Resubmissions

25/02/2025, 15:09

250225-sjzkmssks8 10

24/02/2025, 19:12

250224-xwgmtazkz5 10

24/02/2025, 18:37

250224-w9jtnaxqw7 10

Analysis

  • max time kernel
    56s
  • max time network
    57s
  • platform
    windows7_x64
  • resource
    win7-20240729-en
  • resource tags

    arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
  • submitted
    24/02/2025, 19:12

General

  • Target

    Mega Spoofer perm and temp.exe

  • Size

    22.4MB

  • MD5

    317c5fe16b5314d1921930e300d9ea39

  • SHA1

    65eb02c735bbbf1faf212662539fbf88a00a271f

  • SHA256

    d850d741582546a3d0ea2ad5d25e0766781f315cd37e6c58f7262df571cd0c40

  • SHA512

    31751379ad7f6c55d87e9a5c1f56e6211d515b7d9ae055af962ed6f9205f5abad302c2e47dd56325abff85327ec3b7f9a6cf76ed34b8cbe1da06549c622c7031

  • SSDEEP

    49152:yIT4lj7Rl9HFoDi+3JK5CS2bV5IRtyrp63FDysl28Wvp/pUOmrscrdXuMIgqJ95+:yI6

Malware Config

Extracted

Family

marsstealer

Botnet

Default

Extracted

Path

C:\Users\Public\Documents\RGNR_01ADC343.txt

Ransom Note
Hello VGCARGO ! ***************************************************************************************************************** If you reading this message, then your network was PENETRATED and all of your files and data has been ENCRYPTED by RAGNAR_LOCKER ! ***************************************************************************************************************** *********What happens with your system ?************ Your network was penetrated, all your files and backups was locked! So from now there is NO ONE CAN HELP YOU to get your files back, EXCEPT US. You can google it, there is no CHANCES to decrypt data without our SECRET KEY. But don't worry ! Your files are NOT DAMAGED or LOST, they are just MODIFIED. You can get it BACK as soon as you PAY. We are looking only for MONEY, so there is no interest for us to steel or delete your information, it's just a BUSINESS $-) HOWEVER you can damage your DATA by yourself if you try to DECRYPT by any other software, without OUR SPECIFIC ENCRYPTION KEY !!! Also, all of your sensitive and private information were gathered and if you decide NOT to pay, we will upload it for public view ! **** ***********How to get back your files ?****** To decrypt all your files and data you have to pay for the encryption KEY : BTC wallet for payment: 1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4 Amount to pay (in Bitcoin): 25 **** ***********How much time you have to pay?********** * You should get in contact with us within 2 days after you noticed the encryption to get a better price. * The price would be increased by 100% (double price) after 14 Days if there is no contact made. * The key would be completely erased in 21 day if there is no contact made or no deal made. Some sensetive information stolen from the file servers would be uploaded in public or to re-seller. **** ***********What if files can't be restored ?****** To prove that we really can decrypt your data, we will decrypt one of your locked files ! Just send it to us and you will get it back FOR FREE. The price for the decryptor is based on the network size, number of employees, annual revenue. Please feel free to contact us for amount of BTC that should be paid. **** ! IF you don't know how to get bitcoins, we will give you advise how to exchange the money. !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! ! HERE IS THE SIMPLE MANUAL HOW TO GET CONTCAT WITH US ! !!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!! 1) Go to the official website of TOX messenger ( https://tox.chat/download.html ) 2) Download and install qTOX on your PC, choose the platform ( Windows, OS X, Linux, etc. ) 3) Open messenger, click "New Profile" and create profile. 4) Click "Add friends" button and search our contact 7D509C5BB14B1B8CB0A3338EEA9707AD31075868CB9515B17C4C0EC6A0CCCA750CA81606900D 5) For identification, send to our support data from ---RAGNAR SECRET--- IMPORTANT ! IF for some reasons you CAN'T CONTACT us in qTOX, here is our reserve mailbox ( [email protected] ) send a message with a data from ---RAGNAR SECRET--- WARNING! -Do not try to decrypt files with any third-party software (it will be damaged permanently) -Do not reinstall your OS, this can lead to complete data loss and files cannot be decrypted. NEVER! -Your SECRET KEY for decryption is on our server, but it will not be stored forever. DO NOT WASTE TIME ! *********************************************************************************** ---RAGNAR SECRET--- QWZjY0QxRTk2MWU4RTIwYkVCRUNhRWMzRjhCQTdlZDJkNUJCN2JkNDdDMzREMTYyNjNGNTdiZGFDYmI3ZEVhNw== ---RAGNAR SECRET--- ***********************************************************************************
Wallets

1BKK8bsFfG3YxTd3N15GxaYfHopoThXoY4

URLs

https://tox.chat/download.html

Extracted

Family

xworm

Version

5.0

C2

outside-sand.gl.at.ply.gg:31300

Mutex

uGoUQjcjqoZsiRJZ

Attributes
  • Install_directory

    %AppData%

  • install_file

    USB.exe

aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain
aes.plain

Extracted

Family

quasar

Version

1.4.1

Botnet

SGVP

C2

192.168.1.9:4782

150.129.206.176:4782

Ai-Sgvp-33452.portmap.host:33452

Mutex

eeeb55fc-ba05-43e4-97f6-732f35b891b4

Attributes
  • encryption_key

    09BBDA8FF0524296F02F8F81158F33C0AA74D487

  • install_name

    User Application Data.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Windowns Client Startup

  • subdirectory

    Quasar

Extracted

Family

quasar

Version

1.4.0

Botnet

Office04

C2

192.168.31.99:4782

2001:4bc9:1f98:a4e::676:4782

255.255.255.0:4782

fe80::cabf:4cff:fe84:9572%17:4782

Mutex

1f65a787-81b8-4955-95e4-b7751e10cd50

Attributes
  • encryption_key

    A0B82A50BBC49EC084E3E53A9E34DF58BD7050B9

  • install_name

    Java Updater.exe

  • log_directory

    Logs

  • reconnect_delay

    3000

  • startup_key

    Java Updater

  • subdirectory

    SubDir

Extracted

Family

asyncrat

Version

Venom RAT + HVNC + Stealer + Grabber v6.0.3

Botnet

Default

C2

3.70.228.168:555

Mutex

bslxturcmlpmyqrv

Attributes
  • delay

    1

  • install

    true

  • install_file

    atat.exe

  • install_folder

    %AppData%

aes.plain

Signatures

  • AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

  • Asyncrat family
  • Detect Xworm Payload 50 IoCs
  • Mars Stealer

    An infostealer written in C++ based on other infostealers.

  • Marsstealer family
  • Quasar RAT

    Quasar is an open source Remote Access Tool.

  • Quasar family
  • Quasar payload 4 IoCs
  • RagnarLocker

    Ransomware first seen at the end of 2019, which has been used in targetted attacks against multiple companies.

  • Ragnarlocker family
  • Xworm

    Xworm is a remote access trojan written in C#.

  • Xworm family
  • Deletes shadow copies 3 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Renames multiple (7781) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Downloads MZ/PE file 4 IoCs
  • Credentials from Password Stores: Windows Credential Manager 1 TTPs

    Suspicious access to Credentials History.

  • Drops startup file 2 IoCs
  • Executes dropped EXE 37 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Enumerates connected drives 3 TTPs 1 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Looks up external IP address via web service 8 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Interacts with shadow copies 3 TTPs 2 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Modifies system certificate store 2 TTPs 3 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Mega Spoofer perm and temp.exe
    "C:\Users\Admin\AppData\Local\Temp\Mega Spoofer perm and temp.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2764
    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe
      "C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe"
      2⤵
      • Downloads MZ/PE file
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Modifies system certificate store
      • Suspicious use of AdjustPrivilegeToken
      PID:2192
      • C:\Users\Admin\AppData\Local\Temp\Files\Transfer2.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\Transfer2.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:2996
      • C:\Users\Admin\AppData\Local\Temp\Files\SGVP%20Client%20program.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\SGVP%20Client%20program.exe"
        3⤵
        • Executes dropped EXE
        PID:5580
      • C:\Users\Admin\AppData\Local\Temp\Files\bwapp.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\bwapp.exe"
        3⤵
        • Executes dropped EXE
        PID:5636
      • C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe"
        3⤵
        • Executes dropped EXE
        PID:4752
        • C:\Windows\system32\schtasks.exe
          "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\Files\spectrum.exe" /rl HIGHEST /f
          4⤵
          • Scheduled Task/Job: Scheduled Task
          PID:564
        • C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe
          "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of SetWindowsHookEx
          PID:5264
          • C:\Windows\system32\schtasks.exe
            "schtasks" /create /tn "Java Updater" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe" /rl HIGHEST /f
            5⤵
            • Scheduled Task/Job: Scheduled Task
            PID:5688
      • C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\jeditor.exe"
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:5880
      • C:\Users\Admin\AppData\Local\Temp\Files\aa.exe
        "C:\Users\Admin\AppData\Local\Temp\Files\aa.exe"
        3⤵
        • Executes dropped EXE
        PID:5984
    • C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe
      "C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:2900
    • C:\Users\Admin\AppData\Local\Temp\asena.exe
      "C:\Users\Admin\AppData\Local\Temp\asena.exe"
      2⤵
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Writes to the Master Boot Record (MBR)
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\System32\Wbem\wmic.exe
        wmic.exe shadowcopy delete
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:2356
      • C:\Windows\system32\vssadmin.exe
        vssadmin delete shadows /all /quiet
        3⤵
        • Interacts with shadow copies
        PID:1616
      • C:\Windows\SysWOW64\notepad.exe
        C:\Users\Public\Documents\RGNR_01ADC343.txt
        3⤵
        • System Location Discovery: System Language Discovery
        • Opens file in notepad (likely ransom note)
        PID:3156
    • C:\Users\Admin\AppData\Local\Temp\Bomb.exe
      "C:\Users\Admin\AppData\Local\Temp\Bomb.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2636
      • C:\Users\Admin\AppData\Local\Temp\25.exe
        "C:\Users\Admin\AppData\Local\Temp\25.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1012
      • C:\Users\Admin\AppData\Local\Temp\24.exe
        "C:\Users\Admin\AppData\Local\Temp\24.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1696
      • C:\Users\Admin\AppData\Local\Temp\23.exe
        "C:\Users\Admin\AppData\Local\Temp\23.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:740
      • C:\Users\Admin\AppData\Local\Temp\22.exe
        "C:\Users\Admin\AppData\Local\Temp\22.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:684
      • C:\Users\Admin\AppData\Local\Temp\21.exe
        "C:\Users\Admin\AppData\Local\Temp\21.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1708
      • C:\Users\Admin\AppData\Local\Temp\20.exe
        "C:\Users\Admin\AppData\Local\Temp\20.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2608
      • C:\Users\Admin\AppData\Local\Temp\19.exe
        "C:\Users\Admin\AppData\Local\Temp\19.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2528
      • C:\Users\Admin\AppData\Local\Temp\18.exe
        "C:\Users\Admin\AppData\Local\Temp\18.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2808
      • C:\Users\Admin\AppData\Local\Temp\17.exe
        "C:\Users\Admin\AppData\Local\Temp\17.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:992
      • C:\Users\Admin\AppData\Local\Temp\16.exe
        "C:\Users\Admin\AppData\Local\Temp\16.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:348
      • C:\Users\Admin\AppData\Local\Temp\15.exe
        "C:\Users\Admin\AppData\Local\Temp\15.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2864
      • C:\Users\Admin\AppData\Local\Temp\14.exe
        "C:\Users\Admin\AppData\Local\Temp\14.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2076
      • C:\Users\Admin\AppData\Local\Temp\13.exe
        "C:\Users\Admin\AppData\Local\Temp\13.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1864
      • C:\Users\Admin\AppData\Local\Temp\12.exe
        "C:\Users\Admin\AppData\Local\Temp\12.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1968
      • C:\Users\Admin\AppData\Local\Temp\11.exe
        "C:\Users\Admin\AppData\Local\Temp\11.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:2508
      • C:\Users\Admin\AppData\Local\Temp\10.exe
        "C:\Users\Admin\AppData\Local\Temp\10.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:232
      • C:\Users\Admin\AppData\Local\Temp\9.exe
        "C:\Users\Admin\AppData\Local\Temp\9.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1208
      • C:\Users\Admin\AppData\Local\Temp\8.exe
        "C:\Users\Admin\AppData\Local\Temp\8.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3008
      • C:\Users\Admin\AppData\Local\Temp\7.exe
        "C:\Users\Admin\AppData\Local\Temp\7.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:220
      • C:\Users\Admin\AppData\Local\Temp\6.exe
        "C:\Users\Admin\AppData\Local\Temp\6.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1516
      • C:\Users\Admin\AppData\Local\Temp\5.exe
        "C:\Users\Admin\AppData\Local\Temp\5.exe"
        3⤵
        • Executes dropped EXE
        PID:2572
      • C:\Users\Admin\AppData\Local\Temp\4.exe
        "C:\Users\Admin\AppData\Local\Temp\4.exe"
        3⤵
        • Executes dropped EXE
        PID:3024
      • C:\Users\Admin\AppData\Local\Temp\3.exe
        "C:\Users\Admin\AppData\Local\Temp\3.exe"
        3⤵
        • Executes dropped EXE
        PID:560
      • C:\Users\Admin\AppData\Local\Temp\2.exe
        "C:\Users\Admin\AppData\Local\Temp\2.exe"
        3⤵
        • Executes dropped EXE
        PID:2060
      • C:\Users\Admin\AppData\Local\Temp\1.exe
        "C:\Users\Admin\AppData\Local\Temp\1.exe"
        3⤵
        • Executes dropped EXE
        PID:2236
    • C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe
      "C:\Users\Admin\AppData\Local\Temp\CryptoWall.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:2544
      • C:\Windows\syswow64\explorer.exe
        "C:\Windows\syswow64\explorer.exe"
        3⤵
        • Drops startup file
        • Adds Run key to start application
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:2252
        • C:\Windows\syswow64\svchost.exe
          -k netsvcs
          4⤵
          • System Location Discovery: System Language Discovery
          PID:1828
        • C:\Windows\syswow64\vssadmin.exe
          vssadmin.exe Delete Shadows /All /Quiet
          4⤵
          • System Location Discovery: System Language Discovery
          • Interacts with shadow copies
          PID:304
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:624
  • C:\Windows\explorer.exe
    "C:\Windows\explorer.exe"
    1⤵
      PID:4728

