bc5fc6212b1f9a

    SHA256

    4bc301060dbb164affd3f9346e6e311a534740ce4cd5d53d2f7d12cbfa89d0dc

    SHA512

    15ad98878fe58c065836a9bf1b6773349f854004381aa45542f812c24aa53a9b650a8c09e73395bb731a060c49c10b04786ea790d57a510a068a8e45448bd455

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

    Filesize

    31KB

    MD5

    b8eb75ad0dcf8034c33b32e04320ab43

    SHA1

    c6e9060716ae9b33d268c71d89b57263e6927999

    SHA256

    96eb6833261538977191919c10dd26b939dff67ed811db35eeb14c198b862c57

    SHA512

    98b1cf9b224e735e6223d86df260f85c8ca33d1c7f347a0755a12c58d3edf57d2e8de60b5ae8b956fd7d7786a7b4a06e1cb7d8f39d1e11f36ff9097163e20b9f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

    Filesize

    4KB

    MD5

    a9712bd6b50896ddeca6c6c156b092ac

    SHA1

    4e0168de098180a0f1cd3fe8d467de5f5393b671

    SHA256

    af22ffd1dff633700bf9ae9420fe2146f1934a1e12115fcbe44a2c43f0492416

    SHA512

    b614dc1477cf603f4a95813396a229cfd0674b40c211181fc6590b66b9e53639ddd50188719e142c8eaf9c3ef2c39ce9d1e672c8bfb9ade9133a10610a414158

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

    Filesize

    21KB

    MD5

    7e989adb1e1840786e7a0225290ffb4c

    SHA1

    d3ec52a2c379a4d56f4bed4eeefcde7b3caefbfa

    SHA256

    1358bbbe8aeae66ea6ccd4434195cff7e2c407bc1976e9bca7ae09617ecca505

    SHA512

    b6dfe7e0d0f2c6a31978439a9b12618b4a2af402821d119ba108e13670b27dc6533e627c8e6915084b04a87a14c65c2af93d680df789f6f4daee56f9a3d24760

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

    Filesize

    106B

    MD5

    608d6c9e9ebaa65238d150b357380ea0

    SHA1

    1d82e60da7c8115031bea3dcdaa00a97df7b4bb8

    SHA256

    d300fc0d05c6501731e512444a55eb3aa529ccbc786246da91779f4c0febea3a

    SHA512

    da0c2a2518cacff40796ebeb248a187f5448caee69094040e2a57d5214d8c3fe7436d93bd7ad7f8bb38dc25a4a84d224f7b66c897300f06705d56bfc7a54dde5

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

    Filesize

    8KB

    MD5

    f4a53925a2c3684278423bf6af229bd9

    SHA1

    6f5b01a6c90bc685b0481007c4431b87da0ba68b

    SHA256

    3f161d138472e1ea03e86e0e8adc35d41c9a3ff27b07560d8419e8c226f662a4

    SHA512

    30d395380853bd737a6b70c8bd6e457a0dc85b18390c04b02d8bb7716049748c30008860b9563b50f072889fb2d51ce14358fa692ab09a3d9e7873130702ed51

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

    Filesize

    15KB

    MD5

    de504752f31f1c6e2c9048e7de6c2ceb

    SHA1

    f2cd1c38ceb842efdb40ee017003941bf9361387

    SHA256

    31eff6263cffa0e1794bf13793847729df11c363cf76361ec640ce3b11ef6bc4

    SHA512

    ce4ce8aae85dd68e6692fdc359d6ae834fd91d134ca3b080fac2ecabd4f8459edc6bb1016187cbcf8cbd6ff9ff42ebfe15567481af31f8eb0225829ee6f2c873

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

    Filesize

    6KB

    MD5

    41e70c07ca1b34b08365b95f1be180ef

    SHA1

    484338790ec4c86183c854604d0134617c08950f

    SHA256

    9aa21b0a2c3cd24bad0def63060042e6d4b707ccb4462a462eedd5bebc3d8248

    SHA512

    24eb4718299e31b789d4617c98a0be2cc3b161e1a589934f1d076ca4111cfc12b030235b57201ad3f71c16933a8035f84085cc9e1bf083b3a32aed19dbd1a0ff

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

    Filesize

    20KB

    MD5

    4c5e2347663977fe082ad50042d9a3b8

    SHA1

    bb8311c27ae35997ba65e3d34dfa95f34ed78256

    SHA256

    245814bc630eb912782dc260900e829d32f87ccc98321c7241076ecc3a225e0c

    SHA512

    37e46b67973c503bd9ce51796a511f23d3cabe048a89911380e85a6c78f9dcf8ef75771daaac70b4c4c0bfb0b71d3119c5939b8fe19d8836dbc2f718027daa75

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

    Filesize

    6KB

    MD5

    b5d14f87541eff90b79b0fcf4090385d

    SHA1

    ec27046600ceee6a9e9cc154fbf99cce7b89f7d0

    SHA256

    7223afd31b3ef53835914efe0737b6781713d42a1581a1cf83481a1cc2f29c65

    SHA512

    197c030e2272462d145e5243fdf448a6336d228dc64aa4f0930651fd1aac9acb41353254ac70f365cf5757a78820ae96047596bfa56c75abf316f332187536fc

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

    Filesize

    15KB

    MD5

    c1aacf6ff668a324f6db280c758604b2

    SHA1

    8eaee485a24dd19120f47e20851130139f5de986

    SHA256

    57691ff6b3620eb446fd34b7ddfdec26cbe4b40a78936466a081307594645403

    SHA512

    3b9516e0aecb558655fa107c11da4330179115ca8a1a89544a897e7b41dcfc99c6375e15a0417209cd9ac24f4532201e34bf6b75d01a432ad269daae6ac9fc7f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

    Filesize

    2KB

    MD5

    e8d368278d096bb7536a811da4fee3ed

    SHA1

    42313279649d2bed4817f28746c0a8d1cd0b3027

    SHA256

    503dd979025f2556c67fccf3380daca895fd9f4f2aa0636f07cb5317c1ef6f20

    SHA512

    e7d4c9c496db7dac7c3af57c4b03e79eb052dc075585a32c09bf984d55c6e0ea79bdcebd5c4adc6c5f970615c3436506a837a0b136024c35e94d7eb0dc89f7e2

