e0f3a73cc2ebb6ccab7a039d15f375816f6a08d7dc4e4729eda4a4deadcfe0b5

Analysis

max time kernel
130s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
16/07/2024, 10:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GrandCrabV5.0.1.exe
Size 2.7MB
Sample240716-mvb1ts1fre
SHA256 b4902aa2802656f873111b272c03ad93ca2dd53c0c612b9d310c982f4afa497b
MD5 49c158ee65b32cb7f4ca6a769c90bfc0
SHA1 f047d2888c29ee711a9ca627d09f0ddce343c54a
SHA512 be908bdcd1ae14bd9270a7a4733992a4da440a1326860453f525da2472335b6095094905a89eb833dd2254060cdbf33ce42700c41d8e9075f182f2e8d6fd1001
SSDEEP 49152:N3HyN3QjIm2ANy2NiNQFgFb89Va15682uwgL0KviZiHAtLFTmo9h2A:lHrjIhmiN2V9EvzoKviZFJh2
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery persistence ransomware spyware stealer

Malware Config

Signatures

Renames multiple (3347) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Event Triggered Execution: Image File Execution Options Injection 1 TTPs 7 IoCs

persistence

Image File Execution Options Injection

T1546.012

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Image File Execution Options	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\excelcnv.exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv .exe	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\wordconv .exe\DisableExceptionChainValidation = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Winword.exe	msiexec.exe

Manipulates Digital Signatures 1 TTPs 26 IoCs

Attackers can apply techniques such as changing the registry keys of authenticode & Cryptography to obtain their binary as valid.

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustFinalPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCleanup"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadMessage"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubInitialize"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllCreateIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigCreateIndirectData"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllVerifyIndirectData\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigVerifyIndirectData"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Initialization\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\FinalPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "MsoWintrustTestPolicy"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllPutSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigPutSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\Dll = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllRemoveSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigRemoveSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Cleanup\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubLoadSignature"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\DiagnosticPolicy\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "mso.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\OID\EncodingType 0\CryptSIPDllGetSignedDataMsg\{AB13F5B1-F718-11D0-82AA-00AA00C065E1}\FuncName = "MsoVBADigSigGetSignedDataMsg"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Certificate\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "WintrustCertificateTrust"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\CertCheck\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$Function = "SoftpubCheckCert"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Message\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Cryptography\Providers\Trust\Signature\{1A6631C0-3EA2-11D1-AE01-006097C6A9AA}\$DLL = "WINTRUST.DLL"	MsiExec.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\trol.vbs	GrandCrabV5.0.1.exe

Executes dropped EXE 1 IoCs

pid	Process
2848	WINWORD.EXE

Loads dropped DLL 64 IoCs

pid	Process
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
444	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe
1340	msiexec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
1316	MsiExec.exe
2000	msohtmed.exe
2000	msohtmed.exe
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
1204	Process not Found
2000	msohtmed.exe
2000	msohtmed.exe
444	MsiExec.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\BCSSync = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSSync.exe\" /DelayServices"	msiexec.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Documents\\lol.jpg"	GrandCrabV5.0.1.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\Microsoft Games\Mahjong\MahjongMCE.png	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\timer_up.png	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse_1.1.200.v20140414-0825.jar	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\VeriSignLogo.jpg	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\Microsoft.Build.Engine.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\system_settings.png	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\video_output\libcaca_plugin.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Data.Entity.Resources.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\form_responses.gif	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked-loading.png	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382948.JPG	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\excelcnvpxy.dll	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-charts_zh_CN.jar	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Defender\ja-JP\MpAsDesc.dll.mui	GrandCrabV5.0.1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\fr-FR\gadget.xml	GrandCrabV5.0.1.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.preferences_3.5.200.v20140224-1527.jar	GrandCrabV5.0.1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\it\System.Windows.Presentation.resources.dll	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\alt-rt.jar	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jre7\lib\rt.jar	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Media Player\Network Sharing\wmpnss_color120.png	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_blue_snow.png	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Opulent.xml	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\PresentationFramework.Royale.dll	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01239K.JPG	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Mail\en-US\WinMail.exe.mui	GrandCrabV5.0.1.exe
File created	C:\Program Files\Common Files\System\Ole DB\de-DE\msdasqlr.dll.mui	GrandCrabV5.0.1.exe
File created	C:\Program Files\Common Files\System\Ole DB\en-US\msdasqlr.dll.mui	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Mozilla Firefox\api-ms-win-core-localization-l1-2-0.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\pause_down.png	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\stream_out\libstream_out_stats_plugin.dll	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsBlankPage.html	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\de\System.Data.Services.Client.resources.dll	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt.nl_ja_4.4.0.v20140623020002.jar	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\es-ES\settings.html	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341448.JPG	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\fr\WindowsFormsIntegration.resources.dll	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\misc\libaddonsfsstorage_plugin.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.InfoPath.FormControl.dll	msiexec.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jre7\bin\installer.dll	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\7-Zip\Lang\tr.txt	GrandCrabV5.0.1.exe
File created	C:\Program Files\Common Files\Microsoft Shared\ink\Microsoft.Ink.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files\DVD Maker\it-IT\OmdProject.dll.mui	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_VelvetRose.gif	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\msmgdsrv.dll	msiexec.exe
File created	C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_VideoInset.png	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\Microsoft Games\FreeCell\it-IT\FreeCell.exe.mui	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Calendar.Gadget\es-ES\gadget.xml	GrandCrabV5.0.1.exe
File created	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WindowsBase.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Defender\es-ES\MpAsDesc.dll.mui	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_cloudy.png	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_black_moon-new_partly-cloudy.png	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Mail\fr-FR\WinMail.exe.mui	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Sidebar\Gadgets\RSSFeeds.Gadget\images\item_hover_flyout.png	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\XML Files\Messenger.xml	GrandCrabV5.0.1.exe
File created	C:\Program Files (x86)\Windows Media Player\es-ES\wmpnssci.dll.mui	GrandCrabV5.0.1.exe
File created	C:\Program Files\DVD Maker\es-ES\WMM2CLIP.dll.mui	GrandCrabV5.0.1.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	GrandCrabV5.0.1.exe
File created	C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Star_Empty.png	GrandCrabV5.0.1.exe