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\LanguageNames2\DisplayLanguageNames.en_GB_EURO.txt

      Filesize

      27KB

      MD5

      f895d802a4dacbdcffc71efd94c4aaf7

      SHA1

      5375493d69d57bed41752c0e67ced6b011d39496

      SHA256

      b332b4340118fd80dac0ad28538bee1664b57252af8ecc318ea7ef6259a9b92e

      SHA512

      5b48b1ce00253b538766d78d4d3a78c2bec17ca2bb44bf0277de31d9c329decd82ce3e8d69e88197851eae9cc9a2d52f4e516335fb0a1e12bb04bc9c22e45fa3

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_F_COL.HXK

      Filesize

      635B

      MD5

      0d1366643817e3169bc6168a6697a682

      SHA1

      b959acec43223061a3ff7e81f4c716fcef22fc4a

      SHA256

      3c0b4a86923683477421b9466eed9a5a19ea528815363a08de71731a83eff1d7

      SHA512

      1a648019f8348e40e3368c9c9e2c6c91774ef8179effb75db47c49d61bc5b63ff701091017fb039fc18c0a3c5016048e37eb155b9bc356abd7ae36d1f1380c81

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\GRAPH_K_COL.HXK

      Filesize

      634B

      MD5

      472484cf949c5e78431d545324c8912f

      SHA1

      3f2eaca64fb54c7ead9248938cdce4526edf79d5

      SHA256

      5b1eea211f0c9d8d83c62b2dbe51308408f836e9e5901106d665c85f3a4a0d24

      SHA512

      dfba778a056700cc7c098802e362d31251519b80a7e947eab91e106316c9a3ccd72ed2053e18540d6c3f679f05dfaa12c35a9d73b8b849692a000bcc56ade9ea

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_OFF.GIF

      Filesize

      862B

      MD5

      8632c19e9591d9967fd18732e0fc2f25

      SHA1

      53bbcf34da4b1a492389fedfd12a1ebee10e4a0e

      SHA256

      5f6ea5e3873b2153b0bad196d6ec11ea1f29db5fde1d414d02087709746bbef4

      SHA512

      95019aa2c2849094a35a33f2916002e32ee84e506b96930d649b7616e374bb4216b8caf93b50427100fc2168b3ae38ffd9356d9f1a50a57052019d0a81e6615c

    • C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Biscay\TAB_ON.GIF

      Filesize

      743B

      MD5

      fb9053245a57880c35c12821def4ddef

      SHA1

      975d4931d812e9c2f2d640ff87f031a9c51be885

      SHA256

      b0daa4fdad28cc79e493639e4a041a0a107e873aee69b3573d30fd3ba719b9c9

      SHA512

      ecc57cf5aacb1789a66b287f98788a9918ef7c04ada2a2fa21cf255da6d8a22c975167cc623f97577d41ad1fb9dbfd8d9684fe3b34618e9f37f54e6fd05bda91

    • C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\SIST02.XSL

      Filesize

      239KB

      MD5

      0a91d618920ffc688370aeff7b680bb9

      SHA1

      c4738e76d1f8e7b6dd0eab4ecdb9295d1fb95196

      SHA256

      dc825f91b86cdbd573c44805981810765f7708071e26012fea3d1bb8dfa2702c

      SHA512

      b9997531c176aace4ac36d7b58b5f7a88ae48f921b202100ca1b081ea410745dd761f910c48fb31a9269486f5dc4f08b5825f798baaf269b95c0aadebe205e29

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\BG_ADOBE.GIF

      Filesize

      24KB

      MD5

      331c7c03c2a1a86cb8ed2a3389264fdd

      SHA1

      f4e74ce5eb7c093ecdd2e6e6bfc6ac6b724d8f00

      SHA256

      b6f2ac414a7a2e9a87ca0b92b7d868682ecaeed18f50dbe913b8bd06a2466f15

      SHA512

      4aa48b4e5fa4ed4f01009c70c6c6d30a2bcfaf8c13d11c3e6c70272df5fcfd9060fd8bfe75eeb630f4ff496e4c6d6bca97dc92d1c7cfab3df948492a9b2ab767

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\BabyBlue\BUTTON.GIF

      Filesize

      706B

      MD5

      d950f2ceb166deaba4c32066f222ba9a

      SHA1

      f777695df8f208fc57763c1bd884147f000f3777

      SHA256

      bc0aed4fc92c841002e70705f6f2b74ce11616dd9489b68c9139648b30958d4b

      SHA512

      f814ddcf6d99acfc92aef082a595f75c98502e99c4254e252de5b609248f8d11523f469fce307fb08e0386b82027f0343e0bb39d2061ea639fc5836ed0bae64d

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_OFF.GIF

      Filesize

      1017B

      MD5

      9c9b130d63520a3d78c3fd5cc1009cc8

      SHA1

      f7b928431890a2bc2ef85907d034ae0da634ea51

      SHA256

      3aef7d0d7f080bdc468c9bc59f62d0aa6cd3db5fb2e97d062945acd283bcc266

      SHA512

      6b91caf00d51723ee78b51e910448e0ab806ce38af4272c042a86f5a1f0ce7f71cf3916a88481714ccc547e2d36d0bf10731defcfcea46a816d79368dcf026e2

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Desert\TAB_ON.GIF

      Filesize

      1KB

      MD5

      a8db06a4395b28528f950cac706c86b0

      SHA1

      68f871f7eb0260a111b0ab05406249c5c078673b

      SHA256

      751ee55bd0710fcd44bb8b9c10276ea0691ca93072cf5caad6cc8342055cf5ea

      SHA512

      baad1edecc0dbfc55adadcfa3a75e303b5e3129c3144121e6833937d87d1e6723ef25029b1b7336f59248df0b7ec3856b03e372948974e68b1f156b248981947

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif

      Filesize

      6KB

      MD5

      5a1de9969169165330ea8ae1c6e73ac9

      SHA1

      66685134e58357158a72a30c0b0bd38ecd8f15bd

      SHA256

      a6778f267ff03f4f9e3a822518ffc3215f2eb10d110431260c986e6455ce7566

      SHA512

      8408a0e630a7239f3b7e526b7e9cd4a33a689054f979d8ac365159aac7e7c96c63f966c39d60c530340cd334babe6068835f3afb73c0dc703e2abe2e587f0a51

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif

      Filesize

      31KB

      MD5

      941fa4778019a5a053c9b5c47fae1127

      SHA1

      152fd30a87ecbc2bf1299eec42ae8f446866ceec

      SHA256

      195e2ec3aaa9bad8659fe4eebc57789f9cffc2e06e0317b47dcd2f08689d48f5

      SHA512

      f1b4c52192fdbd2d84ac0072d9e5400f2e37f9f8947dc5cfe4a216404014f4be1046485e4ecc4ceb68370ace0e5dd71b25be8608f68771da8060c798f377035b

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif

      Filesize

      5KB

      MD5

      78db4b5902b8682d6323bb5ead4e87ea

      SHA1

      6343a94c91af516cf5cae3fa0815b158ed9b1f17

      SHA256

      2a21cb3eabfc112fc313872305a90ce54f64e737363e046c5e483153ccbd84ac

      SHA512

      64348bf9f7b51dbed6237bde86b78474e1a21ade1e479857102b83901e14533de7c60f2dddc8cc054b26bba75624f14abe865cd8bfafb603afd350c9618dc52b

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif

      Filesize

      22KB

      MD5

      18affbabb206fb53cb9ebe43257df98e

      SHA1

      7f2195371f15c2a2886268b4ad0307e85784fc83

      SHA256

      4c4335a7c3d8c0ee13e6e1bfc2c9ad315f3e6e7f17fac6601d980e4e09768698

      SHA512

      e8ce8c1c4c09be94a3c2e8ef49e2da35344e3a30487080809f4db91104ad510b69ba932706054f0a29082b23636c64c087b845c5bef1c62839fca9ffa84756bf

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif

      Filesize

      627B

      MD5

      695c463d7b7de2b4c18d79ce6dbcee2b

      SHA1

      1b6383ebd9355d0370f68baca50dca0df366df39

      SHA256

      f8d6f168e7e6735f8d9c3bef19d8543545298cab3ff690493ee58612145ba850

      SHA512

      a4386b757fef53ebd29ad239f27357294d1f79d343dbf6ba7afd89af3da6facea77c36e43bb4feb8c505b958cea91bb9fd3786114d08373519310ccc39f0ccf3

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif

      Filesize

      8KB

      MD5

      aa86a0c5f895afaf6026aca2422810ab

      SHA1

      7d69b3423a8acead819c39c79cde20c1827e40e1

      SHA256

      b18f5fc189ed74b9652c87c3691f13c601ed92a27fce83aea9be64875d4db09c

      SHA512

      78af6e416c87b0541c666c1b39e78f8e751d4d6274f515a52868a96248a66529d565f048c96f55a7b9e69acfdbecfd4576a975cf3f5311d4727555bd0163e11f

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif

      Filesize

      15KB

      MD5

      0b51453a793605956127b739078ddf51

      SHA1

      1a9fb2ee9dccfdb18c42e0361bf2d8f9691d116d

      SHA256

      733244dd39136454e67d3db1af9249bce65645720387372ba6a7177cffd0150c

      SHA512

      037cfdcc8e23cb75c13143b131888a13528423b40ed2202b155a510969f0233dab9523c179ad59286008e59ab92ee2d81b2ca76bb570bb18dabed99d2969287c