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

    Filesize

    318B

    MD5

    5f80d1575d13f8f2d0a72e535d0c097e

    SHA1

    d42c66902ec852a506df43a9e38bc606447c18b8

    SHA256

    2e22447d3026ea1f4727fe72806f58de3a88c5a626fc3e486df7fcd27d5c5bf3

    SHA512

    1ff4903953535eafc1be3f6517ea1d76ebda08a0da57d957765be51fb8c50e51b30e6e2ba8665af23fbd2a84f0b6e37b677584ec946f1624b5c80861d676f080

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

    Filesize

    6KB

    MD5

    0e8d94c0b79bb42d451d7d4c2e8d2fd8

    SHA1

    d1b71c1eabc49eaecc285d3537a6114c8b0d3ff7

    SHA256

    9aed3a1a1a2fb8cb280749eb6e3f6802e39ecb30f7fc98dff99418c3432813da

    SHA512

    1bdd9d9870b2dc038b30006d079dc933e0ad71d4a7356de108aa6a15ac35d7033fa1e9f3b33cec0c854e205e4957ce1a1722dbf6b0e1015d8290db0b560239bd

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

    Filesize

    255B

    MD5

    1c027f00f01e22a0202b34b9a6f44159

    SHA1

    a4a63007c18e3a46df1d9cbe6bfae982ec10da5f

    SHA256

    4b60508952982aef2e9241027e2b3eb7e6b00bb688ed0f40a369f4cced75ffb2

    SHA512

    3c75cba31a60de157a7ace3b1824037901156e46eefa7355674eaca8e4df7caeaaf1f9a9cce4ee20eb95942b51beab6c6141f835c37012f58c89c8bbb7113362

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

    Filesize

    323B

    MD5

    e72082940e41092243b981432b030819

    SHA1

    d047bfe9bf3fb12948f8e3b02014747daff21249

    SHA256

    2894d6a7e3f3513df2ee9a12eeea8e8b7db694068cbaf7b1a6748322ed89bfb2

    SHA512

    744da5e90d10f0254a58287487821b2a01fba801ee5832f65f1622507fcf687771aba37aabfdeac530c3aecddc3d379b48820877dcef94a5fc457a71dcb7f083

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

    Filesize

    367B

    MD5

    50c23f280e3be7e057c0a3940bfdec6a

    SHA1

    a2bc163eb59bccdf7ae1ff4e17401a266dd895b0

    SHA256

    94504ceae4a0459d310fa984a9356b15a60a94be8baee7bf5355b8e20185ba52

    SHA512

    72ae8863f0b305ef110d742be8958baf6b661a2103964b75753e1624b5f065b1849fa8526bbde243893eb50cb21069eb58865d79925b5cc7ba0726e093544582

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

    Filesize

    148B

    MD5

    b54e916c78e1376f0102e767690fe0c5

    SHA1

    a1b8ec264976d331f45189d26dbb3b7e737859ee

    SHA256

    0e56d0b99189d1e63bb8599f8bde02e026a3327551ceafc22332678bf1dcbc7e

    SHA512

    90c03b02394aae50dd533e276d66c0014c70942117ac06a468f342850abacd0bf9fa4a83d021e645ea7ff06a47b45bda3d9262b4676257d012a14fb155d15cd6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

    Filesize

    440B

    MD5

    dd9d1d9ebc4a0e0affc89df186e03b24

    SHA1

    7cf0055db328a5200eab88756c337e582874c89d

    SHA256

    e968b54d9a245620fa7f174a8e532bc71b71960d483b9f159c51604577a46048

    SHA512

    752c86400d05e5159c8a9552ab346fb91cec4135aa3fc4c47a7e386df1448f5c666a3cb51be83fad4dc5e27f69b85b583b74beb873177244623c8906e87e5f4a

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

    Filesize

    462B

    MD5

    eb6d6c5d1f3e458c85edd93640348d75

    SHA1

    89ebe9095886c7e572b4d6db4f91bcc81f56f02c

    SHA256

    0ebe007d90a10c00b791c4958eb4d44ab35485ccbc2d06047c136eb7fecfeab6

    SHA512

    0a42d94d0e3dc786c2e7436c3a452e20e9cbbeddc16d0ac71af8882ae613cbcc0ec4d3700603c1c44fb39a2b4e0c03eb243ece31a033845e785e89acd885962b

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

    Filesize

    267B

    MD5

    494b8d92477cf8329a1863b00aba0456

    SHA1

    cf96f388768458cb1d2caa971cd318c067ea732a

    SHA256

    ddc518858f46ab94e7069c44357476a34894de85544fa50c154c53742277f0a3

    SHA512

    4b9b3f4da50a2e4f2686bfd99cf7331c0d37712b98f65bca6ccaff857ba3d75da10ab8f1ecf01bb67d25ec3a8dab9817299e0dbaa5ba2403856b335d0beee8cb

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

    Filesize

    2KB

    MD5

    b2f4c5f4deef7db71b8b1d2a8922f54b

    SHA1

    773a02fc49190b6384157bbc032fd462aba4c873

    SHA256

    9ce710fe61ebb04d3f504fd78ca0d2145f3b8df2f6ab60b641712b54acc5bdc1

    SHA512

    d9895b07707970a259b2fb675721e501edd2306ae66fc58af46b5d40678cd86c52c0202711073c59fd0d9ca9a88f57ed590380969d9faead6a5cff79dc460a43

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

    Filesize

    3KB

    MD5

    bfd2e864b5321c4f4b8ff3d665920c32

    SHA1

    44e135b58e158771136f4640d598b92af866af6f

    SHA256

    d84ff20aca2f696bc32ef441f80c6e811274f8693c3f69552f83f23767a9b721

    SHA512

    25b1d192647bf3246a30da22aa7b75b78bced51f83473b1823d8108bdfc55b61a50a22ec28296ae02a89fac037c94d28d721b01f0b4f38cdd7f5036ec28ecc09

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

    Filesize

    462B

    MD5

    4dcd2185af1302126e2fb1ab7e2bf69c

    SHA1

    2aee2e3616852dbf1ba8261224df8bc66e209908

    SHA256

    bcd62e5b1f5d6b711083872bbe6b9d1758de3fa6a236f5a2bde067089e22fd8d

    SHA512

    abf0e44e2d7ebcbbb2c3cdb97ca8be3c8c7c0adfc76bd88654307168bada36aff79199b59eda29fa41115fa19caeda341a076938ac66ce29bd12760362b92284