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSI20EA.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2965.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\oisicon.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI3162.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Installer\f781f66.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D93.tmp	msiexec.exe
File created	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\inficon.exe	msiexec.exe
File created	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\joticon.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI2A53.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI655F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI29A5.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\msouc.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngenservicelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI1FE0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI218A.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log	ngen.exe
File opened for modification	C:\Windows\Installer\MSI654E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A23.tmp	msiexec.exe
File created	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenservicelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI3063.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI4DC9.tmp	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe
File created	C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngenrootstorelock.dat	ngen.exe
File opened for modification	C:\Windows\Installer\MSI6106.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI249B.tmp	msiexec.exe
File created	C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\wordicon.exe	msiexec.exe
File created	C:\Windows\Microsoft.NET\ngenserviceclientlock.dat	ngen.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
1276	ipconfig.exe

Modifies Internet Explorer settings 1 TTPs 54 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	msohtmed.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\HotIcon = "C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll,103"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}\AppPath = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	msohtmed.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	msohtmed.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\MenuText = "Se&nd to OneNote"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}\Policy = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}\AppName = "IEContentService.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{000209FF-0000-0000-C000-000000000046}\AppPath = "C:\\Program Files (x86)\\Microsoft Office\\Office14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ButtonText = "OneNote Lin&ked Notes"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{000209FF-0000-0000-C000-000000000046}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\HotIcon = "C:\\PROGRA~2\\MICROS~1\\Office14\\ONBTTN~1.DLL,103"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\Default Visible = "Yes"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	msohtmed.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\Icon = "C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll,103"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{5FBAF6E6-C64B-49DB-AB1B-F93C607EBC71}\AppName = "onenote.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\Default Visible = "Yes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}\Compatibility Flags = "1024"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	msohtmed.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	msohtmed.exe
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ButtonText = "Send to OneNote"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\ActiveX Compatibility\{EFEF7FDB-0CED-4FB6-B3BB-3C50D39F4120}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\Icon = "C:\\PROGRA~2\\MICROS~1\\Office14\\ONBTTN~1.DLL,103"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}\AppPath = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	msohtmed.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{000209FF-0000-0000-C000-000000000046}\Policy = "3"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ClsidExtension = "{FFFDC614-B694-4AE6-AB38-5D6374584B52}"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{DD993BDC-06E0-4131-B889-DD3B9AEBE253}\Policy = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	msohtmed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\MenuText = "OneNote Lin&ked Notes"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	msohtmed.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\CLSID = "{1FBA04EE-3024-11d2-8F1F-0000F87ABD16}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{789FE86F-6FC4-46A1-9849-EDE0DB0C95CA}\ToolTip = "OneNote Linked Notes"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ToolTip = "Send to OneNote"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Extensions\{2670000A-7350-4f3c-8081-5663EE0C6C49}\ClsidExtension = "{48E73304-E1D6-4330-914C-F5F514E3486C}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{000209FF-0000-0000-C000-000000000046}\AppName = "winword.exe"	msiexec.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2F	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3A7CAEBB-C5C3-4EFF-ADDF-C32663BDF8DA}\ProgID\ = "OneNote.PowerPointAddinTakeNotesService.14"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{314111BC-A502-11D2-BBCA-00C04F8EC294}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{314111c7-a502-11d2-bbca-00c04f8ec294}\InprocServer32\ = "C:\\Program Files (x86)\\Common Files\\Microsoft Shared\\Help\\hxds.