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif

      Filesize

      6KB

      MD5

      be259d5dda4b4be90e94fd1b329b698b

      SHA1

      d92a33d07ae4231fe5b3ab3bdfa2b6ff22b09d29

      SHA256

      2a3b6ed5b6f78a03dc671a97d892cba7e7b44142a0515c9a9362d75c8521193c

      SHA512

      a7547696aaf293385b6902d6088cc9e19aa6e56475a0403b3c82cfae85885fe86580fee471d93733f3f61ab1fd2ae0c61d7b911b7cc3b8c0e23eccf2601a4e33

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif

      Filesize

      20KB

      MD5

      4095b0f36e4e0b09d748fcfb52acea2e

      SHA1

      defedb410392f5fe4d5f5fe92d208a363eb8fed2

      SHA256

      8ab0d82d0ec4ba8d4d35d84427e62a5d3ad4d883b2ac0903872eec9e5acfe16b

      SHA512

      b8e5da112498645120a73066f8d643ca2dc400cc46e9c1d08fcfdd0017336b40debdf716922f29321c2115cfa16a0289d7f3173b08ab8332670e7140de985c25

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif

      Filesize

      6KB

      MD5

      8e8f5a68ca3efa2e883451b98aa3f1bc

      SHA1

      86ba780bc5a7a1fc05ab15ee1b3fd45a8eef9b85

      SHA256

      a05312b15ed57a7a6dc0ab7b979b235e1ab42bfff385b53d3402cf312481a5f8

      SHA512

      4ddab47bf52646937705ba264f45bc26700130aa786dbd9a6a4d1d45639bd62383529da789a1ab5e2f2077775d5ac3bc9024fdb470456ca518ab93842a4829a7

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif

      Filesize

      15KB

      MD5

      b1942daa617ef2f85ab9a783df030970

      SHA1

      6cd2769955e3089d4c2fce2e77e1c5b30e176ff8

      SHA256

      146ee03548dc443ac8b394b957b1239f7e1c3e201d176fc032cf7ecb9b12a07f

      SHA512

      474028b61e03e846377a433fed833c948e42898a4859b3e09ecda1972aa38f5b697d17fdd3768fbaebd54387db1298d5d4f175ba7194c18a1ea8a734496a40a6

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg

      Filesize

      3KB

      MD5

      e987b8c20309485f1043590cb3e3928f

      SHA1

      f677fcd41eca12162cc12654ebac1b62df3af054

      SHA256

      a0d752a74929b9466d9f26ebc6d3e177ca4d8c35126ea746d38232e9b4cda016

      SHA512

      fdc69e46742336eeac6c774f94ff63886bc325819e68e59bff6e823d6602cae0df16ad5aaaa8cebebf8b798279a2b5bd592a3a3614112f39a723b401f9092cb8

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp

      Filesize

      2KB

      MD5

      386c1fb255ac1a7849d98ba433fce253

      SHA1

      7cf896dd2239277fbef7ee542695497a7db5d07f

      SHA256

      4b160e60d275fced2f4ccea66edcdebf6896426b23d2785ab95753f4b294ca65

      SHA512

      fa3fdb91abb75834351959df61b9aa053fb59b25ac0bb0a8436d1a482fc0a72fe6a11f04a44de10a1062402a56fd21a664334f50fdaca1e6cdcab0fa37a0fd3d

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FORM.ICO

      Filesize

      839B

      MD5

      c6f5b9e33b382841ce8fcab4f5444706

      SHA1

      d6e4bf4df3c876bf7a0531657c210bf448497bf8

      SHA256

      3cc1b8fa207a55a348ba454c00f3ff542e2550c29794dc053c845873e5b33c78

      SHA512

      b49893d51e88adb03edf86dd2b54f85f35f21d34e39c923c3cbfd116019e0d529afe13374cfe8aa7724097e04652fcc8b3e030831f369857ade2ac82c37ce876

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

      Filesize

      7KB

      MD5

      9fe61f0baa02611d757bbca0b096aa14

      SHA1

      b080dc10c00f84cb62271a06ea1acecd14e68a49

      SHA256

      4640b230bf23ba47c4ed57d410ca34537be25fcca815357dbcd220b56fbb9f9a

      SHA512

      82301110a8eba22c0a09129d26a39cebecab424519e3ce70d640977e3690e7f96412bedb2a98f95b250aa8ca33fb17886fe4cfb6b767d3f4d8ce72a47f837dec

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\HEADER.GIF

      Filesize

      776B

      MD5

      5113b06c0a6de7aa5d8f92a0b93abc90

      SHA1

      0585dc8a484b7a13ff81edf91e5a25eb08b0d803

      SHA256

      708949ff84d0916727eb6560675ca1afe863a9315bbd2e7983f1c862465c9279

      SHA512

      94b52a34d12b70bd9a4407b6234f07b83ff6d45e617919533914542f5b009fd734dd283829988677fbe2c66150a1676760530268357abf7bf8706bdbb99dfeed

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif

      Filesize

      844B

      MD5

      9d214003536b2c0972f32590c63d53db

      SHA1

      04600d6841eaac7d868c864e6bd685ee64d56348

      SHA256

      b29a78455da6ae458d67b0ff049e6a133c67eebf6a1abb849d732eafeeb05bdf

      SHA512

      32454f11e3e9585c40c72c86a44433f6acdd60cb7b1f14b2d32c7c8391ffbb58b5350a2c9c7fa138a333b9a935233f21d7d9bdc7a8899f7643c2271ca9f6077e

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightYellow\HEADER.GIF

      Filesize

      888B

      MD5

      2c8d99c2baa56688c20921f52fb010d6

      SHA1

      c0bbb2d8ce22adffd0efeff93bf3b6ed51b712eb

      SHA256

      bf6ca4686c7dbd0549309c4c99d3474e277ac9efcf1e11be3218a6c10cece2cd

      SHA512

      c08ea7d2ea699f58e8cd5a0f3768994b7ddfac78d2c292d1d6fb1233c06f739e11f55e3eeef13fef642abab8d4030a19c69d3d7808a541e1457c27c8c28d59bb

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Desert\HEADER.GIF

      Filesize

      669B

      MD5

      f76eb002a27147b92f2747cdc0d5ae2e

      SHA1

      2a7803e6f07af7ab3c233980205c408c9ef1e00f

      SHA256

      4dbc58ad262709f74a8a23c9e2a3fa8ae0e90f173657686e990082e8384b6a28

      SHA512

      00acea7fe85ef668e2b1a8df276a9b3458f24ec2231b94a65189bc22d83a642e24101b266c2697c77cd62abe70143f4987904ba35981e0ce2a4197fab77ac489

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\GrayCheck\HEADER.GIF

      Filesize

      961B

      MD5

      637de55a91067f0d9ce97b9763b08fd2

      SHA1

      5813aca9b0814b594f1a18b343999a919fc9a913

      SHA256

      fd7ca3c9211a94b2dfe905a5b4f01ebcc589be3326e95d347f3ed216d790a757

      SHA512

      cac631ce03206a650342cdea4e0f73f443fc1c68a5db4ece7851ec63c077a49f010f5d3345f6d35336886ee6c9b582f1c78171ac98abc27e521a35883f512f06

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_OFF.GIF

      Filesize

      983B

      MD5

      b3dea878252c79112bdb55c5d4a30cf8

      SHA1

      9f9dd37b74e19696bb546cd13d8f729c9af13817

      SHA256

      0a76062559dbc4056b0609e5ee13b1cb05faab53f6f4db9fcb85b269f4fd6dec

      SHA512

      a6963e0b628efc9547ff4465a2e5e95e1e8d92747b010c7dd0d9e22db4cd7fe915020277a936a897f160e1794c032b069ad9f0246115bda61e5a188c18671727

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Lime\TAB_ON.GIF

      Filesize

      788B

      MD5

      a6b6290e9ed149add8a8144d870809ca

      SHA1

      0e3d024b67e4d3ad32bce8f7c6af4696f784957d

      SHA256

      942d50ff6ed9319c8a9cbf320592e76f0e1c8c7ef7a06e8607a013eabb8b428c

      SHA512

      d251432bc3b577a9b70c5301b9941ed3a56ca111407dda3a438efaac14367dc99229643550dd724656f85b5ac87721ddf6607f2b9ea4daa487a18fcf91869e43

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Oasis\HEADER.GIF

      Filesize

      2KB

      MD5

      4fa50e4386367b736ebf5d98c8c121d9

      SHA1

      b5b16db021377d57a6738377a484a5352e625e03

      SHA256

      175b68343dfe9f3fb2ba5cfa8371d46fa78a170213384cb7e16d1c7324cf8e19

      SHA512

      9539ec64c229248efbdb33507de7d6a9bc37e3aa0286dc8e590c5e474e7b4a0759f2b3e91d9c4cfb29db0e7b6dbc72e1110353fa1018d0bf2ef9c271489971aa

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\HEADER.GIF

      Filesize

      3KB

      MD5

      ed8de4b3b58e956a52da42bff5e4c4ac

      SHA1

      2f69f3fe65ac6a9c4eda6a5ae991c3513626df3d

      SHA256

      0b25a0eea2b1ae6c6b29853880f7b57df7c2948e61515ec20d5e0b5cc14f23fd

      SHA512

      9fbed602fc0ee1a55e0d47b98dd0e00d8b31c83f59ac8a453bda6fd583774ee02431dbfe7d8d026414d064ba8b187c7b0a239504482dec14fa957a7c67a22e6c

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_OFF.GIF

      Filesize

      983B

      MD5

      d027e72d10a98aedc30ab21271ef55ee

      SHA1

      c24e3d343c1532e85e9b7d49f5f87354941f3807

      SHA256

      80efd781f66db52a70696b0e6046323afca56a08c8bc2d25b24d1736eb6cfb12

      SHA512

      1ac6bf9e76c46e59db222903ce65c3556703c7c84243ed8387a897ca1fe45f8e4c4a25161495ed529d535435a3eed01858c1c0cad5c86e27a7a4b72af451a6bb

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\TAB_ON.GIF

      Filesize

      785B

      MD5

      1a8bf548bf6123a054ccbd7f46211130

      SHA1

      15eb87b3e20d7f5749988d7e7ccd263687dca654

      SHA256

      9a4b1f3f8e8b2d117101fa38b0e061950b66d46bde8c4c89db4a3b73c88bec3e

      SHA512

      3ca1fffc747df2c82cf1e4066df40d19152380cb6bb8091653216da08d8fcfb9e2daacac8374bdf5c37611eddd03d22b612acdefd545b5b7db692092f9b68cea

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif

      Filesize

      754B

      MD5

      3c4365e827c44a235af09f56c35c6188

      SHA1

      a14edf7cdf51743db346bd989071608f8a5e5479

      SHA256

      1f26d89946c94e36282928dcadd6ac9fba7cd98fbaf23d9912e4b30b9dbf3dcb

      SHA512

      8f7df15aa1174fcf6652fd5c77f1e3d6e4458e47712d78d46fd73d31ba14b4ee21217f56ec2cb47e1f57d1592709d860018f8a5103ab7c91e009b6231abdfaf2

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_OFF.GIF

      Filesize

      885B

      MD5

      722fa89644e11bb211e777797dea5bf2

      SHA1

      8e2bf6e33413682d02a9cdf04587997a9e79c7cb

      SHA256

      9fc69dcba867b453d24e5df4ea30de30756ad796d56ebc02636a989a70faa909

      SHA512

      79ccd6c7c524ef814f1702c59a5775c0adaa6a3f0243a525fdf1842e81e19e5b5c7509bed0f81ed5bae657ade777cc70e724d567d8916b65f249b23ce0ff1178

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Slate\TAB_ON.GIF

      Filesize

      885B

      MD5

      29975e257828e1abb07db6e08ee2d011

      SHA1

      753eee83c1b9bbb1a9741b20af9e13cd2df29fee

      SHA256

      6200d16c41c9ec34929572e8f3a76be159d66f20ec5ae132065cb07be6936ea2

      SHA512

      3ca7191e0e0c52bf28b2271beaad1f0687e1d0edd94c7e6fb14d24350ac0cd603af6ffc0aab404e8dfef5c79c28aa7c9e5bfd64626e6369cd66c2ecf2a434597