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

    Filesize

    264B

    MD5

    9db842d7cd6ed50b46640d6ca7b568fc

    SHA1

    aed99b3e4e8f62bddbf90973afe30c29aa1f27aa

    SHA256

    3cc060774d53c75e37c3bc1adf86daaabd7cc6b02d2fe2ee92fd62900d227abf

    SHA512

    a76e9490246d9d8f7e24223a16d76655d2c5bf2327d5547b0934f5c980d2b230e30ac45186b5f9a414604697d391f5a50a5fd9c45e69286cff4091dc7b6e2bb3

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

    Filesize

    233B

    MD5

    3b8d6587b781902edfec31316ce75918

    SHA1

    fa52b4bea5e44d0259e1616c8419b568ac98beb3

    SHA256

    ef7904bb2d97c4298129f0952215466bb3304bb4c0a7e35a900c139733a4c073

    SHA512

    1364e49d5002b44d5151fa16c0f2cc499009fa0426613f8ad94f29ba5525d9a98779dd53dd1c01019c13c3e9cb9b606dfafe82a4196ff3330b64f390a4ad4238

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

    Filesize

    364B

    MD5

    22d9cf0a9fedab3db4335123c67e7cb2

    SHA1

    50430a1c924a2b1481535ed2aa6dfd11ed2b6499

    SHA256

    625120c1214449aea77801f9f3fbc2c4a942364dc400e7f598f7b27c1a0dac4b

    SHA512

    3f45312911d0d86d4217f335476daf39070956216b2a18ab905dcf2755ae965b1d30d3686040fe262a557715f650c496fc3588fc496b447c4e4872e7c24a0363

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

    Filesize

    364B

    MD5

    498ee041308bfdab374593a1be068cbc

    SHA1

    cceda5d86538745202f0188d75f58edcaeb12a17

    SHA256

    b971fc8cbb40d198475dcead33398b275bced10f247b791a4df39b961cd497a3

    SHA512

    8ea8628e8f9a4f6a58ab13be7c987fc744d73e19c3029ac80d53fd727c47f4917f74c64c0f5f1faa5a83b7f2f4c7bce49ec89b77882381d6e554977a640bd526

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

    Filesize

    6KB

    MD5

    f77485454518c7fd127d0e530255fc9e

    SHA1

    e7dc1bafe65560aec39d8000e2e3a470176a9fc7

    SHA256

    c5ae3ba4f3cdcea7164dd1e538fc927782eb1971aa0c7be66c1f88c983fe92b3

    SHA512

    e858a528cfaa76ec48b266ed4cb07df6da9d4fe37098291700b8e3c3d485a1ab7fcb128d79ca879361a5d0afba8a4f021f221c8f5f1dab7aa46402e64487b1e6

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

    Filesize

    428B

    MD5

    8990eada665295a6bde006c394861e27

    SHA1

    bfbfe88ce6b1ffac3aa34c6f449169dfc9eb3a50

    SHA256

    495830dd25642fd39a979f403c6ee5933896b2f7098f4dc95ba95846092a58ca

    SHA512

    cec4e2b7ade3cf1dbea054b93dcaa1763214b6ae7ca553e8b63854a3f0729ef85448ab7e5b3f0c05fd68651ff0ad1c7ba1ac5c619c2efa7d35b2519c05ef59ff

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

    Filesize

    26KB

    MD5

    beaa4e4b675587763791540dd7fd5a2f

    SHA1

    77a97ce9e439f3b6f783ffa51c7062fcd643ffbc

    SHA256

    91d686ea1295474b5a79e75ee59401edb56af8618208b9a91c796874abf73473

    SHA512

    f39297268eac9c7c6119642ded853c35e30c35efc0358d8d151266fe2bc0b735558bb07e4ad3145c6c26c5aaa6c977cea82cbea8a6be20f586e44396ff69e780

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

    Filesize

    815B

    MD5

    7f28518c4225db4d62454666b9ac2976

    SHA1

    3759419420215278883cc2ad913b530d1a97b105

    SHA256

    f9bd3750d611ce502a8b775079bfe3ec9ce6eb7006b87af9e0feb22e8c9393ef

    SHA512

    761bea4a6f33ec6c563b628b3843710796b51c1f3d97ad9612be8c52bf8e73db6955bb44cba77906d065f66654dd582d2ebd7e4c5ac97ede6515afc5320ea83f

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

    Filesize

    870B

    MD5

    8c685448ab317650752ed2f0996b2c69

    SHA1

    0016ab32ff126d191160ddaa50f041aef9a75f28

    SHA256

    42f65ef024946994c3e1d5ac4f503b2a5ac8ded229bc051fb8095f0797a1559e

    SHA512

    391632aaca24f8be0a30245886565bcab9c7fefa1b8b5591c232782cefcdbd293143b1ad57d9e7537e0072c9c478cb2c12c273a5fe1090d260a6b157631fef3e

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO

    Filesize

    318B

    MD5

    c6dcab9afd4e52b7b04b017c418f7662

    SHA1

    a486bf211bfdb9544d783649ca1bf0779bf792f4

    SHA256

    b428f09275670a94a5247c5f8e098fd06261c1da318c88c046c2b8227cd1dbec

    SHA512

    a7f422362c4be5f0ce7ea9e7f9aae6c654772ed3ab2166982de270e2235b373ba34dbce1e25ea3460d67ab1c0bbb0e7c85e2d12f35ede531d7aa2355dc5be7de

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

    Filesize

    3KB

    MD5

    e793867d36bafd21de3adba5c7948749

    SHA1

    6eb16806c1ead365cff4aacd884ef6556076b1e3

    SHA256

    e51627c79419fa970b9771f3e473dbe318971b5b6547d9811c128b69c22bd17d

    SHA512

    d6ad277388c588a23ce3fbbec0e781f6a4937d34659652d7cdf2192084afcc3106c8f526bd3794e7155312ed95719844332a078c7c86bad30a1b7c9182919c98

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

    Filesize

    2KB

    MD5

    4e1821ba90ae9ea328e0b06e18383236

    SHA1

    18804ad33a0284320b5f9120ed402b647ac08d07

    SHA256

    f5443125f8022bc07ed3409f853d0c2b7f1ad2b2b06657f73335a1836cc64f99

    SHA512

    a2a0508f92e500c143a28fe8c8c315865b7df2354f36562f9f107511ba6192be3d2b0f7b02112f6f9b871e66a9c607616ab2ac553eaeac58982817b5c3f40b0d

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

    Filesize

    19KB

    MD5

    6aba443f8d4ccdc3011d2b03880b1b4b

    SHA1

    0aa515aec4fd1a136e50914328de3a506499bbeb

    SHA256

    663609311018319e53b8a6753c31f7c88661cad212f1978b6a177aabd825d306

    SHA512

    d94242f6372a9e52bbc435da98dd3ecddee67db839e87bad0780538d5327b70acdbdbc3a80055a8b88fe4b654faf821af741a3c5cfee776552a50e4edacb3628