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{3050F285-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F280-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{603CA966-E676-4c06-9C53-E7E6AA0D58C6}\ProxyStubClsid32\ = "{76FD94BA-8FF3-40b4-9C56-D7421DBFD10D}"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Word.Application.8\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\InprocHandler32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{867CD778-80D7-4f93-989E-B3E76A92FB42}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61E40D31-993D-4777-8FA0-19CA59B6D0BB}\MiscStatus\1\ = "131473"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{8A624388-AA27-43e0-89F8-2A12BFF7BCCD}	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Application\CurVer	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{03D935D9-B9E0-4356-925C-6AD11EAE4E14}\ProxyStubClsid32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C46675CB-205C-11DC-9894-00123F2C1792}\NumMethods\ = "5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\OneNote.PowerPointAddinTakeNotesButton\CurVer\ = "OneNote.PowerPointAddinTakeNotesButton.14"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{0006F024-0000-0000-C000-000000000046}\Implemented Categories\{7DD95802-9882-11CF-9FA9-00AA006C42C4}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	msohtmed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8A624388-AA27-43E0-89F8-2A12BFF7BCCD}\VersionIndependentProgID\ = "Word.TemplateMacroEnabled"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{7A5DB9FA-6640-40A1-9303-D4B1EBCDAEEE}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ContactPicker.ContactPicker\CurVer\ = "ContactPicker.ContactPicker.2"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61E40D31-993D-4777-8FA0-19CA59B6D0BB}\ProgID\ = "ContactPicker.ContactPicker.2"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F4754C9B-64F5-4B40-8AF4-679732AC0607}\LocalServer32\LocalServer32 = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\.hxc\OpenWithProgids\Shared	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3050F26A-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32\RuntimeVersion = "v1.0.3705"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\DataFormats\GetSet\1\ = "1,1,1,3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{314111A9-A502-11D2-BBCA-00C04F8EC294}\ProxyStubClsid\ = "{00020424-0000-0000-C000-000000000046}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.12\shell\ViewProtected\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f00760070002000220025003100220000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{C46675AA-205C-11DC-9894-00123F2C1792}\ProxyStubClsid32	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{4A6472CB-0744-4760-9931-34E01D33DA47}\ = "ILobiError"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\BCSRuntime.AsyncFreeThreadedCallback\CLSID	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1E2AD43D-FE32-4B7F-B3C3-C0B3E3C2249D}\NumMethods\ = "5"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{912ABC52-36E2-4714-8E62-A8B73CA5E390}\TypeLib\ = "{00020905-0000-0000-C000-000000000046}"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{00020907-0000-0000-C000-000000000046}\LocalServer32\LocalServer32 = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.TemplateMacroEnabled.12\shell\ViewProtected\command	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.TemplateMacroEnabled.12\shell\New\ = "&New"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Classes\Word.Document\CurVer = "Word.Document.12"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{314111E3-A502-11D2-BBCA-00C04F8EC294}\TypeLib\ = "{31411197-A502-11D2-BBCA-00C04F8EC294}"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C46675C6-205C-11DC-9894-00123F2C1792}\InprocServer32\ThreadingModel = "Both"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{C46675AE-205C-11DC-9894-00123F2C1792}	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{926C910D-CB01-464d-82E8-901B5C7D41BE}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.TemplateMacroEnabled.12\shell\ViewProtected\Extended	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.OpenDocumentText.12\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /i \"%1\""	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Wizard.8\ = "Microsoft Word Wizard"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{3050F272-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\TypeLib\{CBA4EBC4-0C04-468d-9F69-EF3FEED03236}\1.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{3050F281-98B5-11CF-BB82-00AA00BDCE0B}\InprocServer32	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{10154F28-4979-4166-B114-3E7A7926C747}\OLEDB_SERVICES\ = "4294967295"	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\DataFormats\DefaultFile	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1B261B22-AC6A-4E68-A870-AB5080E8687B}\LocalServer32\ = "C:\\PROGRA~2\\MICROS~1\\Office14\\WINWORD.EXE"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.DocumentMacroEnabled.12\shell\Open\ = "&Open"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.RTF.8\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{40994F76-6EBB-3856-835F-1B6242FE4417}	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{A2F75CF5-3929-4E76-BE6D-5279C5BD241C}\1.0\FLAGS\ = "0"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{314111f0-a502-11d2-bbca-00c04f8ec294}\ProgID	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{C46675A1-205C-11DC-9894-00123F2C1792}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{37C4B8C0-B1ED-4d8f-A69D-AC992BF5EDFE}\ProxyStubClsid32	msiexec.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\Interface\{31411202-A502-11D2-BBCA-00C04F8EC294}\ProxyStubClsid	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Assemblies\C:\|Program Files (x86)\|Microsoft Visual Studio 8\|Common7\|IDE\|PublicAssemblies\|Microsoft.VisualStudio.Tools.Applications.DesignTime.dll	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5754901B-3769-4053-B11A-983DEBF936C8}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSRuntime.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FFFDC614-B694-4AE6-AB38-5D6374584B52}\ProgID\ = "OneNote.IEAddin.LinkedNotes.14"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31411225-A502-11D2-BBCA-00C04F8EC294}\ = "IHxCancel"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Word.Document.12	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{61C57D61-7E2F-4528-8588-67F3C69A97C4}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\BCSRuntime.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{84F66100-FF7C-4fb4-B0C0-02CD7FB668FE}\DisableLowILProcessIsolation = "1"	msiexec.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery