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif

      Filesize

      7KB

      MD5

      d2ebe18b5034807cf0b78f99faa1dab4

      SHA1

      a22e255b025ad874cfe6afa0c5ed3551c88b2c7c

      SHA256

      05974ebf1e6c9eb9134dbe78fb6616cec912588b386c5984ac006536029a3f5b

      SHA512

      75e71fa1d2a1e6ad7169a9b882c82e511978d124eb0706f7352149cf8b9be2019a3748898dd8b6a75091e862a15b73bc7d6b67a8d7f5be2728fac9da93d9c5d3

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SpringGreen\BUTTON.GIF

      Filesize

      949B

      MD5

      46b65554981fd550a3c527191f723f12

      SHA1

      9bbf75899a1ba9feb14a23cb6b636c0750a0e327

      SHA256

      f5164498726e452e101dedf41f766642447ee0708705ba5469b4cd27ef21acc9

      SHA512

      183e6bd0a59a16d154e467027bc444ab6db78e3150bed73feb6d04805fd492e26ca9b6ad35ff72b21306662b0ba393517c55c6d149bc717d7e5759541c2e83aa

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\HEADER.GIF

      Filesize

      26KB

      MD5

      d784e0927f0c0960fe1bced709a6a399

      SHA1

      6ab77f71658a8c547508988384154960e51a2569

      SHA256

      45e0c6934ab8e504c7bb84a3da5607629bac0e3a86fbc698542f350b494befce

      SHA512

      aaf07bcb7d30635a7a88a4dd7a82b33122b4228e13411894a835a070f22867d49e4e99c6f5ed1ae832882e8cd27da9843d5f1f02f78e73b16f497051653f9dbd

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif

      Filesize

      1KB

      MD5

      86a7a1af737ee51424a3547b38bbe70f

      SHA1

      af3ce057257b532249e2a9b17919c9b2f69d5a13

      SHA256

      5c808a59366d62616ce1e903c5627cc9849e2315b3fa241ea763cfe6553006d4

      SHA512

      65f42614fa3a119338426695652843e1d17425014fdcc7079534d5c1f2569bfbbab0087789b52c5ba01b40a14491fafb3eff0507e1f6efa20ac648acfc7eb78e

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\RTF_BOLD.GIF

      Filesize

      1KB

      MD5

      41b02a0edb1ad74eaf42d18e8afe5819

      SHA1

      f21af493a94d3a11f2c705da20cfe819ed439e33

      SHA256

      071e61230994cdf1f608b34f807d5378cc77ecfb86bc60a03815e89a6bf28c61

      SHA512

      947f026d49e4484737b20f9f8631f98c86cf0ad8afbbbb4188d08658211a47a4e2893400da706e7bccdfccebe25513ae66360bd06047fcfc5cc6cf99bad45266

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\VIEW.ICO

      Filesize

      839B

      MD5

      503e7941c9c9ecb16eb9d30d8ba0e127

      SHA1

      7000fcc3809248b4fa1a8293ebb5965271786afb

      SHA256

      ab992ae7fc59d3e9ba313be0a97a24858db4ed9cf2a17a332fa27de560c134c7

      SHA512

      574a2a0291b03345bd9e196fdd6d6b1253958e424f2affec38cd94863d0c6d83a3caec52ef01d59fff641737c78d3564c1c725a289a46e53dcd07d98597ab9ba

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

      Filesize

      3KB

      MD5

      12d3533d13a07dda5cafa0fa41482604

      SHA1

      0364cd6d0c3d5bc6b6b395e77b67fdd4b6f197d3

      SHA256

      af0426e6699442a6fe45e365af887e1620b736b566184ebfec27b19513df6f6a

      SHA512

      5db17430252a779c5b2663c5dc353ea6f608d3879fcef0bf8af2ed52f70d28b77cfde54745677231c4f938b470d33bf2b85f679fea9e7afbda49ad6cc1d71648

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif

      Filesize

      3KB

      MD5

      d11fb2b047547183f64aff8703ea1fac

      SHA1

      475fd41dd08777ca68caf3c673f7a52bb237f91f

      SHA256

      70ea10808ffa68bcaa1d7bf8b205d5d359ef79bb754bab08dd89cbec63c1ddeb

      SHA512

      111b5743e8215d18466e98eaaf3dd195d163d8c0a72a8c76a4016c169c9f9afcb37aa8995033711d7b63569564dfa062debc7dff76d84e6eb08ea2b70ecb4818

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif

      Filesize

      20KB

      MD5

      32c2f49252baaf532580625f9ce711b0

      SHA1

      7a71c9a4fa8994680fcad80336a5d19adfd28ffa

      SHA256

      53b086ffa333fcce954ea5755f0463f56b12ac205265023370159c78c68dfc36

      SHA512

      0c627ca48fc589fa0eb1860b1127fb13ac99d16a2c0a75735297f1ca073241f7444e0eeac0518ec6fba25069745c178db2b016d8079da05040105eb85264c7da

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif

      Filesize

      1KB

      MD5

      2597606e023c7ef41a584dfa173e13d4

      SHA1

      886acd23d3292eff20cc4ed7a979222fd70b889b

      SHA256

      3229aa2450a6f67126330e272c1b5d95287cec3c700321e198b965d2e6e66c71

      SHA512

      8323102626d40035870a0c55b1847e39cfa9f03cffa0aceaadabd4bb7e083bf47c74a64d635c67fb90e257c97255f7890b2045b85edcd4597bddedb9dc4d3512

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif

      Filesize

      1KB

      MD5

      81355dc31c37ce54414f3636f61603e1

      SHA1

      5f9e69147798e22e47c5a07968d7628259321a2d

      SHA256

      6d7ce96adc960b01e7a443c213cd9f8196066173662ba80d127ca83ef80392dc

      SHA512

      8124a491663277765583eed06571253083080863d702328499a3247d07c483270368653c165e0689d9c69d97ebc9d808f55a39776e3c7cb93ab4f9f1fccaee8d

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif

      Filesize

      1KB

      MD5

      eb0f340fa5ea7adcf7bee49cc5d27273

      SHA1

      eea42fd3e594e0ebc2fce60da6fa1cbe755e30f5

      SHA256

      a5a3dffa9472fd9fc104ae404cb77b1b3904c3f031c35337e4064237c86174a4

      SHA512

      d7945ad76d9d4210c757596a8eacb41f6a20460a9f87d7651c014e6a7e709a7c0dcaf0bcadec961bf9ee13558469c52b4b4a2a1723afcb7a7c26d8e6bd74342c

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ADD.GIF

      Filesize

      1KB

      MD5

      c82e98fb0e3a18559ab8267207c0eb09

      SHA1

      199fac53a4f8ae97be06a32d961f54dc3f13c0be

      SHA256

      b2b6604942d3acbb7e590a35130471c68206830f5489471af2b7b4c65352e9aa

      SHA512

      4845622ac0a8ae2dacc576c0177d8fdda9c343ce2e75f447713f633bd44e4bef5ccc549dcc851547d1217c6cd563f1fbfc5e82722f3e54e816b41b9e3d2c9ed4

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF

      Filesize

      1KB

      MD5

      4e2496ade4940d7041f8e000d303fd26

      SHA1

      75f3a64e345ea605c23eceafaf6c94894abae77a

      SHA256

      6ca44bf6d318ccc6325e704678eeadf102d2f3f34c085aaa547804f2c4192926

      SHA512

      1ed72216fd90a502cde9032b84e25f71ea91274e143cc2dd8a2e9d3904075e59d1aa3a48dcf355bf4ddb730ed18da7773084c180a42e790c404d12557444a65a

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\DELETE.GIF

      Filesize

      1KB

      MD5

      82ab0e4e647369d9d51d2bf5ed523ad8

      SHA1

      f364463e303680763930b6dd85e5c838a3075557

      SHA256

      3b678b7b0e0a9f698ee949d53a8dabddf3f1fe0c1894cda2da0152116c6797a6

      SHA512

      6ab102f3f9d411c05993c96b5a3e62a9ff1e348d17103a5b3bd2b9a62c11edea7e7fb271898857324ac34b519c5eb07556c102339ab7c9ede277f462b9790bc8

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\ERROR.GIF

      Filesize

      1KB

      MD5

      c4b899935860d40606e0bdc086e55ed9

      SHA1

      9abec34847d844c105895edc8e2519d80e2fec3c

      SHA256

      8df1d8b319067bc915c786628b472a0d365281d78fcb99ed05b8d38c04961569

      SHA512

      587b47fc8dfcd4624b4cb517a8d4250dfdbf4a49ba77a2e111e284f0c1a55940875dcd16ccd2e7d02a2cb58ac884602f94b6850c49fa7e301be911ed366cd409

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

      Filesize

      5KB

      MD5

      47a335c00bced145aaafc0620d98a639

      SHA1

      78f84f1887dba3c82dec1128ef89811e832c1fb0

      SHA256

      a9649242512136d099f42569a4edd39ee56d560f5bc92d53f14319dfb83fc761

      SHA512

      ffe84885e446dbc5687d86917d8fec0e94bca715fe3152871d9ae9e5d00cf9a8b1fc95c517fca215324c1b0fe50ee4fe7b5bfa5e89ec7d70cdc359d5d5b05cbf

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp

      Filesize

      2KB

      MD5

      f10f7196e25b38b7f21a0d830685cd5d

      SHA1

      5fa6e679980764ed8600ed06f8a9ee1f52ab1851

      SHA256

      eb0ff203ac0eb2f86ce270bf7d38330b5a0bfffcbc6c7a43578a0506d5174de1

      SHA512

      ede08ab1617d19fa9b01e7f4b093aca763072e3d842266f931baec4aa958acfdf0a6be28c3145c9acab86072587903f25fab0044ca0d1713f86957f12f2fbc26

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\LAUNCH.GIF

      Filesize

      1KB

      MD5

      8389c83ffb555af972f4eaf2f17ff3a2

      SHA1

      93ad7f4cbdbfab29b15137acd32974ed0393452e

      SHA256

      b200ea4414670303f63b1fc88cc33ec1de30628a1dd3fc440ef77ce393c1609c

      SHA512

      51fd5a4b0c7a639b6924e05313695a4a8e5ff7a0ffa31cdbf367c4555a8980217ce84eb8f56e74880777898f3bf9dfe0f5745605e55373c6ad093ef87fca17b1

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif

      Filesize

      1KB

      MD5

      1827b902803f5187cd97738f0fdcaca1

      SHA1

      db9a44fa015c0923c73451e302fdbe55c5d93982

      SHA256

      02de935b2c27cd3b44c4a8c8f9dc21431aead6f351c2dac902f33900b47453d1

      SHA512

      db23903baa188e72530e096a1f61f58ed252f5eb247719feeb0def0c4af86b18239bf9335ebfefaf215298bee645411bc6293aded1999893416f5262f5e03264

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif

      Filesize

      1KB

      MD5

      840c291b14b8809d4b103662a7bc35eb

      SHA1

      feed309f0693f3df36b4ba739b4728920ec69a90

      SHA256

      8502e4931988173481702ee98c5f5ca16894c544f916e077ad884c6f52cd2356

      SHA512

      645d3dbe7f79368beb8b01b11c3dfbbf9cd7d6723ff01955c9dd5ac306148f2f430d9faa5b96c69e58f801d3a7d2a93356203bcec447da611cfb84cc5091a11c

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif

      Filesize

      1KB

      MD5

      3f1b855a3d928b657c69d8fbbf7c01c1

      SHA1

      dec291192e971c60debff096a58616b732d5b76c

      SHA256

      bec017e99ca72e263ff5235d2b31e98a7867342ec896c5aa1749238f2532f946

      SHA512

      4c9a3e0216881f7985bac486e05996b8c6413d347273203f58af3bc0ff9a1d3e0900c128d032540e809060acdd98040e62d7ca4f82fb18aa02096e552fac6c2e