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

    Filesize

    890B

    MD5

    36f09ae37a31ff5b088219e917fd62bc

    SHA1

    ec0b9309c4259308e4972d6c28bda41dcc2e74e9

    SHA256

    c07c75f351967ba0adf2ac146cfa4c28f36bdcc44bc88310e167bed274bc29f8

    SHA512

    d81b7451cdb42ac1db956f67dc2f53fe5ced5d40c0cbd2ca9300e8dcbec65eb8fef923ba48e403d271cf73819ad32a0f1b5d4d76f0abef2edfebc9cf965f4c14

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

    Filesize

    852B

    MD5

    b98863a68958b1b2aaafbdb86c5977b3

    SHA1

    ac1313573bba7fdf6410f0d4cb4cb5d1cceb9515

    SHA256

    a495818ff1884396729c7ece186fd03009ff4c8f778a73a646f1674c285d1017

    SHA512

    c47d1af02737f02b186d52dadd4b353804faef56be733c1dcec44d05f5eb8b6fb57bb5b2a22dd98590d356cdce50ca28e26d760bc9110052544cc2f4f72c7559

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

    Filesize

    860B

    MD5

    de80b4b78cb0e6803e5b7926dbbbc0a8

    SHA1

    f970727bcc5febe3e0ac220c9d9d03425bc75d41

    SHA256

    5cdbf2d8d82bedbcc4bd478527a989b0551e95845303d9a0eef3ac543c6fb6fc

    SHA512

    63a2f07949f87fef51e225e9236583dc11330e9cc8bf691763016db8c7c6a1acd89702c34001d5426b9750aa0c9d52822d1fbf5626dbaf6c915e26d79ab8def1

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

    Filesize

    580B

    MD5

    7d275ded0fdc14540086be6e79d275a0

    SHA1

    c79bb112e6c64cdccac25570af10164ea5d8e4bb

    SHA256

    51a5ce400fb83d954d88b42b1f228b9ebc6a1b1ca1eed1e7bae17d77c2d6ec0e

    SHA512

    b8aa275c045a4bf0ba73a6bd303e50a9b6cfce03aa744b0f29e17b6bd99d443f9711c4eb0c072dbd73979547abf0fb41b2a7af141556eb8bb3bd48a879828a65

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

    Filesize

    899B

    MD5

    84ec28bdae9dbe5dd417be8d25d10a68

    SHA1

    971fc6e8fd52f8ebaf54e543e43a40b1d42bd6c7

    SHA256

    0f746fade43c47377106bfa46732e429edabb29d804034aa0ba0f441090629f5

    SHA512

    927744c8d486bcb917cbcfc2e70178d93e0371d15944012953b55f02e728ebbc5b1fd06da3645f6697e9c5f464fb8f1ce92c6142e96488faa5ad8016927cd33a

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

    Filesize

    625B

    MD5

    1eb4aa4cfa4d98f16c285a3ab314cae4

    SHA1

    898db811590a4aaf0a9061e9119a8df781f097eb

    SHA256

    ec8925a5a15e8701baa65e613aa818f697a5049775437d21c5232309891fd7b5

    SHA512

    2380aca7d070ec47d47b997edbfef890195b16794153505aea0699ff1155234ab999a6c42da44be68c4e3959dfb52e951dc541606373977d15d9a61307027c33

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

    Filesize

    873B

    MD5

    0e9e04f3ff99806ffbf0cb7611e7c257

    SHA1

    82f2817faa0d930348b528357ee3ec2f0d3094e4

    SHA256

    404bd271cdacbb8ea4c32c1ee4e815a2e99d5d6003337d07db315249a368180d

    SHA512

    9cc96bb5218bc0d22c2dd269aabac851639d999811047984f3c032d38a595cbea1133ef9002a2edbb6916e0a05dcc83662a14352c92e516b04bfb762757ff6ef

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

    Filesize

    5KB

    MD5

    e65f367f5ae24a38e0a79213585ca805

    SHA1

    d308311a61a17e259a6fb643334dd0d3feb8e768

    SHA256

    5182fd4940fdc0af847ccf060047a2ccc5e5734219ff1487ebea315beb123b65

    SHA512

    d924131642b57170bb594088a5b6907feab04ffd3d672b0c7990170b47e566dd470a77c1d950e0e333daec1ad1a9a5b4f583bf2081c9e612ea7e58df44b81380

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

    Filesize

    615B

    MD5

    3a401c7c5f9be07fd4cd45cd8122faa9

    SHA1

    8180b84b109d18bb49f918512a5485954a777f71

    SHA256

    061cdf6d0accefb344718b1fecd176648ddbac9ae09b2f0f59a35f7a95f51635

    SHA512

    f8e315e76f5d140bac71af2eab3ed8d59f0638edc99fa2f67d453ab22857bcffb497b2a4c350b8befd2dddea120dd5502380ac6185b8ba80580a0b25d9238829

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

    Filesize

    848B

    MD5

    006bdf376985258601b5d1f73aaebce5

    SHA1

    21eee12fe6b1dcb401bda7dde956c15b30ee80c3

    SHA256

    89efa40f72a4742bdd5f4be1baee55089c14d16fd4f922715653a5305c50a12a

    SHA512

    b4084ecf51950a0fe7eeb6f20ebb53c2375c02a8b3d10677f7f4653c6ceb9d8927d026592974764cffe5679b11c416e6153cd6ec7c655268b9422070f3c361f9

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

    Filesize

    847B

    MD5

    d289c04f79d4387122d667ea65ff3f2d

    SHA1

    20363f59979664a6b3d24a36258fbcf5c887611f

    SHA256

    72c29669aa318af33ffe9489af106026da86d7161b223919eba0ada92cc67004

    SHA512

    474d4846df7068cbf997526572abdf52caa05e2f4b5cb6f53951097a8f4f8aa8a2edd15c25e508aa523aff83923f3bd106184ea112e52e778e36811b13413a17

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

    Filesize

    869B

    MD5

    ded5c377ec62557e496b449435bc9690

    SHA1

    f03548d396d820e9c3f6060722669838004cce29

    SHA256

    294ce7832e5b6c68fcd41e67452d63f9a5479a567c3864883f7adafae5d47ad2

    SHA512

    663c5c474c619f8e07e8ba87c5e51f4f042445a67c180dae67a6d7d0604d5057170609236c2b045c2d822e31b17fafa9c9a9a4cd3da3c97f0bf5678cb16a973a