T1018

pid	Process
1952	PING.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2848	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1340	msiexec.exe
1340	msiexec.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeSecurityPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe
Token: SeTakeOwnershipPrivilege	1340	msiexec.exe
Token: SeRestorePrivilege	1340	msiexec.exe

Suspicious use of SetWindowsHookEx 10 IoCs

pid	Process
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE
2848	WINWORD.EXE

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2568 wrote to memory of 1252	2568	GrandCrabV5.0.1.exe	32
PID 2568 wrote to memory of 1252	2568	GrandCrabV5.0.1.exe	32
PID 2568 wrote to memory of 1252	2568	GrandCrabV5.0.1.exe	32
PID 1252 wrote to memory of 1276	1252	cmd.exe	34
PID 1252 wrote to memory of 1276	1252	cmd.exe	34
PID 1252 wrote to memory of 1276	1252	cmd.exe	34
PID 2568 wrote to memory of 576	2568	GrandCrabV5.0.1.exe	35
PID 2568 wrote to memory of 576	2568	GrandCrabV5.0.1.exe	35
PID 2568 wrote to memory of 576	2568	GrandCrabV5.0.1.exe	35
PID 576 wrote to memory of 1952	576	cmd.exe	37
PID 576 wrote to memory of 1952	576	cmd.exe	37
PID 576 wrote to memory of 1952	576	cmd.exe	37
PID 1340 wrote to memory of 444	1340	msiexec.exe	39
PID 1340 wrote to memory of 444	1340	msiexec.exe	39
PID 1340 wrote to memory of 444	1340	msiexec.exe	39
PID 1340 wrote to memory of 444	1340	msiexec.exe	39
PID 1340 wrote to memory of 444	1340	msiexec.exe	39
PID 1340 wrote to memory of 444	1340	msiexec.exe	39
PID 1340 wrote to memory of 444	1340	msiexec.exe	39
PID 1340 wrote to memory of 1316	1340	msiexec.exe	40
PID 1340 wrote to memory of 1316	1340	msiexec.exe	40
PID 1340 wrote to memory of 1316	1340	msiexec.exe	40
PID 1340 wrote to memory of 1316	1340	msiexec.exe	40
PID 1340 wrote to memory of 1316	1340	msiexec.exe	40
PID 1340 wrote to memory of 1316	1340	msiexec.exe	40
PID 1340 wrote to memory of 1316	1340	msiexec.exe	40
PID 1340 wrote to memory of 2000	1340	msiexec.exe	41
PID 1340 wrote to memory of 2000	1340	msiexec.exe	41
PID 1340 wrote to memory of 2000	1340	msiexec.exe	41
PID 1340 wrote to memory of 2000	1340	msiexec.exe	41
PID 1316 wrote to memory of 2344	1316	MsiExec.exe	42
PID 1316 wrote to memory of 2344	1316	MsiExec.exe	42
PID 1316 wrote to memory of 2344	1316	MsiExec.exe	42
PID 1316 wrote to memory of 2344	1316	MsiExec.exe	42
PID 1316 wrote to memory of 1664	1316	MsiExec.exe	44
PID 1316 wrote to memory of 1664	1316	MsiExec.exe	44
PID 1316 wrote to memory of 1664	1316	MsiExec.exe	44
PID 1316 wrote to memory of 1664	1316	MsiExec.exe	44
PID 1316 wrote to memory of 1160	1316	MsiExec.exe	46
PID 1316 wrote to memory of 1160	1316	MsiExec.exe	46
PID 1316 wrote to memory of 1160	1316	MsiExec.exe	46
PID 1316 wrote to memory of 1160	1316	MsiExec.exe	46
PID 1316 wrote to memory of 2272	1316	MsiExec.exe	48
PID 1316 wrote to memory of 2272	1316	MsiExec.exe	48
PID 1316 wrote to memory of 2272	1316	MsiExec.exe	48
PID 1316 wrote to memory of 2272	1316	MsiExec.exe	48
PID 1316 wrote to memory of 2184	1316	MsiExec.exe	50
PID 1316 wrote to memory of 2184	1316	MsiExec.exe	50
PID 1316 wrote to memory of 2184	1316	MsiExec.exe	50
PID 1316 wrote to memory of 2184	1316	MsiExec.exe	50
PID 1316 wrote to memory of 892	1316	MsiExec.exe	52
PID 1316 wrote to memory of 892	1316	MsiExec.exe	52
PID 1316 wrote to memory of 892	1316	MsiExec.exe	52
PID 1316 wrote to memory of 892	1316	MsiExec.exe	52
PID 1316 wrote to memory of 1608	1316	MsiExec.exe	55
PID 1316 wrote to memory of 1608	1316	MsiExec.exe	55
PID 1316 wrote to memory of 1608	1316	MsiExec.exe	55
PID 1316 wrote to memory of 1608	1316	MsiExec.exe	55
PID 1316 wrote to memory of 2180	1316	MsiExec.exe	57
PID 1316 wrote to memory of 2180	1316	MsiExec.exe	57
PID 1316 wrote to memory of 2180	1316	MsiExec.exe	57
PID 1316 wrote to memory of 2180	1316	MsiExec.exe	57
PID 1316 wrote to memory of 1936	1316	MsiExec.exe	59
PID 1316 wrote to memory of 1936	1316	MsiExec.exe	59