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif

      Filesize

      1KB

      MD5

      25497b9ec28879719cc16645e2a436d5

      SHA1

      f5ef5e49ec008379733644f807023f9c5967ee6f

      SHA256

      1ff0b53b81a8295dac0a75fa8e00b564a90b562f366a8b287ad033f817baed87

      SHA512

      c227979f2daa012fae97d7a768b39cf7c348b809bff7a225d1e1b50c0c578508239872ff633fc29c7bdf8b52e6f691648b8066400ac02ff3961347ff9d579bf6

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif

      Filesize

      1KB

      MD5

      c8d319faa28deed9060ff23048f11a02

      SHA1

      3365015d53a5d9348af5a357a0b8de2a1ee696b4

      SHA256

      10e63aa5b58c4f8722d471d9f475f3a500bb592acf1c465d288514a86d746ee1

      SHA512

      8cebf2ba4b99f1805074458949778be140ca188a301159e0d2634dfecd9c1495b10aa8ddf517584169e5737e0a26737465fd343152ee24e6d77116cd7a3b65e0

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif

      Filesize

      1KB

      MD5

      c8b5a15cdd1dbe1a6c3a76aaa0862af3

      SHA1

      b471c32483f4e9ecb2d68f6579f4e054f43ea8ae

      SHA256

      f6345b9695374234a5f4485eb47bc8481a9080247314603bed4ec9282bfc0b31

      SHA512

      137e2f9c61af3d74745cb76dc0fe84025ed9bb94ef93cc3ee850081a63def82319215bf713609395fb5b7ccd5e3b599d1174d2615df87d79b33ea931c50d2353

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif

      Filesize

      1KB

      MD5

      45220accd7711dabe6ae764db10a2460

      SHA1

      535ffb9f866f0d023a594849bea01629572fb249

      SHA256

      f2fe361fefd042bbd3556c8a811619e942be9647f0a16cdd318737859cdddad1

      SHA512

      9802932c9d7f4f1d8cb5ac4791e9396489944a257ab03d08d7599a3b368ef47a3a44237c0e184eb933fb9444fa64a3c035e129f4f4a12748ac86b879286a210c

    • C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif

      Filesize

      1KB

      MD5

      e78a0fa03e5980d13579be4a2b3b2cd5

      SHA1

      5be62bec52d92204173e8cd54a91f109188f9d0e

      SHA256

      5ed4be12345553bb06411bdcf1a5e5230cd93a124f62b12964bb10e143f999b7

      SHA512

      dd7da5d3ede959c81a47a619bc4160716c1a367f5173b55933b9e195fa305c957b88d7cc4816afbca117a052051212b20809eb64f34ee325b36f027499908a45

    • C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMV12\Microsoft.Office.InfoPath.xml

      Filesize

      247KB

      MD5

      96f1b52fcac78bd02cb972d121ba3eb8

      SHA1

      d1e0c6fb1b198987a3275cb2dbc37d3d731fcecf

      SHA256

      773fdf601ee96de435ce2525a01f8c633f6776d86871f24030d4fbb565df7f68

      SHA512

      aa6d3dbc859e5ffebab1af6bb02ccdc1fabde1508d3477d18671392946f64a163cc6233c1d59156b7bac33120487af194e2166fdbbc501878bcbede95f20baef

    • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\TALK21.COM.XML

      Filesize

      1KB

      MD5

      e1dcb2cf3cc271b9be39d77b4a37198b

      SHA1

      96d1a355655ba89b41e54ee1a7608b1126d5e426

      SHA256

      2fab82586d8b7d93ae373bbb14bb74b85205f397d25af4aa8380259069b9fe32

      SHA512

      b25b48676e6cf96b19035f85f4976920b6c624adf84e689ff0724d64983c5bef1cfb22c0fb7be34f9083fb0950e5d259a024d060fe8c0f9d7a456e1252d89b71

    • C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.COM.XML

      Filesize

      1KB

      MD5

      ccc60293adf79bd7ccbc5e8f71de567a

      SHA1

      75f1b750ede8b6661098121fd6504deb8762bf1e

      SHA256

      29ce78c39f9579c83a290b774c44047ecaa4f8a3c26bec394cc8d952672d6e19

      SHA512

      b116042fc1b5309a569bb4e3668e3a912654ce6cfdd6c782da33cff45fb2ef228a4c88f00c146c415a0683378dbd3e94a8b5bf979aa0806d928ba99d29f27074

    • C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl

      Filesize

      6KB

      MD5

      757c8f80810aac48c2ca90cb66154f0f

      SHA1

      26b51b926ced032b70b14cfbdb7a8d89741ac7a5

      SHA256

      3b0c0bb7cca89eda6143d80b4d3ee758895b2e102ad52b0ac74d553a4d7302ec

      SHA512

      aa22256bf1ce740fd0e77eee11f4685252752539853897d9658cd3cfbbce421732b5a398f0f1abac42c696bcbb7c22f1c9b174b69bee3ecf107f697c81022560

    • C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif

      Filesize

      674B

      MD5

      a419458ee398893aa68df3950ae63603

      SHA1

      e55c9c45589906fd56ac11751959885048329b3f

      SHA256

      6a2533835674817b8d1a27f4ae6a393e92d07f5a09c7af667696936bc6f6a9c2

      SHA512

      caad77223abff37c7a4c71a2eb0d02fb37ceee9f35c6c539c3b21bafc2bdf7604ca9f4ab0c976f3b8a9a06cce0a351c56a4aa3182ebe3cdeffe89974cbcaf4ad

    • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST

      Filesize

      548B

      MD5

      963297070990581441c45d83e9b85f9a

      SHA1

      7b3210cb201c26c2a1a7bc15be7b02cf5d9f9cf4

      SHA256

      f5a4d5990161dca40b0d3296f8c64ff77e8d9c4de0276b04b349f9f007988c0e

      SHA512

      294852c085392525fb4a373812e1b17cd1ceee069620e5170088c03e320580f50980e84e31bef3342c3f1d4085e4e89aeb9e11bfadcdc91017c148c5d8b0dfab

    • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC

      Filesize

      548B

      MD5

      3d5dd0e162fcc67c97cbe958ca00613f

      SHA1

      73e21e4e768bce99ba109ccfd95b3fd1e10852a3

      SHA256

      d6c44cf5930510e57703967958b2b2df317a6fd54277b8498ff7b1dd50430178

      SHA512

      0afa5ba20d02704ed99162a359aa4bebb00fa46291c5b12d6570ca82dc07f9536629d4da8e41c7f3bb849a8a3853e93bb19d3a14bbeadf7ea25c1c141ac89c71

    • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST

      Filesize

      548B

      MD5

      59f8b73555e1eb8e5504887efd40c1f6

      SHA1

      4e4d8f6951fe93de007ba319a5b67fb7a0d6a680

      SHA256

      e8f45b065be287302d1802a493f4444b4fcf73f9d853f26e7647f07a51b9b838

      SHA512

      4a5ad5352ee3659ac6121c1d716be39c60eb5de80d8d42a4188a70ab0e9d2f0bb820d77174e06b9e43227987dbf345f8387d4eb2fd282a2f06e94f0e48b6789e

    • C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MST

      Filesize

      548B

      MD5

      5cc84d026b75ffafbf132bbebe8bedd6

      SHA1

      e6469e66544789c5dc1122db030f5ad4d8966b7c

      SHA256

      4f038018ad8c97602830ee99d5c5d1a322aefe93734db5a49a210b4428f06763

      SHA512

      49f79c4c2eaa3264af6cff88c398ba026f579958713d75549e1b08a232ed7d61b3632e2c4021aaf654a6ccb996c8eca8786249cd8a4d74cb3a6fe5b925ff9d82

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html

      Filesize

      12KB

      MD5

      3f57489cf94223d636104883396b80f9

      SHA1

      5cab55c15d7a5f902cf203f072ef133b7d3d6701

      SHA256

      6032d30dcbabef4ba3d6aa5295a5756c380873fab3dcb4f2642d19ddf4985314

      SHA512

      21026b992ec09b50ae8fa00d5c000b88a096f369b763d585f98dc8de2a5046d9f34bcff1efd5ea3e0a3f793e657b0d8da2644d68c56b5df855cc4dbcdf7ff2ba

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html

      Filesize

      9KB

      MD5

      77a349ab4f042db566b6ffce90d06c0c

      SHA1

      d7a4669d512dc9b27e2a5116648be5965e4e2b4c

      SHA256

      a807f917336c8a47a9b60a7cfc06879da68c207b66ab2c7c0397280ae9e85d0a

      SHA512

      71704b95b78bfe744e3253cba8be317f27a41d0f9c52622677fcd193f602b9ff96a8e1123e9a82b853b1bd15087b59a067237962b5de8dc668349297793aef19

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.feature_3.9.0.v20140827-1444\META-INF\eclipse.inf

      Filesize

      578B

      MD5

      f555cc15c9827bcab87b40453235e1e6

      SHA1

      39ed1f7a7b25a0ba7d11d9e5aed8c82b55d66eb0

      SHA256

      d8daa597131f572312a22f3bc8a8018c392f0e357636eb1eff5d59a16b215e31

      SHA512

      e916e361b9afbe3e0f5aa5bd55f4483293340fea941a449d703cf59b559d6a02d8ce2d522e3aa6db325bb96dfbe8943109e3fdb2361e3e3619b4a05057fc3896

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\asl-v20.txt

      Filesize

      11KB

      MD5

      36866cae0acca1cd7ae36ae319b8749e

      SHA1

      d4349cc9f0f1faba2e6a43773ca611f5197625de

      SHA256

      e7e988088e0191bebb564ad4753a8847151e9c2619cd0ebd4c3190539b28a2c5

      SHA512

      5a8706b338504768c92b7af0843227fe305a7493996386622a160d61dd352aa0a1fbef5ae5dce3d66250163908ddf320909fde9446b030c9fdb7d0a308dc37db

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.RSA

      Filesize

      8KB

      MD5

      185c54acc1ac67034256caf56a2daff9

      SHA1

      27fbe6aff907fc6ff3622fc13fcecd238b79bfca

      SHA256

      2e80aae77411f0957826185197199276d1fd7eb1fc068bbfc8d1a3b36d476f2b

      SHA512

      72f36d9404abc650bbf6ef68b697949b0281575d9ef3a1941d776e4e51b4341426dc69e92358d6266410d7154573e967e5f39e699fea3a1315c94254ed71f2e8

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA

      Filesize

      8KB

      MD5

      4b102b4031c9b8baad5fae114700c42d

      SHA1

      8fffdc16090a78f6101d13134d84c79802f75872

      SHA256

      bd0380964b6fd825284cd73eb569e1ffd0b78f3571cef5e51c4fc7ebddd2b21a

      SHA512

      0746abc5565ce8636e7f8ed0fdc5d0010ab3f6aa1ffb7b4c7b350db6294e6cc9b00eb53723b868583675cbd8348b835a8217d33152e9bfca6236c94220efed74

    • C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\META-INF\MANIFEST.MF

      Filesize

      654B

      MD5

      8a7a77fb2298059ad26900e303f37efa

      SHA1

      aaaf86e6d380159d5812c249e52fe10cfa35cdce

      SHA256

      a05387cdd2b5feb8a7995c792474668c80e57ca565eec3bf02fbef928101ca83

      SHA512

      39d5c82eddb8c7246b645830babb522fb98e911d9899e43aea6051283693211b3d4a1f0650f1d3c11ce0de59db09144bf03095c5e85ec60ee83bc17b153a989d

    • C:\Program Files\Java\jre7\COPYRIGHT

      Filesize

      3KB

      MD5

      338f8a1cc7126036f0ea2b6e328ce290

      SHA1

      fc929afab6222551fb9a19e48aedf4c4429d6223

      SHA256

      278def6c9c086c3bbf4db88a1695bb0bf41dcf832218853c866afe773ca88871

      SHA512

      54a65c71e5236c3794b1dba6008a94af634a429598bce2104fdfd9d0b9d261649133512532e33a54ce7d227a06911dacbeab0a2945906ee5926f8c3c3e103156