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

    Filesize

    847B

    MD5

    3b8e78e17bbb79592fb41f56dd87d349

    SHA1

    bfe6e145c74b711d9db43b971f0c566305d764e0

    SHA256

    92ec49106cacd3823d795d5dc29a1358594c93332e2bd60983a286e2dcc566c9

    SHA512

    8d2a07258779d12b9ef2f96edd152727c2c09071d31ed11f7adb1794869c15afce0a925679d52516dec59d8358551638fe780358c5d9a45bb39e9056041de657

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

    Filesize

    863B

    MD5

    e3d0eae674d8677e7856c24792a5feb7

    SHA1

    2fec599921f1d81ac8f39388754371ce94469ecd

    SHA256

    56e108c44bc4a81f011b632ed25b0bbff574679bf6e2bd0c968453fbff28c4ed

    SHA512

    021c8d9e1dfdb886846dffa69a4979c2dc5cf2eba98041eadf01d7e6d9b99be771382284f46657e0ce5b64b881826163ee378352ab50b861415b0c5da4ad7574

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

    Filesize

    861B

    MD5

    88eff69ed7048225503a3e783b9a403c

    SHA1

    34f8b2b19315701c17edcb2e2932688199ed7b9d

    SHA256

    c15258ac120e71c6772a09c82585e1db4129e80bc568cc60a7e0a58756122544

    SHA512

    583cb3c418e0024eb1e0a12aac817ee74281e57f2dd6af8519c53f2f4b0b8846af76503a10505232ce99e59cbf06b99a90eacabfca66c35d2802494471e420f4

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

    Filesize

    850B

    MD5

    4772f49b38432c0019f53afa08a3d67f

    SHA1

    ee06bbf81270441cb667d2d2c9ba53eb277e4f96

    SHA256

    7e1587191a51e3473372e36de75b5551f1b9cac8ded9f5e7effbd831b28bfa13

    SHA512

    c79bf903e6a92cd2c1600eb5c95a6f0b15184615517cb248b1317957475f7b259199eb69be302d57ed2d1afe1f3cf48d747d24d948c210b3ba91f73e333a77ce

  • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

    Filesize

    883B

    MD5

    a923957203a91c4fd97068b035dd2c72

    SHA1

    c1f485899b5811f00fbf3e9ca1ac9389de1d84f3

    SHA256

    0bde28db9d7ccf722ec5c746c300f7f6760100dc39a926f1bccbc21fc8a48c8f

    SHA512

    c6b4c04b288fb217e9921ea44d17c14cc6e66eee2d11ed4245fda7e81daf84262f3edb48b90e3fe1c55d52d2a5b10b5a8bc00fd663a2d284fa5700da5933c095

  • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

    Filesize

    807B

    MD5

    4854455ebb343672a46e975b8605238c

    SHA1

    9ad647fe3e1760440e63f74ca7377ae365881b40

    SHA256

    afbe024c082a8cfbf4fadc4a1ab5c9bf1b13085e29350dcc0df1247b1d0c92ec

    SHA512

    60972de56b741e9a378a1f489c157f74c18c68f9ad929203353eb7338a2be2505ed1f1117ea04a8f093a3b21a01d10f56e861f1e3be8479c664378a02114e972

  • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

    Filesize

    806B

    MD5

    f7edb6603d6d8288a3f0b46a351ac1e5

    SHA1

    41130ad5f436c1f27851affb6405d79bc614b2e1

    SHA256

    43ffd976d88c6b07516d70bb62215bad72d2b3f3368e89e9ff7c3bfdebacda32

    SHA512

    972a8e3de4de0c09dba6ad10964cb3128352fc4a80f9e4e16d05e87e9281c9ab9253f0f52b46fdbfd9d424f62787271735daf375cacd069cf93440332922a6f6

  • C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

    Filesize

    5KB

    MD5

    c0eef7258be77b146b35351f0cd2ec9f

    SHA1

    3f04dc94467444b9ce090db243c8e67ef2e08bc2

    SHA256

    e5a78c589922e7caedffcb47ec0bf1bea56bf47cfe31135d3903c1e4ffe8eb45

    SHA512

    f96c1874a865523f50cb53a9138fbce8a4ec01a25c96eea4c2245f81b9a1ab08b5f63083a83b420593f5735b053fa59760aa0986095eb17c3ca419555f76fc04

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

    Filesize

    153B

    MD5

    e18b939555b11a55384a353effef1608

    SHA1

    eb52ac1d3897672ccc53d19a8efbbaea2dca929c

    SHA256

    4491054274cb57423b54f636f6e4acbbcdd2681d434ff3544a0551d99e3979e4

    SHA512

    1e83fae862c9a768b835ca544d6d1fd076bd7695a5ddbc204649620579311db758359f1a0d6569deadf637f24fc93cde67ea872cc98259f984fa07c00717a0a4

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UCT

    Filesize

    27B

    MD5

    f602e941afa133463114be3c84076a87

    SHA1

    62a0532ba91b555f49d8b9c4e72e132b34bcf18b

    SHA256

    9394533e85130e30e55059ec7ac6b116e36496d6463a735f504c4e9d06ae64e7

    SHA512

    4d510947bd6381141c9ac17e7fe44c5edba1f2d9d0e8ab9a34fcf28aa5d7992c898d40a98b98d278fb774f0ec3331da7c66fc8f21b1abe0858255ce07774302d

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\EST5

    Filesize

    27B

    MD5

    9275c86f8abdc8a6688d2a4aba5d1274

    SHA1

    1ba0be3d097646eb7ac416861ef3ddb7d8bc4e1a

    SHA256

    c7ce963067b7b7030ee1fa7a0416ef59c8fa3f3aab8fa364f3203329e4d943f0

    SHA512

    a5434c370f34796bcf7f613e5ac3a9f55864be86fd0387dca8bef7a598e45ab212f1379db87ccb7ae7f2653cc60d4fa314325214cf67e22c0fc07a021ac9611f

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\HST10

    Filesize

    27B

    MD5

    433cbc706636bcd72a7d64921bd61495

    SHA1

    7082990614a27a85b63618d6fb427eb9d738c895

    SHA256

    285d5198f25bcdcab1f0d4c851a79dc21bb68269ddaf2ff5a14c3a91e33ba6b5

    SHA512

    3d95808e68f6d1a4855fdaa14ba15b053f19802cf7225e836d2d5cb509e65ea01f8826d560416ac42a15868100ba5f11a7cd2bdbd75cf763e7034d5afa65eb95

  • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\MST7

    Filesize

    27B

    MD5

    00c0706973f5aeba0fa77b9399940790

    SHA1

    ff4cd23ec27de07cb1c913b8b56b43ae766dc9b6

    SHA256

    56e783bca123c4bf33489c224ccf4663cf41db54cf301f5084d5d03af437db37

    SHA512

    7ba4ff1a409db8420294177cb77486849e86e6bd73483a0e8cd68dfb4b4d6db467f03433e70424ab934fa9336ab8240c4fb6c62f732bfde64a1dd705f0b466bd

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

    Filesize

    57B

    MD5

    eb3dbbecacddb5cc59cfdb5382d4c178

    SHA1

    2b00f449c629305022c2027ad0bb76d9b2be6e45

    SHA256

    f023adebf503e3a8485c76f42dc24abdd1c262e7f2c89c66af15b580eb9305d4

    SHA512

    7c055fc3d55a7315ceb609d3707adc50f2448e083635c11af5c4f770933d01db3fe089448c552aabf7ef2695fff4596155593d348d474d3404810c70d7a1444b

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt

    Filesize

    11KB

    MD5

    67202d74b399c61f4072c0727ca892d6

    SHA1

    0c5a9b16e6628254530f5a8833909675950f436d

    SHA256

    869447b991ebc6252fff74b48f0f3a0d1c17574d86ba6b24040a728caef970b4

    SHA512

    88e6d6de3ae498c400a05d3dea7c952d48c5575c5a1242ee3b87fb6e1dbeec843aa3179211af6712c2d3175310c8bc87273df1647fc2f76ff51cec0a7ffa0874

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

    Filesize

    7KB

    MD5

    0cc539528b1e858f9178432731f80c1a

    SHA1

    933482c997b58e75a6661bacecb292fd70c03bef

    SHA256

    2dc0e6a97237ab4de5d5d34225baaa4adf7b8e63324e67ac4234cfd604da6f6a

    SHA512

    eb5f7b933216136d441448de6dc0f0f3acfcf94b3c19d3fc757ecd2da4ea67b5e646a684182f4ee4ed6e373a83b7fa7e26b29b6cc948d63c6310795c2fed50fb

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

    Filesize

    7KB

    MD5

    c16f6d1db257b4e833a3e9420e8bd977

    SHA1

    a7b56d689aaa4f467f08d79becd457b61d77a8ce

    SHA256

    b7e90473a10bd0774cc3c54ccc8f31a18069dff835cfa2dc988cec37a82c961a

    SHA512

    7d083dcf0caa95fb0ef360242fea88184f05b9de94363443df0715066792c6c8be9fd6d92040084856bdd1672d265f71e5b12a6332e36d6e7a2fab8937296a75

  • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

    Filesize

    133B

    MD5

    285367955f8c6314317100f470aaf71e

    SHA1

    0431fcaf190c6a0220cde13d484bdd40e38fe43c

    SHA256

    d604fcad53f474a0b97064806dd2b3c47ddbdb66e4f613a0ca2820a06672e1fd

    SHA512

    6ae5d298b80d465b76cb2db82a850316d1e71466984c46a9d778fca2ff5757a50fe862597a2714831ffeb5148d7a1fc65bfe2290d39c0b8faac6254bafbd12ab

  • C:\Program Files\Java\jre7\COPYRIGHT

    Filesize

    3KB

    MD5

    8f0cbec6019099aa8f91fd3327db17b1

    SHA1

    d609e2399fcff6119c019035e2009e98c806f534

    SHA256

    61d8a821d76814ce06832061cc19e0e4a60740f8736ba71c069edc9f57f4f320

    SHA512

    eff0596ceb266ea6ffe61806fe331ca94b403d7cd9a3d97c59d6dea7988e3d3d6edb21a814856db2b6366e4887db4dbc38cfcf31243835ed4fd36840c69bc9e5

  • C:\Program Files\Java\jre7\LICENSE

    Filesize

    41B

    MD5

    39d5aafbbd169417af3c7835f63f1433

    SHA1

    e1616c5c28824f43ae920fc09a0d71acac85a0ab

    SHA256

    aaa1ecb1c3c6a948a2c9fb89690535e47b7e9a70d0965dc080df40b6275c597c

    SHA512

    a469822720b37c7dd78a27923834e4ae201e21d2710c0b6be49c9d06f2c39360f74f4c95ade2ded4fb3ffbb288a5385afa3a6cf3ae83e186d8be993fb597b491

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

    Filesize

    109KB

    MD5

    a278a9137bbedb4f4d897666305d682f

    SHA1

    6b8d8c8c4fdf6f755ddfd5e91ac0f501f796f3df

    SHA256

    ffb23dab1cfb801398618a2647d47b6c2df2d0f58310e73ace9b29f7cd9e632e

    SHA512

    eacb9ee427e9671b200fa594cde9e4036f3bfce5fc8fe45a5d5f15fa2c0bd1be9dd748bb6d1893bd11d6e8af10b2434baae93c8e06178f5e2b9fec18aa773177

  • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

    Filesize

    172KB

    MD5

    b43d16a288f90a2254d437adbce4d8ad

    SHA1

    18df78fd46c6c0549e8f880676e68c289e19910d

    SHA256

    766bea16601e21e6e1c688d2a152107e78504e44490014050ce43e2d68e31dfb

    SHA512

    ee7964f66165da3a35b99415b3d7c11d3282a11623bcaa76fd01a8db00b442e0c66adb4b13b98fb5bb29d92f47d2c665afa30f6ae673c43f9b56dc781ddaad34

  • C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties

    Filesize

    3KB

    MD5

    384136037d71a155dda64fada24ec6fe

    SHA1

    9d23b2fe08fcc87c84bff6a3e685b3377d7e1c5d

    SHA256

    f31568b86e1ea14c81e0597c63a791be78178d4f7dd112a7768ee74370dcfa26

    SHA512

    c6ff43ab3ae320df4222ba5c018e5ecf47d364ae5a1aa70563ae542dc15a32d861e28c7babe5e077b1c604cb8fe775989b04f10cfcc4f4a62b0f4f46e235aeb8