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\GrandCrabV5.0.1.exe
"C:\Users\Admin\AppData\Local\Temp\GrandCrabV5.0.1.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2568
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\Documents\net.bat" "
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1252
- - C:\Windows\system32\ipconfig.exe
    ipconfig /release
    3⤵
    - Gathers network information
    PID:1276
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 5000 > Nul & Del C:\Users\Admin\AppData\Local\Temp\GrandCrabV5.0.1.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:576
- - C:\Windows\system32\PING.EXE
    ping 1.1.1.1 -n 1 -w 5000
    3⤵
    - Runs ping.exe
    PID:1952

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Event Triggered Execution: Image File Execution Options Injection
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding DC4251C0CE24DF81D08CE9A434C253B6
  2⤵
  - Loads dropped DLL
  PID:444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding F317F5563C6E54A586E881B62AA1CFDF M Global\MSI0000
  2⤵
  - Manipulates Digital Signatures
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1316
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2344
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Applications.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1664
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1160
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2272
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2184
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Applications.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:892
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1608
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.VisualStudio.Tools.Applications.Runtime.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2180
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1936
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2832
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2736
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Applications.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2928
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2640
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2040
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1932
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:684
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2916
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\Contracts\Microsoft.VisualStudio.Tools.Office.Contract.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2804
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2148
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1988
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:236
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.AddInAdapter.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:576
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1036
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\AddInViews\Microsoft.Office.Tools.v9.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1544
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Excel.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2428
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2088
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Outlook.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2156
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:2256
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.Word.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:1560
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    PID:2380
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe install "C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\HostSideAdapters\Microsoft.VisualStudio.Tools.Office.HostAdapter.v10.0.dll" /queue:3 /NoDependencies
    3⤵
    - Drops file in Windows directory
    PID:1028
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    PID:968
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe update /queue
    3⤵
    - Drops file in Windows directory
    PID:1540
- - C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -PipelineRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\Pipeline.v10.0\." -Rebuild
    3⤵
    PID:1248
- - C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe
    "C:\Windows\Microsoft.NET\Framework\v3.5\addinutil.exe" -AddInRoot:"C:\Program Files (x86)\Common Files\Microsoft Shared\VSTA\AppInfoDocument\." -Rebuild
    3⤵
    PID:2012
- C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe
  "C:\Program Files (x86)\Microsoft Office\Office14\msohtmed.exe" /regserverfp
  2⤵
  - Loads dropped DLL
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2000

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\YOU_MUST_READ_ME.rtf"
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2848
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:1932

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Image File Execution Options Injection

T1546.012

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

f781f67.rbs

Path C:\Config.Msi\f781f67.rbs
Size 2.4MB
SHA256 95fc1808cad98b336c4aef6c25c0b0dd04963c06e7ea25104c469bfaed94ce4a
MD5 572dd79dfc0fb03ca8c5f215052b17b5
SHA1 13f3d422d3c0cbf3915615bd5dd946329521f5d2
SHA512 1c148c3b3f8f85a935f5139d976ed85bd6a3f0418009414fb15af812a1887979d6d94c4dce7b64f879b5b21272f4a39a6a1163971bd859853057c41241cf5086
SSDEEP 24576:K4QYus734QYus7O4QYus7O4QYus7JlKjgCzvayRynu5uDY+5Y6oe:+S7NS7yS7yS7MU4e
MD5 SHA1 SHA512 SSDEEP

Submit Download

f781f77.rbs

Path C:\Config.Msi\f781f77.rbs
Size 583KB
SHA256 3fe640177e08a89c153adaf35ba68efbd6dc28071199280a143e75c860359a15
MD5 54e248f316f27a92d311879f5ded3251
SHA1 e2087dd1665affc8697378f0d4b05b63c2716d00
SHA512 08d8c56d0768354857518ecf87dea19f112b467f891d981c5047292d31cdb2bd9f5ffbe7c89cca50850d9f56f9c1f2cb351aaf3a00e3ef654da6529075856435
SSDEEP 12288:tMMiRBxQgZemOeeMMiRBxQgZemOegMMiRBxQgZemOeRMMiRBxQgZemOew:tMMiRBHeNeeMMiRBHeNegMMiRBHeNeR7
MD5 SHA1 SHA512 SSDEEP