    • C:\Program Files\Java\jre7\LICENSE

      Filesize

      562B

      MD5

      f08903c050a1c1e9438567d7a85e9e14

      SHA1

      d09cc2c10ed70c3d47b332e6749ff05a5c992ae5

      SHA256

      47ce82d0c0d2146eafc67b7170a94c0a13301b53eae54d9dc42ab28791b64043

      SHA512

      839f45783a7563e4aeda44ea22a0746fcd84998ba14d551ec23733933f018dce2a5adb8ebeb10fdb17ed1aaf400b946b4a70a62e091720958d46b3982bc481a9

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt

      Filesize

      109KB

      MD5

      ddf183ce3d017c98d362f8275e0887b9

      SHA1

      c2ce3b40850f3b7a8c09c0f05d1723bcf5f05b3d

      SHA256

      a4a2993581889cc365f29a22b4a383e29a2b93e773042513001119e9675808dd

      SHA512

      8dd3ae07dbc13054072cc998912b03c85939fb012a8c84bc1a84d9003e70c5cad73ad329b38c5b4034ba49b9a552256c7b07c8c8c5ac69184d09ae23ce5c3929

    • C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt

      Filesize

      173KB

      MD5

      2aca30971d5eb0f8d74fa2c292996f9c

      SHA1

      79fb89883c02b4949d3b295551c1ba7c6607fea5

      SHA256

      4fddc0dc25f07256ef580579d7012979747e2424d84a5f7b10dbbbf89bc3fe06

      SHA512

      887b19c94ec614408ac5a4516ac2b21e35015dcf4f0b452432700e4ade09df23bec609fec55c473d91ebf80eb1f24631bb73de07e9a9d40216453dc432e831ed

    • C:\Program Files\Java\jre7\lib\deploy\messages_zh_HK.properties

      Filesize

      4KB

      MD5

      c165623742dd6ba5c080c1c3c6f3c4bf

      SHA1

      0cde0ddc635281a8dc730b3511a48b03a1bc7bb8

      SHA256

      7eb122eae5f8693f311bbeb2d8e01c94f5dcea69db0bd8bb850bb3ea950646a3

      SHA512

      c9412a638d7ebc5868de5200cc60dac238e1ce19df7792b7a15df81909690f1308646fcbdc3369e347332703878e971842cfe811a3cfbd87dbab1e2f9c313f3a

    • C:\Program Files\Java\jre7\lib\zi\Atlantic\South_Georgia

      Filesize

      548B

      MD5

      2f2db663710a409eecea53e1dcb5e4f5

      SHA1

      8ab391df84e67b8c691ce775dae2222c06ee74cb

      SHA256

      768f036b1d0599a386eb04149d4aec2704fff7622f6b83f3bb8265c4de7f02da

      SHA512

      95d8bbd7a4967c20e2570f2205e516d6353ceea47d249fa44078923b20462d18eefa2144563709167465a699fbb0f83d73160d885ba88a59fe59cafe9de71392

    • C:\Program Files\Java\jre7\lib\zi\CET

      Filesize

      1KB

      MD5

      35c211b5ae6f87debfdb4ec461aa0e42

      SHA1

      1f313ecc0049c4a3c19b9ff7fbd2a76e4390092c

      SHA256

      b9a82a1da0c9d91265d807bc5507351e6421767e33952fbe2abe23a5137d39d5

      SHA512

      9a44b5c3e1333973f04ce840ec7bfbb20269e93d2cc36d256b9dc6d6a0f36d304214ef9bc8a88102557648faec676180c7dd3b1271194755dcbb1cc111aec735

    • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+4

      Filesize

      548B

      MD5

      ecc243be32e3ed6078a029e70a7ee441

      SHA1

      1df391361b8b95bddccbaf4fc8b2ca124767f0d8

      SHA256

      efb80022fdcf2751354902bbe8c53783d3da47146ed638f7729821951b6fbffd

      SHA512

      3570a0f176032d1faae9b8f3e7aea2a3e7937481c43f72ce78e349284ba932bac1f8d6e04dc93385373b6284980402d48b41d240af4df8a5b92b4cf49d7db898

    • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+6

      Filesize

      548B

      MD5

      31725005063968031be6013be169e5e3

      SHA1

      59c34038b79aec614f862f51ca078e9393e42e24

      SHA256

      f18540f58f5356e3472d3c9823ee06c8a0fc4fd4f1ac742713a7efed70169c51

      SHA512

      7350b377aaab94b99ae8ae80184f6de1629f5009218fc4c4a3d38cff76e7962d5d8c6ac6a3f1e25758cfa23b3f6550fa7b75f190ef5050eac6e2ee642611db1e

    • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+8

      Filesize

      548B

      MD5

      bbd0d492646c9574fa117b176303205a

      SHA1

      c2d5050ceb44f4faf0cad29f131ae623468049c1

      SHA256

      0c14c85a54de6c8c2bc7f7daea0cd13b95ac481318f908734b829f986bdcc81a

      SHA512

      719043f27cfe62c399e0e6b3581595a0d2cfa1eb33fced3ffd7c2af71a9ab8cc8c51dc3648a397c90a0372f93636af1e95570fa7ecfaa32de739b07331eec94f

    • C:\Program Files\Java\jre7\lib\zi\Etc\GMT+9

      Filesize

      548B

      MD5

      56bf98961df987fd93377a4817883f6e

      SHA1

      30a2d5704efbe223926127ce0a868e9b0fd47c03

      SHA256

      097ed4f47918688223a1a1d855309bbf80f79c97f4c1bda04bcfd463080de022

      SHA512

      df19b822772d0ed92e7a2f03f92e0ec4de9b2167f608f96c783e746174ead88851d82997846e7c21ef6179710e870f1a094f5abfaef2c66d44b80f8b2dfd1f93

    • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-10

      Filesize

      548B

      MD5

      39f14a01eb2823dfac02c820b03bcd55

      SHA1

      966f3a882d2112bcd07a4970b38354d0de3b2215

      SHA256

      6a75f2e897c44c434c89daeb8ca5dcf07f75764e9a36f6326ba238f8d630768e

      SHA512

      6d3ceb8ae2edc82ab919d5f38e40f8624929dbbc71de7d6c4a1f8eacb85ad8b138c09984d6026ac459c0c467a72228790f30251c7ab0cb39c875535b7870c9df

    • C:\Program Files\Java\jre7\lib\zi\Etc\GMT-7

      Filesize

      548B

      MD5

      ce97ba0bfe573b4d5cac58783f49320b

      SHA1

      90b5e980ea06764868a3351dd5a194dd7cfc54d8

      SHA256

      8a164b2ec268273874944a966aeb8363e006a33d5f8f0ef08467dcb9abdd5f7b

      SHA512

      8e9b4672676ce7862d1a35f92a69a554d83ad403c86afd6263fd89f06e6e5f00046098f79edcd6a01f56330f09a758c476b28fb48bc1f8112863a67c703e3952

    • C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo

      Filesize

      584KB

      MD5

      197bc3dd46112f6dfad5be576181b7bc

      SHA1

      4dfb2a8fc27e0015d48c976949ecb33c7fa25100

      SHA256

      ab963d0334e6caa55ffe34973a760fc8495ceef1cb5b4a06d2348574c6734f70

      SHA512

      b20fe7d963ee59b7acdaf78d64aca8e48bb63d2d68644e40b33a3b7a0d917ae58378622c894c30a24b3ae7ae3aa79eb02584165f8fa6744dcf20a30641350c8a

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      1KB

      MD5

      a266bb7dcc38a562631361bbf61dd11b

      SHA1

      3b1efd3a66ea28b16697394703a72ca340a05bd5

      SHA256

      df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e

      SHA512

      0da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

      Filesize

      342B

      MD5

      6f5ec98aa1ff2fd5f420b143cd13a8ca

      SHA1

      7bec3f3819d09006981ff06d7bc627f281251cfc

      SHA256

      350c215ea62da8747fc6e0af7096f23e1abd77d02ffde752b58b3b2e3860de36

      SHA512

      89d0c072f8a58ca5052aa80a63f79d99efb9bb8b06951ff240b6927eadb33453bb1216a6abf2cfba5496ab2805f1c9da9180f60f2c4b48e33252daf675e274cc

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357

      Filesize

      242B

      MD5

      0e2cbfe46e6355f5b0ae54c3fb4fb5d7

      SHA1

      ea3292486668bf3b5efd2bba7a43831824b5d4fd

      SHA256

      ce285437d59980b1ec3072927e7d568f56a5b1fe2f10febae5fe43fb581b76a6

      SHA512

      be3428ebbf6856dc877d75568078a31b609b5ca4c54cdd31d01b98ef7554dbd5b6cf3a7a256c1d9f2932b78e1a4618130c6664079dafdd7664d43d4ffbfcb33f

    • C:\Users\Admin\AppData\Local\Microsoft\Feeds\Microsoft Feeds~\Microsoft at Home~.feed-ms

      Filesize

      28KB

      MD5

      a8b108367e9a3f7b8f2f6299f742ed29

      SHA1

      18720e4c8d7765717c49e7ca65ee5b167115b4a2

      SHA256

      033a0672a1b21b9dbfaa27a5b833048c054a5595352b95ebdc77f1a7f4928b73

      SHA512

      3d54f22d14c03c81dc25522f513c777e74ba2a468df81019bbd6e666dd02e2e216c8eda310db495f99bfd0c9d48cee53847232a0be524a9f909c5be2058da47d

    • C:\Users\Admin\AppData\Local\Temp\1.exe

      Filesize

      37KB

      MD5

      8ec649431556fe44554f17d09ad20dd6

      SHA1

      b058fbcd4166a90dc0d0333010cca666883dbfb1

      SHA256

      d1faee8dabc281e66514f9ceb757ba39a6747c83a1cf137f4b284a9b324f3dc4

      SHA512

      78f0d0f87b4e217f12a0d66c4dfa7ad7cf4991d46fdddfaeae47474a10ce15506d79a2145a3432a149386083c067432f42f441c88922731d30cd7ebfe8748460

    • C:\Users\Admin\AppData\Local\Temp\10.exe

      Filesize

      37KB

      MD5

      d6f9ccfaad9a2fb0089b43509b82786b

      SHA1

      3b4539ea537150e088811a22e0e186d06c5a743d

      SHA256

      9af50adf3be17dc18ab4efafcf6c6fb6110336be4ea362a7b56b117e3fb54c73

      SHA512

      8af1d5f67dad016e245bdda43cc53a5b7746372f90750cfcca0d31d634f2b706b632413c815334c0acfded4dd77862d368d4a69fe60c8c332bc54cece7a4c3cd

    • C:\Users\Admin\AppData\Local\Temp\11.exe

      Filesize

      37KB

      MD5

      6c734f672db60259149add7cc51d2ef0

      SHA1

      2e50c8c44b336677812b518c93faab76c572669b

      SHA256

      24945bb9c3dcd8a9b5290e073b70534da9c22d5cd7fda455e5816483a27d9a7d

      SHA512

      1b4f5b4d4549ed37e504e62fbcb788226cfb24db4bfb931bc52c12d2bb8ba24b19c46f2ced297ef7c054344ef50b997357e2156f206e4d5b91fdbf8878649330

    • C:\Users\Admin\AppData\Local\Temp\12.exe

      Filesize

      37KB

      MD5

      7ac9f8d002a8e0d840c376f6df687c65

      SHA1

      a364c6827fe70bb819b8c1332de40bcfa2fa376b

      SHA256

      66123f7c09e970be594abe74073f7708d42a54b1644722a30887b904d823e232

      SHA512

      0dd36611821d8e9ad53deb5ff4ee16944301c3b6bb5474f6f7683086cde46d5041974ec9b1d3fb9a6c82d9940a5b8aec75d51162999e7096154ad519876051fe

    • C:\Users\Admin\AppData\Local\Temp\13.exe

      Filesize

      37KB

      MD5

      c76ee61d62a3e5698ffccb8ff0fda04c

      SHA1

      371b35900d1c9bfaff75bbe782280b251da92d0e

      SHA256

      fbf7d12dd702540cbaeeecf7bddf64158432ef4011bace2a84f5b5112aefe740

      SHA512

      a76fee1eb0d3585fa16d9618b8e76b8e144787448a2b8ff5fbd72a816cbd89b26d64db590a2a475805b14a9484fc00dbc3642d0014954ec7850795dcf2aa1ee7