  • C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia

    Filesize

    27B

    MD5

    4f359e17bc961b7502e1bb8cbb8cbb5c

    SHA1

    b8bd43629d293545e3e417ef7e92666f303ab8b0

    SHA256

    a896dcb6f3dae60928e25f36cff063e8ab30fd7599e0c44d5bc109f87df6c987

    SHA512

    1822015b79a5897f5c2781508d8f12c470e57e13b55513790282b921947d65eadcc72310f30d4dfad6d0ef8e4149aa846062b4323fe5489bfaf1a117f93f416f

  • C:\Program Files\Java\jre7\lib\zi\CET

    Filesize

    1KB

    MD5

    fd06e357421db53927d90fa0a541c5eb

    SHA1

    04b85b07ee226b9432613f109da943151809615b

    SHA256

    0725dba33674423f019fc2e1bcb00ff68899c31e29e60cf6c3fd66a3e201a74d

    SHA512

    c61e1a9697ebffff3bc565d73e78f68b80401abe51b9a17eff3e7cb1d8cef5f6f78f5ee8f857bdd6fef48bc28418f15ef128fccb5d60267bd327bdb41229d828

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4

    Filesize

    27B

    MD5

    7a36a589f938c549504e00132650d064

    SHA1

    73c5ab1dc822fc25d6c81ad8194ac58a236c686b

    SHA256

    205d45fd5d811f3e99de38b9430df3b755f217e0cae173bb2182a4203c1cda3b

    SHA512

    24bcc6f9f0b0691dce28510aad4bfc48dbb8975c730f04f4d9eea547dd7667f57dc9c38bf3f459ebc58413162aea1fd8f46f03bc07184b551cea463c6ae1e0dc

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6

    Filesize

    27B

    MD5

    a27545f392998c63cd7a609b227e0982

    SHA1

    9b3f6998980ef720b7e0b2a37f74b7b53c912900

    SHA256

    75fb2d51008bfb89071fce80f5f482f5b735f69962c2aea9e81bbfb3e94533ed

    SHA512

    61cff6d28d3d487ed84045352035b67fb208eb64c54e8e1913291ae334459d8132d46ff10694770333181249018ed4613fe037041af1a41894d51f94864dfc5a

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8

    Filesize

    27B

    MD5

    64eebc174a4c3f9838712bb35a024009

    SHA1

    c46caf921d4ee5a745ce1de642f431b7e5e570e3

    SHA256

    75ea5354f03ba50b1c16c1c67af392cde4728359099fe89ba1ec8528060ca64a

    SHA512

    755ec5854d83dad4d5f5015b2a4e1b7676a745a0d6349938dcf002ece41624896e596ffabde76dfddfa13e5673269ab0ab94f92dc0ec8b29000fe26fd6b2dee9

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9

    Filesize

    27B

    MD5

    90cfb4bbe9a86265fe92604bc6b7f2b4

    SHA1

    c6bf1ba6b25e2eafed7ca5e686854eb5d9afd272

    SHA256

    484c5e78ef5a4c62db2934b95fba803604e30348d08d5d48b6c586680383d372

    SHA512

    3087f590cebde20377ad2e16c7a68e7f0877e176277f862bdbb7993ae487f3040e694065ae32091e7725754509f987b294ab03e025feb81dcfa50f7f48a3b3eb

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10

    Filesize

    27B

    MD5

    5ee4c0524e704f3eddfe20017665548a

    SHA1

    7e47a6598717982203f43c711bbe17bfe0afd9cf

    SHA256

    fc723de727934c800713c575a59662c5d7c42602fa0fa93f87fbdb6e9f2bfda9

    SHA512

    481468616e095d031f40dc9b6cdf3628af76112303ff71b1855229b959b4aefe38101399e03f75358dbbfd80686b1f7758c2496ec96cdb74c86261e51c627a33

  • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7

    Filesize

    27B

    MD5

    e4c1428479453c6196d4d54f169db137

    SHA1

    8e35f13f9761fc4ed53d32babfc577f9d2ca6fba

    SHA256

    d3b9c2649ab9d72f3e25a27dae7147e17504fd1eb557d1ebf9ed486084bd2e7d

    SHA512

    da6dfa841cc85ba1dad9a13ed936fd562dac9461bf65876fc85ea8857195dfb5c50ae6de0c20f3a78e6607531597c8a4e7cb2e1db5035daedaef569cbc2e5558

  • C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

    Filesize

    584KB

    MD5

    a5cedc66070251c5f0ef66c4805e5d18

    SHA1

    c99a479f11803eeba62393603ff2014091da6d74

    SHA256

    6b86a2843533c96f63bdfbbf99ed585caf8ac1e65ffd4971667286c4db925db9

    SHA512

    90f3ae2847f7d3836c4d32bf8d7bfd40d15b43880fcc34ca14ad27e7e6326747d92d86f6811334f16853f5c3cd098e6dbb13c8d5602d269e3eea01e545bbde15

  • C:\ProgramData\Microsoft\Assistance\Client\1.0\es-ES\Help_MValidator.Lck.ckey(gqknI454).email([email protected]).pack14

    Filesize

    4B

    MD5

    8c8bfb718f99b04f603bc98e300da2fb

    SHA1

    d3b24dfd1542c1bed5c7508c5e19a66b96d47086

    SHA256

    db0e4f42cd96a4c219344bce625eb63c74ce8efcf3a6b6a8fca7b84ae4322b75

    SHA512

    8413748b98a6e5e2d0851bcc25ac954cbf8f3329b43a2fb0ce9b005ee9b5d9bd03a7cd742b733e4ae995bdfed1afdbc04ddf75b652210d9ee9d75884cfad8263

  • C:\ProgramData\Microsoft\Search\Data\Applications\Windows\Projects\SystemIndex\Indexer\CiFiles\CiAD0001.000

    Filesize

    240B

    MD5

    adce881ff01c85e9c540816504fac7f2

    SHA1

    b59a5f8d3d5ff0c9427367aae809dc43658d4b72

    SHA256

    51d76887d04686d4f02d0a18ac1510931e430994a69f3b8c9cf47ed121dff519

    SHA512

    92c8c8c04592c03b68b7d99cd9f9ad4771c91edb9fb497296ff614429b72ae74a0fa3881c43ed457e95fb6386e5d09494270f30ef01a14ac974666a742b30424

  • C:\ProgramData\Package Cache\{662A0088-6FCD-45DD-9EA7-68674058AED5}v14.30.30704\packages\vcRuntimeMinimum_amd64\vc_runtimeMinimum_x64.msi