Submit Download

tab_off.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_off.gif
Size 352B
SHA256 40162de932eeefe28d00123446fceef1ada01b51a11ada7b81899d49c6b9b498
MD5 1319ec2f9add91bc303f76ff2003f9ca
SHA1 39c5f367876c9b55d9cce0beee00a0f09b14b624
SHA512 88cf25ef60a3dac4201dc93b10c110f4e32c997370afaa1677e2ff85388492b72d578e43d866584250fe1605acabc7fca2d278cd225e5106eb60308a9be41f3a
MD5 SHA1 SHA512

Submit Download

tab_on.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Swirl\tab_on.gif
Size 224B
SHA256 1954161c5fe141cdc3304b7ce353297bf549586666824474f6c341af7fc929ab
MD5 2cfe098d6f064f3af74188a653111e7c
SHA1 667836b8116ba45a29d2e87d97ec05366beda364
SHA512 8ba10c14198337b8ac8f9711a77dbf9f9bebf68bfb2891db10ea87c9ac5c47a3485c2145fdc8e1420b5938f00bb7130843b8c6d6a0c11bc34a37aef8724d4f2b
MD5 SHA1 SHA512

Submit Download

bg_Casual.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Casual.gif
Size 5KB
SHA256 c7560522d752b50425de4cb7d8a537a96333f5141ed82eb80cb9d503b696e33c
MD5 95bd453f849aa28289996961881c82b6
SHA1 2f2b33f7fbc8226d9f486a08b7688cff2bae4921
SHA512 31d3e75f38d9547f2cd5c90b64e2c13387a5f877975368e7c59c59c6b4f9d4b194560a85ba5c9738e39ea834bb20f93a4b3adbd0bb7de464831441553a66856b
SSDEEP 96:+CZGWRt3mqOAEUzMWZ5BkV6O18cPqbZbL/Z7ZoK3tLGQdGZBCzK0dZoKo8j21T:+CH341UzMIgV2cw1/Z7N3tjsZIz1dZFw
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Country.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Country.gif
Size 31KB
SHA256 d24e341abcbad6234fcea0a8921396e6d1d472a3da7d24049359c41ef48719f1
MD5 b078f7847441b4a50808dc0de42f5bea
SHA1 181c8c710ec021786abd98d217ad1b6fe1149d60
SHA512 99111136d0fc9b01aa03359c265e64de92ff92f5e3052df4e6de64b54e68b8eca869648b12668d84e5419b5bf00e7628d145086793cd78b2c25ba3daf3e1d1bb
SSDEEP 768:waFYJEJ3f2nxisRtr9VNx9T8FHCXBK35IPzZHv29HkY:wKf3enxi6p8FCXg35INH2EY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Earthy.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Earthy.gif
Size 4KB
SHA256 c589f676f76991a8754310590c73df02a5dfff48c7eaa3899eaca184ca0cdea9
MD5 63381039009fb70d21a77838e9260917
SHA1 1664492fff2cecc3cfb604add189aefc7efb6184
SHA512 d5f061f0afacd0042b30b3a80eb47837e59ea0511b280e155c3b5b63a50b4db24af7f939efd213880b21eeb8d8f84a419e04552d258823c619e39474e5fa9f45
SSDEEP 96:JeqoxBZS1iPD57GcODCycH4sUioM2nIYIa0GxhmHyeIOBnLp5vd68jq3xbaMQE:to7ZUixGJmyciZPALGxjTOBnLp5vdNjc
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_GreenTea.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_GreenTea.gif
Size 21KB
SHA256 1e9bb6534f974ab65d9d75954c60e0de566ba3b087d433b3022b60fed5d2dbe6
MD5 eda84fc0d76372b60e3680fa4a8a2d93
SHA1 9775e504a907697eca2f6a336d119584d17f2819
SHA512 a69328972d352ad0df8aa0b35331dceab1e1cc750626514e2daeddfa98d48a8f66d40a1ecd880f565486207e101d3db3b6054adae3ec4e5d00c50d3b7f5f7c00
SSDEEP 384:lAVqhjmrwbgze78vviMU0tMmMX+T6l6DbnCdrPoGQlMy:FmcbgHvvSuT6l6DboPoGiMy
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Groove.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Groove.gif
Size 112B
SHA256 8ac5a26ee455143831fad6c3d4c7841292ecc82fdf11a8c06b4b9db931659039
MD5 5f15d68878b980b7f6176620548ba0bc
SHA1 2e3d50182ec474986d4451a3f9914b94fba77200
SHA512 cd7ca65b99038e0b8e6bc0ec5f25feda70361057b3621d98f1383ac609788f2a14c573bfc13306a6ca2eaa9e18c7f92afe80449028d83ad988ecf4fa08fd92c9
MD5 SHA1 SHA512