    • C:\Users\Admin\AppData\Local\Temp\14.exe

      Filesize

      37KB

      MD5

      e6c863379822593726ad5e4ade69862a

      SHA1

      4fe1522c827f8509b0cd7b16b4d8dfb09eee9572

      SHA256

      ae43886fee752fb4a20bb66793cdd40d6f8b26b2bf8f5fbd4371e553ef6d6433

      SHA512

      31d1ae492e78ed3746e907c72296346920f5f19783254a1d2cb8c1e3bff766de0d3db4b7b710ed72991d0f98d9f0271caefc7a90e8ec0fe406107e3415f0107e

    • C:\Users\Admin\AppData\Local\Temp\15.exe

      Filesize

      37KB

      MD5

      c936e231c240fbf47e013423471d0b27

      SHA1

      36fabff4b2b4dfe7e092727e953795416b4cd98f

      SHA256

      629bf48c1295616cbbb7f9f406324e0d4fcd79310f16d487dd4c849e408a4202

      SHA512

      065793554be2c86c03351adc5a1027202b8c6faf8e460f61cc5e87bcd2fe776ee0c086877e75ad677835929711bea182c03e20e872389dfb7d641e17a1f89570

    • C:\Users\Admin\AppData\Local\Temp\16.exe

      Filesize

      37KB

      MD5

      0ab873a131ea28633cb7656fb2d5f964

      SHA1

      e0494f57aa8193b98e514f2bc5e9dc80b9b5eff0

      SHA256

      a83e219dd110898dfe516f44fb51106b0ae0aca9cc19181a950cd2688bbeeed2

      SHA512

      4859758f04fe662d58dc32c9d290b1fa95f66e58aef7e27bc4b6609cc9b511aa688f6922dbf9d609bf9854b619e1645b974e366c75431c3737c3feed60426994

    • C:\Users\Admin\AppData\Local\Temp\17.exe

      Filesize

      37KB

      MD5

      c252459c93b6240bb2b115a652426d80

      SHA1

      d0dffc518bbd20ce56b68513b6eae9b14435ed27

      SHA256

      b31ea30a8d68c68608554a7cb610f4af28f8c48730945e3e352b84eddef39402

      SHA512

      0dcfcddd9f77c7d1314f56db213bd40f47a03f6df1cf9b6f3fb8ac4ff6234ca321d5e7229cf9c7cb6be62e5aa5f3aa3f2f85a1a62267db36c6eab9e154165997

    • C:\Users\Admin\AppData\Local\Temp\18.exe

      Filesize

      37KB

      MD5

      d32bf2f67849ffb91b4c03f1fa06d205

      SHA1

      31af5fdb852089cde1a95a156bb981d359b5cd58

      SHA256

      1123f4aea34d40911ad174f7dda51717511d4fa2ce00d2ca7f7f8e3051c1a968

      SHA512

      1e08549dfcbcfbe2b9c98cd2b18e4ee35682e6323d6334dc2a075abb73083c30229ccd720d240bcda197709f0b90a0109fa60af9f14765da5f457a8c5fce670a

    • C:\Users\Admin\AppData\Local\Temp\19.exe

      Filesize

      37KB

      MD5

      4c1e3672aafbfd61dc7a8129dc8b36b5

      SHA1

      15af5797e541c7e609ddf3aba1aaf33717e61464

      SHA256

      6dac4351c20e77b7a2095ece90416792b7e89578f509b15768c9775cf4fd9e81

      SHA512

      eab1eabca0c270c78b8f80989df8b9503bdff4b6368a74ad247c67f9c2f74fa0376761e40f86d28c99b1175db64c4c0d609bedfd0d60204d71cd411c71de7c20

    • C:\Users\Admin\AppData\Local\Temp\2.exe

      Filesize

      37KB

      MD5

      012a1710767af3ee07f61bfdcd47ca08

      SHA1

      7895a89ccae55a20322c04a0121a9ae612de24f4

      SHA256

      12d159181d496492a057629a49fb90f3d8be194a34872d8d039d53fb44ea4c3c

      SHA512

      e023cac97cba4426609aeaa37191b426ff1d5856638146feab837e59e3343434a2bb8890b538fdf9391e492cbefcf4afde8e29620710d6bd06b8c1ad226b5ec4

    • C:\Users\Admin\AppData\Local\Temp\20.exe

      Filesize

      37KB

      MD5

      f18f47c259d94dcf15f3f53fc1e4473a

      SHA1

      e4602677b694a5dd36c69b2f434bedb2a9e3206c

      SHA256

      34546f0ecf4cd9805c0b023142f309cbb95cfcc080ed27ff43fb6483165218c1

      SHA512

      181a5aa4eed47f21268e73d0f9d544e1ceb9717d3abf79b6086584ba7bdb7387052d7958c25ebe687bfdcd0b6cca9d8cf12630234676394f997b80c745edaa38

    • C:\Users\Admin\AppData\Local\Temp\21.exe

      Filesize

      37KB

      MD5

      a8e9ea9debdbdf5d9cf6a0a0964c727b

      SHA1

      aee004b0b6534e84383e847e4dd44a4ee6843751

      SHA256

      b388a205f12a6301a358449471381761555edf1bf208c91ab02461822190cbcf

      SHA512

      7037ffe416710c69a01ffd93772044cfb354fbf5b8fd7c5f24a3eabb4d9ddb91f4a9c386af4c2be74c7ffdbb0c93a32ff3752b6ab413261833b0ece7b7b1cb55

    • C:\Users\Admin\AppData\Local\Temp\22.exe

      Filesize

      37KB

      MD5

      296bcd1669b77f8e70f9e13299de957e

      SHA1

      8458af00c5e9341ad8c7f2d0e914e8b924981e7e

      SHA256

      6f05cae614ca0e4751b2aaceea95716fd37a6bf3fae81ff1c565313b30b1aba2

      SHA512

      4e58a0f063407aed64c1cb59e4f46c20ff5b9391a02ceff9561456fef1252c1cdd0055417a57d6e946ec7b5821963c1e96eaf1dd750a95ca9136764443df93d7

    • C:\Users\Admin\AppData\Local\Temp\23.exe

      Filesize

      37KB

      MD5

      7e87c49d0b787d073bf9d687b5ec5c6f

      SHA1

      6606359f4d88213f36c35b3ec9a05df2e2e82b4e

      SHA256

      d811283c4e4c76cb1ce3f23528e542cff4747af033318f42b9f2deb23180c4af

      SHA512

      926d676186ec0b58b852ee0b41f171729b908a5be9ce5a791199d6d41f01569bcdc1fddd067f41bddf5cdde72b8291c4b4f65983ba318088a4d2d5d5f5cd53af

    • C:\Users\Admin\AppData\Local\Temp\24.exe

      Filesize

      37KB

      MD5

      042dfd075ab75654c3cf54fb2d422641

      SHA1

      d7f6ac6dc57e0ec7193beb74639fe92d8cd1ecb9

      SHA256

      b91fb228051f1720427709ff849048bfd01388d98335e4766cd1c4808edc5136

      SHA512

      fada24d6b3992f39119fe8e51b8da1f6a6ca42148a0c21e61255643e976fde52076093403ccbc4c7cd2f62ccb3cdedd9860f2ac253bb5082fb9fe8f31d88200d

    • C:\Users\Admin\AppData\Local\Temp\25.exe

      Filesize

      37KB

      MD5

      476d959b461d1098259293cfa99406df

      SHA1

      ad5091a232b53057968f059d18b7cfe22ce24aab

      SHA256

      47f2a0b4b54b053563ba60d206f1e5bd839ab60737f535c9b5c01d64af119f90

      SHA512

      9c5284895072d032114429482ccc9b62b073447de35de2d391f6acad53e3d133810b940efb1ed17d8bd54d24fce0af6446be850c86766406e996019fcc3a4e6e

    • C:\Users\Admin\AppData\Local\Temp\3.exe

      Filesize

      37KB

      MD5

      a83dde1e2ace236b202a306d9270c156

      SHA1

      a57fb5ce8d2fe6bf7bbb134c3fb7541920f6624f

      SHA256

      20ab2e99b18b5c2aedc92d5fd2df3857ee6a1f643df04203ac6a6ded7073d5e8

      SHA512

      f733fdad3459d290ef39a3b907083c51b71060367b778485d265123ab9ce00e3170d2246a4a2f0360434d26376292803ccd44b0a5d61c45f2efaa28d5d0994df

    • C:\Users\Admin\AppData\Local\Temp\4.exe

      Filesize

      37KB

      MD5

      c24de797dd930dea6b66cfc9e9bb10ce

      SHA1

      37c8c251e2551fd52d9f24b44386cfa0db49185a

      SHA256

      db99f9a2d6b25dd83e0d00d657eb326f11cc8055266e4e91c3aec119eaf8af01

      SHA512

      0e29b6ce2bdc14bf8fb6f8324ff3e39b143ce0f3fa05d65231b4c07e241814fb335ede061b525fe25486329d335adc06f71b804dbf4bf43e17db0b7cd620a7c6

    • C:\Users\Admin\AppData\Local\Temp\4363463463464363463463463.exe

      Filesize

      10KB

      MD5

      2a94f3960c58c6e70826495f76d00b85

      SHA1

      e2a1a5641295f5ebf01a37ac1c170ac0814bb71a

      SHA256

      2fcad226b17131da4274e1b9f8f31359bdd325c9568665f08fd1f6c5d06a23ce

      SHA512

      fbf55b55fcfb12eb8c029562956229208b9e8e2591859d6336c28a590c92a4d0f7033a77c46ef6ebe07ddfca353aba1e84b51907cd774beab148ee901c92d62f

    • C:\Users\Admin\AppData\Local\Temp\5.exe

      Filesize

      37KB

      MD5

      84c958e242afd53e8c9dae148a969563

      SHA1

      e876df73f435cdfc4015905bed7699c1a1b1a38d

      SHA256

      079d320d3c32227ba4b9acddf60bfcdf660374cb7e55dba5ccf7beeaedd2cdef

      SHA512

      9e6cb07909d0d77ebb5b52164b1fa40ede30f820c9773ea3a1e62fb92513d05356dfef0e7ef49bf2ad177d3141720dc1c5edceb616cef77baec9acdd4bbc5bae

    • C:\Users\Admin\AppData\Local\Temp\6.exe

      Filesize

      37KB

      MD5

      27422233e558f5f11ee07103ed9b72e3

      SHA1

      feb7232d1b317b925e6f74748dd67574bc74cd4d

      SHA256

      1fa6a4dc1e7d64c574cb54ae8fd71102f8c6c41f2bd9a93739d13ff6b77d41ac

      SHA512

      2d3f424a24e720f83533ace28270b59a254f08d4193df485d1b7d3b9e6ae53db39ef43d5fc7de599355469ad934d8bcb30f68d1aaa376df11b9e3dec848a5589

    • C:\Users\Admin\AppData\Local\Temp\7.exe

      Filesize

      37KB

      MD5

      c84f50869b8ee58ca3f1e3b531c4415d

      SHA1

      d04c660864bc2556c4a59778736b140c193a6ab2

      SHA256

      fa54653d9b43eb40539044faf2bdcac010fed82b223351f6dfe7b061287b07d3

      SHA512

      bb8c98e2dadb884912ea53e97a2ea32ac212e5271f571d7aa0da601368feabee87e1be17d1a1b7738c56167f01b1788f3636aac1f7436c5b135fa9d31b229e94

    • C:\Users\Admin\AppData\Local\Temp\8.exe

      Filesize

      37KB

      MD5

      7cfe29b01fae3c9eadab91bcd2dc9868

      SHA1

      d83496267dc0f29ce33422ef1bf3040f5fc7f957

      SHA256

      2c3bfb9cc6c71387ba5c4c03e04af7f64bf568bdbe4331e9f094b73b06bddcff

      SHA512

      f6111d6f8b609c1fc3b066075641dace8c34efb011176b5c79a6470cc6941a9727df4ceb2b96d1309f841432fa745348fc2fdaf587422eebd484d278efe3aeac