    Filesize

    180KB

    MD5

    d0c816ab36e9fe6e1008621d9fdff349

    SHA1

    22420f7238d4a8b9eba20af738dd9a654dee6604

    SHA256

    83957ddd0b1f4ec4a3dab9c0e70b644a970e27ca1e520766c813158516899512

    SHA512

    44babc565c38d2cdb4c9385fe3206fa6a8d848d6e8a6811b1501b619476a3cc3706dbcf70d209cf9b84c7f38a2498f83d2f11c54d737a4ed5f1d7fbbed9d6f66

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_2

    Filesize

    8KB

    MD5

    753fec38333fbebd67a8d56fd9495f04

    SHA1

    ca3d7c7a8ff1d6184bb5059914a97df053053c8d

    SHA256

    1c20b700dace1f5207748f0f5044a430cae5b6256d0a876ff813ea1904cfe155

    SHA512

    386b599b87202490fb23b837ca27992800e51e2fa791a4f9b0dee21a872a9223014bfd5df57ca74f337ed6a1cf38cf02a959bbd15c5e0a05a8b8d1ee68db327f

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Session Storage\CURRENT

    Filesize

    16B

    MD5

    4e24d83615b46e5c93f5bb323e5fe370

    SHA1

    d9a756a5145457340f32aa0378c7c8e8a83a88c2

    SHA256

    3a05e2a03efb184b72dc3ae03bc151a446ea41081f0278f81e41996594f7e6af

    SHA512

    07cb20311091cd33dc135dc90d21c4af38def14669130d504817c644fb643e8c060333abcf64d13f10c82d8692877717d1641e21134d5a6640c1a679169631d0

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_0

    Filesize

    8KB

    MD5

    097747ee886d74c6f4fa25ffa08de8a1

    SHA1

    1b8c9f49ba087f463d6b81d85910888d408327c3

    SHA256

    b5fc42a7ceda3dd41e90e2abc5be911881046a4e5ac3833639b91ceb7b717f82

    SHA512

    b42eb64e8bcd5bf3a5cc6e8e01d01f78adb43f3d15e6bd6643d8af7ebcab228e9fd3a746f3758e80b99e49f695a27709d6f2ac3dda1ef9d948e38479d17fde6c

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_1

    Filesize

    264KB

    MD5

    a5454ec793a5c4cf99892518191ff0c9

    SHA1

    e1fafc2f1c66cced7d5907e36545a0b69954d969

    SHA256

    5f5228d8b8256305ff3f147337e961978a99849e6ff4a51d5363c47b0a86f11b

    SHA512

    7eeb14106505c27b7603559006e73a4b9789628b89cc48c83cb4e2ad5f62b2eceb342af3706fb8a8ada2ca56cf4b035c9a24e6c2c0d48c8a7845f9a26b495f9e

  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\GrShaderCache\data_3

    Filesize

    8KB

    MD5

    d5da90f8a30b1a593937dfbd21eb1b35

    SHA1

    34c786abb8eee3e1a28413eab59addc090145b11

    SHA256

    cc1e6085d1d9361af4a2de510567c8cb4005ad9cbf2dd48799c54d476ff50e37

    SHA512

    c1c9a4e5fe7bc250b6ff3cdd9256dddcde2d7c9bc4f3e2e65101a44489061b8688baed25579cf680d30ec43ddffc1c8b2020cc6fdce812ed70803868e44b0b66

  • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

    Filesize

    28KB

    MD5

    5b0f12e8b2f9d454d785aa0665c99358

    SHA1

    05a2f07b8fa2a0d896d2e26d79d2cea9acf5836d

    SHA256

    7ee1ab0cbba64dde88213b6cdc4b936fc7fd2e2d113cc6cadb2304c707f04adb

    SHA512

    28b1d1d42b0e79c699934ae45c4a86b3f1e536d5802cbab332cd93459eaf53d647b623086910264479dbc922345e20cde6566bc345358235c0b37d30165b626c

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

    Filesize

    512KB

    MD5

    430237d66df03bd011388633f4bc2ae8

    SHA1

    b6af51d44d1d528b64ddfbe144d0ee58d3c66ca7

    SHA256

    42d4cab07309a094f7892bf2583fc65a6a09bce55dfd7f00c74b426a47d1962a

    SHA512

    50fb4bcf0377b9c8465ed097fdd26d791898204ee0b92d444ad69afff6c5db67e88acd9658a0ee75be10245083dfff239da269c7bb0a4db0750b3ff21410369e

  • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bz1ih2a5.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

    Filesize

    48KB

    MD5

    20f442eb6aa5e235b95111246a985f83

    SHA1

    7490665ba8a50abb622c52c9fc6a9168ede49be1

    SHA256

    fdcee29307f712c80ae9f97371fc28f4fffef704f3fc71c4e515424c6a935ee7

    SHA512

    40210f8382edf8202f05ea288822dd689e61128e750a2c72dc03b0aa0e1b1806062124be1ca04191b15c0e098de52f449a4e9f6a283e010cbd6d3e7dca290f8f

  • C:\Users\Admin\Desktop\SplitCompare.xlsx

    Filesize

    11KB

    MD5

    b85f3153a3bbd47f135e926f74eecaed

    SHA1

    6cd0109d33f2360eb8db41b2cd73dcc33ac3dda1

    SHA256

    ef284defcf8cfdb9612cc1fe076e772b0d8bee81b6396903d1f49de64bb5f76c

    SHA512

    76e15dd8d80552a10eba85ce4dfa583bac917d57adcaca6fb8684e8285ca7b652e153801418befd185457371f09308e52958be103fed02440204b75ac3aaadeb

  • memory/2412-5-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

    Filesize

    9.9MB

  • memory/2412-5972-0x0000000000440000-0x000000000044A000-memory.dmp

    Filesize

    40KB

  • memory/2412-3736-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

    Filesize

    4KB

  • memory/2412-5283-0x0000000000440000-0x000000000044A000-memory.dmp

    Filesize

    40KB

  • memory/2412-3766-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

    Filesize

    9.9MB

  • memory/2412-6423-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

    Filesize

    9.9MB

  • memory/2412-0-0x000007FEF56A3000-0x000007FEF56A4000-memory.dmp

    Filesize

    4KB

  • memory/2412-3-0x0000000000440000-0x000000000044A000-memory.dmp

    Filesize

    40KB

  • memory/2412-4-0x0000000000440000-0x000000000044A000-memory.dmp

    Filesize

    40KB

  • memory/2412-2-0x000007FEF56A0000-0x000007FEF608C000-memory.dmp

    Filesize

    9.9MB

  • memory/2412-1-0x0000000000DE0000-0x0000000000E26000-memory.dmp

    Filesize

    280KB