Submit Download

bg_LightSpirit.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_LightSpirit.gif
Size 8KB
SHA256 25226937e6540ead5f18e4edf62643f967d6b660f7ed0435470b5b2680f4f7ea
MD5 2c8a419964a1bcab8755d0da963240c1
SHA1 f5f608fd049d1c5a463c80044e8030acabc522f8
SHA512 47d9e6c02d9ba5f1e4f3c120050a528ed5b560f637ab307cb20789c894557303a8a421188c1eb4e3043014f482c643959cbda4f5ca5d51ddd4da5db32b4ab8d2
SSDEEP 192:V0vl1POQXmGuyBOMGsO3zhdCMWjFe3jt9Kbgf0t2ZjzvHtfdwrqC65b:V0v+GuyEMGHzvFu43R9KbgFZnHtf6GCI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_OliveGreen.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_OliveGreen.gif
Size 15KB
SHA256 d7927b47b73058b7ccb1126a8ec050a507e2e1be79f792efc342bcd1ba1263c9
MD5 306dd814066f9cb94ad0d4b0504b45f5
SHA1 de81a99776dd22903151b82007a429216b528597
SHA512 f2d85ff5bcbda492111b95cf5259997f4197ff30826d2e0df33afe48235cbbade346781af4ae68d5bdaa65ef02bfbba8084387b2f9a2f5a225fb5109d0fd109d
SSDEEP 384:UEJ+og7VMwYsLreaCOgtH5QN982VRmnzDk/k:ZJHg7VN/rjCOgB5Qv82V6Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_Premium.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_Premium.gif
Size 6KB
SHA256 e539baea87d155d5acf41470a81784b1c0be4d917868cf3fcc3171618fd2be7c
MD5 47acbc24c6b6935d0bb0314cd0647d40
SHA1 b754334a9abfead5db43a7aa5fa46ad8f053aedb
SHA512 e8eba46fa21632b79f48b4cc7d132ad498419f029ccfa0fa8f880ddc6a549133850134e2f2dee82b13cb16689ec7584adfcde2a13a129647da9bf31ee71c333d
SSDEEP 192:Sxa1xVClHgpSY7vwY0Q5IPKN7WDj+GM49syMaYTLB9vizwO6Gj:SY1xslsvBV5wKNgC94hTcXWj
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_SlateBlue.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_SlateBlue.gif
Size 20KB
SHA256 56edd0afbfb451cbf15d8d09dfcb7891c1200582b5ff7a197a0f23a6f7210fe0
MD5 6742ce6c96866139b1337e48dbbaa942
SHA1 0f5b7c8bb66d9105c918af37bd3b2f98f933555c
SHA512 aae40ceed1a658e19ec6f0eaa7bb300c1ce44e98054450b5a7d7325558604c9cac8dfbfd6ce9924635a4a480ec5692902c3831797b94e3f74eba734cf1f458db
SSDEEP 384:5R1YYlIy8lMLeK5c7W1vc6rQ8Rdw3tCb1boub2OW+XHLf1Vwc:veYIlMKKT1lrdw9Cb1cuyOvXHpL
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_TexturedBlue.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_TexturedBlue.gif
Size 6KB
SHA256 2d1bfb3d83386a34ddf194b60698591d5e394926e4014b6715d1f2824a4dd454
MD5 57697e574138bb024fa6b70bca4d8254
SHA1 957bae3f2b9f47eafb044a5ab2bdcfb5f6bd5485
SHA512 adff120bacd5f80820bdf945b1dd9e91824436d5eb23ea8cc91128262aa5040d72876a898aedcfc5de7900bd6a9c7fce8a90bd909e30c5c59a8fbecf56e866a3
SSDEEP 96:he2+XkIZgoPS32h0NNdWpoYj/B2a0tseLg8PywtHI1vV6/MbEYisVx1Mv:X+UkLqnD6jZ2nrk8Py5vVCMb8sVf0
MD5 SHA1 SHA512 SSDEEP

Submit Download

bg_VelvetRose.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\bg_VelvetRose.gif
Size 15KB
SHA256 3ecae5e877a70b7ecf1a2d6680b1ab63e797495493f7228f8d094ecdfdef8182
MD5 f622736c90d8086bad9eb7c6c5d7e1e1
SHA1 1612eccca715091051be7a33d4efba572d4ff6b4
SHA512 91dad69ac6e9a67de9d6de9ee0b699295f566e4c427e3924cc104d8302bdc81f0ede41d64c98fcb32bde5067d32ef4f802154b7bb5957372570c742b6ed03058
SSDEEP 384:yDhyVhGE76cYG+22fP0kZfZC5Lvmyq4Hz45Wl8AG:yDh477qtjvZClQ/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AddToViewArrow.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrow.jpg
Size 2KB
SHA256 e7a1423e5e991937bf2a3fafda272a10b5c763b4df7df0465c767e54b2c28613
MD5 60d9b71e8c990fc46f6bbcb06c0c6af9
SHA1 0a0f0b409b6bc3e2e406d2929d0e0bef44990ecd
SHA512 6bf4e25234f50ab82bd8472cb689ef01bfe5b8934bf68f99c8806c0ac1ee19a68043eafb2d4b7efbba5eecdbacef0e683735be1ecdb2bbd991e3698f1ed02cfb
MD5 SHA1 SHA512