    • C:\Users\Admin\AppData\Local\Temp\9.exe

      Filesize

      37KB

      MD5

      28c50ddf0d8457605d55a27d81938636

      SHA1

      59c4081e8408a25726c5b2e659ff9d2333dcc693

      SHA256

      ebda356629ac21d9a8e704edc86c815770423ae9181ebbf8ca621c8ae341cbd5

      SHA512

      4153a095aa626b5531c21e33e2c4c14556892035a4a524a9b96354443e2909dcb41683646e6c1f70f1981ceb5e77f17f6e312436c687912784fcb960f9b050fe

    • C:\Users\Admin\AppData\Local\Temp\Bomb.exe

      Filesize

      457KB

      MD5

      31f03a8fe7561da18d5a93fc3eb83b7d

      SHA1

      31b31af35e6eed00e98252e953e623324bd64dde

      SHA256

      2027197f05dac506b971b3bd2708996292e6ffad661affe9a0138f52368cc84d

      SHA512

      3ea7c13a0aa67c302943c6527856004f8d871fe146150096bc60855314f23eae6f507f8c941fd7e8c039980810929d4930fcf9c597857d195f8c93e3cc94c41d

    • C:\Users\Admin\AppData\Local\Temp\Cab80E.tmp

      Filesize

      70KB

      MD5

      49aebf8cbd62d92ac215b2923fb1b9f5

      SHA1

      1723be06719828dda65ad804298d0431f6aff976

      SHA256

      b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

      SHA512

      bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    • C:\Users\Admin\AppData\Local\Temp\Files\Transfer2.exe

      Filesize

      72KB

      MD5

      7e2a7b9cebec31d9c96cfccc8c88798e

      SHA1

      f8054effc92e70f909d25503c4fd7c42a90d3556

      SHA256

      6e376efd9e5577127cb963b2ca8db82b30d6baa3ba974373504d0afadb754646

      SHA512

      22ed51fdc307928ac66d689fc5f3562c1ef4b29d9cd63d6160f64b68fcae0c8c79aeb7d027b899717539321b2310640831bd0f2223e1a8b53d7c8be7bb6e15b1

    • C:\Users\Admin\AppData\Local\Temp\Files\bwapp.exe

      Filesize

      2.3MB

      MD5

      17ba78456e2957567beab62867246567

      SHA1

      214fed374f370b9cf63df553345a5e881fd9fc02

      SHA256

      898db742c0c5503bc396a53b67b8a86da0722d51907c4be2beb364c2d578023a

      SHA512

      2165ba2aa0a0214f06bc31402bc2ea170d11032efc7ee56070b6abb0feb322b082ffd5dc5b2ad9841295ea85bd25826ba55fb00ed924fdb5ffd0f9f14d671eba

    • C:\Users\Admin\AppData\Local\Temp\Tar821.tmp

      Filesize

      181KB

      MD5

      4ea6026cf93ec6338144661bf1202cd1

      SHA1

      a1dec9044f750ad887935a01430bf49322fbdcb7

      SHA256

      8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

      SHA512

      6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

    • C:\Users\Admin\AppData\Local\Temp\a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5.exe

      Filesize

      159KB

      MD5

      6f8e78dd0f22b61244bb69827e0dbdc3

      SHA1

      1884d9fd265659b6bd66d980ca8b776b40365b87

      SHA256

      a76e49df84ba2a7b33e8ea959995b5e6faecb90d551ef169d8272ce9042c35a5

      SHA512

      5611a83616380f55e7b42bb0eef35d65bd43ca5f96bf77f343fc9700e7dfaa7dcf4f6ecbb2349ac9df6ab77edd1051b9b0f7a532859422302549f5b81004632d

    • C:\Users\Admin\AppData\Local\Temp\asena.exe

      Filesize

      39KB

      MD5

      7529e3c83618f5e3a4cc6dbf3a8534a6

      SHA1

      0f944504eebfca5466b6113853b0d83e38cf885a

      SHA256

      ec35c76ad2c8192f09c02eca1f263b406163470ca8438d054db7adcf5bfc0597

      SHA512

      7eef97937cc1e3afd3fca0618328a5b6ecb72123a199739f6b1b972dd90e01e07492eb26352ee00421d026c63af48973c014bdd76d95ea841eb2fefd613631cc

    • C:\Users\Admin\AppData\Roaming\SubDir\Java Updater.exe

      Filesize

      502KB

      MD5

      1441905fc4082ee6055ea39f5875a6c5

      SHA1

      78f91f9f9ffe47e5f47e9844bd026d150146744e

      SHA256

      1b05c4d74e0d17a983f9b91aa706a7a60f37ec270b7e2433d6798afa1c7be766

      SHA512

      70e9ab0e49b4bf89505f16c499538daebc1e8da72488cd63ff60747d15a1d486ba38802b0622c9240d10ff68ab32e6bb36a0b809e7cd0e2ec4945d023ce86c5c

    • C:\Users\Admin\Documents\InitializeFormat.xlsx

      Filesize

      10KB

      MD5

      06c3712c3b11093abb4615020bfc9a44

      SHA1

      4a5e33c23a488c7402728a59cfc1dbc964c2c364

      SHA256

      056eca0871c32557391886e6ba8e26873b0b76433a2f4a166943713d48c767d9

      SHA512

      96d3d80dcad0b551f173ec014ea8598335181962a5bdbbb0fe9076c02009d089d29c984a1dafb5948d172dac19b16d14849c3fab9c9a9b29260ca57265507bf9

    • C:\Users\Public\Documents\RGNR_01ADC343.txt

      Filesize

      3KB

      MD5

      0880547340d1b849a7d4faaf04b6f905

      SHA1

      37fa5848977fd39df901be01c75b8f8320b46322

      SHA256

      84449f1e874b763619271a57bfb43bd06e9c728c6c6f51317c56e9e94e619b25

      SHA512

      9048a3d5ab7472c1daa1efe4a35d559fc069051a5eb4b8439c2ef25318b4de6a6c648a7db595e7ae76f215614333e3f06184eb18b2904aace0c723f8b9c35a91

    • C:\vcredist2010_x86.log.html

      Filesize

      82KB

      MD5

      3b61e4b875b11b348c2bf4f312629d77

      SHA1

      c1214fa52c2edced6729f97024fc7c8f2402e562

      SHA256

      b5376b81b6c1d2a79d9b624e9addd2fa64160b092eaad90e858061595e1601ea

      SHA512

      90ab1b3983a4e84ed14cf57c4a1d998bccd20ac1d3ff346c174b0ea714e3bf14ef57e40b5fd2ebd3fffd60508ea3f1717375a428025b49af419634ed34ab3917

    • \Users\Admin\AppData\Local\Temp\CryptoWall.exe

      Filesize

      132KB

      MD5

      919034c8efb9678f96b47a20fa6199f2

      SHA1

      747070c74d0400cffeb28fbea17b64297f14cfbd

      SHA256

      e036d68b8f8b7afc6c8b6252876e1e290f11a26d4ad18ac6f310662845b2c734

      SHA512

      745a81c50bbfd62234edb9788c83a22e0588c5d25c00881901923a02d7096c71ef5f0cd5b73f92ad974e5174de064b0c5ea8044509039aab14b2aed83735a7c4

    • memory/220-1493-0x0000000000BF0000-0x0000000000C00000-memory.dmp

      Filesize

      64KB

    • memory/232-1345-0x0000000001360000-0x0000000001370000-memory.dmp

      Filesize

      64KB

    • memory/348-1187-0x00000000013E0000-0x00000000013F0000-memory.dmp

      Filesize

      64KB

    • memory/560-1550-0x00000000010C0000-0x00000000010D0000-memory.dmp

      Filesize

      64KB

    • memory/684-1051-0x00000000003B0000-0x00000000003C0000-memory.dmp

      Filesize

      64KB

    • memory/740-1009-0x0000000000DE0000-0x0000000000DF0000-memory.dmp

      Filesize

      64KB

    • memory/992-1175-0x00000000002F0000-0x0000000000300000-memory.dmp

      Filesize

      64KB

    • memory/1012-973-0x0000000001280000-0x0000000001290000-memory.dmp

      Filesize

      64KB

    • memory/1208-1391-0x0000000000EE0000-0x0000000000EF0000-memory.dmp

      Filesize

      64KB

    • memory/1516-1499-0x00000000001F0000-0x0000000000200000-memory.dmp

      Filesize

      64KB

    • memory/1696-1008-0x00000000001A0000-0x00000000001B0000-memory.dmp

      Filesize

      64KB

    • memory/1708-1052-0x00000000003D0000-0x00000000003E0000-memory.dmp

      Filesize

      64KB

    • memory/1828-52-0x00000000000C0000-0x00000000000E5000-memory.dmp

      Filesize

      148KB

    • memory/1864-1287-0x00000000012B0000-0x00000000012C0000-memory.dmp

      Filesize

      64KB

    • memory/1968-1307-0x00000000013E0000-0x00000000013F0000-memory.dmp

      Filesize

      64KB

    • memory/2060-1554-0x0000000001180000-0x0000000001190000-memory.dmp

      Filesize

      64KB

    • memory/2076-1188-0x0000000000A80000-0x0000000000A90000-memory.dmp

      Filesize

      64KB

    • memory/2192-46-0x00000000001E0000-0x00000000001E8000-memory.dmp

      Filesize

      32KB

    • memory/2236-1557-0x0000000000120000-0x0000000000130000-memory.dmp

      Filesize

      64KB

    • memory/2252-6584-0x0000000000080000-0x00000000000A5000-memory.dmp

      Filesize

      148KB

    • memory/2252-45-0x0000000000080000-0x00000000000A5000-memory.dmp

      Filesize

      148KB

    • memory/2508-1334-0x0000000001050000-0x0000000001060000-memory.dmp

      Filesize

      64KB

    • memory/2528-1104-0x0000000001330000-0x0000000001340000-memory.dmp

      Filesize

      64KB

    • memory/2572-1500-0x00000000009B0000-0x00000000009C0000-memory.dmp

      Filesize

      64KB

    • memory/2608-1105-0x0000000000810000-0x0000000000820000-memory.dmp

      Filesize

      64KB

    • memory/2636-49-0x00000000011F0000-0x0000000001268000-memory.dmp

      Filesize

      480KB

    • memory/2764-6719-0x0000000074080000-0x000000007462B000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-2-0x0000000074080000-0x000000007462B000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-1-0x0000000074080000-0x000000007462B000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-0-0x0000000074081000-0x0000000074082000-memory.dmp

      Filesize

      4KB

    • memory/2764-4551-0x0000000074080000-0x000000007462B000-memory.dmp

      Filesize

      5.7MB

    • memory/2764-21-0x0000000002010000-0x000000000204D000-memory.dmp

      Filesize

      244KB

    • memory/2764-13-0x0000000002010000-0x000000000204D000-memory.dmp

      Filesize

      244KB

    • memory/2808-1176-0x0000000000250000-0x0000000000260000-memory.dmp

      Filesize

      64KB

    • memory/2864-1186-0x0000000000BB0000-0x0000000000BC0000-memory.dmp

      Filesize

      64KB

    • memory/2900-23-0x0000000000400000-0x000000000043D000-memory.dmp

      Filesize

      244KB

    • memory/3008-1396-0x0000000000360000-0x0000000000370000-memory.dmp

      Filesize

      64KB

    • memory/3024-1534-0x0000000000840000-0x0000000000850000-memory.dmp

      Filesize

      64KB

    • memory/4752-19884-0x0000000000140000-0x00000000001C4000-memory.dmp

      Filesize

      528KB

    • memory/5264-19887-0x00000000011A0000-0x0000000001224000-memory.dmp

      Filesize

      528KB

    • memory/5580-19875-0x00000000001E0000-0x0000000000504000-memory.dmp

      Filesize

      3.1MB

    • memory/5984-19895-0x00000000011A0000-0x00000000011B8000-memory.dmp

      Filesize

      96KB