Submit Download

AddToViewArrowMask.bmp

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\AddToViewArrowMask.bmp
Size 2KB
SHA256 67c912a80ae609d88e08c829597bbb02dd8960603c9b4071625f3e03dae98da9
MD5 d76331dac2cc6da8f5bfd089b4ba8368
SHA1 ac200a958b3864b609767e9fb5f5e4d5368b22bf
SHA512 a870b35ceb51d435cf1169c4ea60c19e4f0a2ad67583dbe42b8987d4184d1d0dc014c152eb281a5608a06c10fb0772df26247a3e07be36ed47d50816891125d5
MD5 SHA1 SHA512

Submit Download

FormToolImages.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg
Size 7KB
SHA256 842f9d34d465376578619d47dc4ac3980e0c83e65151403fb80724217a424944
MD5 c73baa21e2802246baa0885e6f061e4a
SHA1 1bb8b3869abd4cf6102fc739a1f70dca8564d327
SHA512 73d5314e0305c6624929ea443a3be690820c38bcc468c95ecc8d2b59bcf33de66274528eeb1559d564f6a9fa441dbab3d6c5cea365fa4f279d552648f1cc74fd
SSDEEP 192:b2TXVwQc6VHzNXDqUADg9QbQi08Dzea6z74ZeoS5C18Se0:SJwQPVHzNXmFnbj08DzeV/WjoO
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BrightOrange\background.gif
Size 336B
SHA256 7b217a28162f3d0c42970c9f554cc891cd53d0264f0d4f4e2504553de0fbed0e
MD5 3bda742694f81175d60a7b9390b2b5ca
SHA1 2dd32dd147814e84a564abf4b71b0c9cf1146ab7
SHA512 dd705621e0cb2859009e47d6189558813260477d3c36abb59b4ea90d103c81558ab8ddfbbb29d2e4421217cf82fd1bba0be14f01dd40f5847781a4d48920c56f
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif
Size 240B
SHA256 ac4af675cc1952730750431b6a4c3b01e307bd96ec39b21daa23134bed111be2
MD5 5159efa9ab2a5c1e0abf5c2b9bf70306
SHA1 13e3aa3f3a418620f3f742ebc18793b3ed5c25bc
SHA512 a00b40507d64b90edf46d02d6379e064d7625b00b644e00931879bb10f78489eb33bca5d69fd49ac90c3fc1a15d1fd69160b6408c11c530cdb2e89cf950f0019
MD5 SHA1 SHA512

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\background.gif
Size 6KB
SHA256 7caad9c5a9b08d9f7f8108871de7e5807ebf4ba8c5f820c58197f4d99468cc26
MD5 c0fdbbda44c1fb5a454fbe179a88e726
SHA1 0d22f04591e1b2f977051939bf2a74a6d6de3f37
SHA512 cc3cec0625d66eb399dd229a815182b10522738cdbb2880f20d5b107217443837e25e548ba9a79a92192f1bedd2123137bca8197988ab60f6ab59a6d72952fc8
SSDEEP 192:Ddl0XeeLJhNUcdun+gPeJUlQ0u3SYOSwfwqOaChpBDKw:EX7BunGmuCYOSwqhJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl\background.gif
Size 816B
SHA256 bae8f18469519e2d2336b16f876cbb2105c1c239a1a8cc3c6347ccdcdf4775ba
MD5 c8f1a4c4a673e2952bda1334f9bed023
SHA1 e4b37fed7b0c69b36cf9e151ddaa59acb6c39ae0
SHA512 37c75f299cb0f978dcaca61e0a5c1f1499d641fcd82014b5c8fda1136e0dedad70525df0491b012c5a8ee0660455ae44b5157d52f5f76bc294da69f19d4a0438
MD5 SHA1 SHA512

Submit Download

ViewHeaderPreview.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg
Size 3KB
SHA256 95408c0b1a8cc9d0dc364cccb0ee86c29b725712fbdb89ee767deecb1549a97f
MD5 7243aac3f4addcbb0ae475e1c530deed
SHA1 a3e12962c584ae20ca3904131bed584a0743e669
SHA512 06414a040945dd8ee4f440940a830d8a0dd79e9b2e7512a5bb7e4eb50a51e243acab55ae2d5db3d7f91023e61eb26f894aa6bdedd67b2a54175d59c29a0bf6c0
MD5 SHA1 SHA512

Submit Download

attention.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\attention.gif
Size 2KB
SHA256 5d37389f1f54919299c65048e830442bbe3e6f82c36d30ec10bc0a9a71e704b4
MD5 74f34ee83416d6772ec610385596b480
SHA1 a275a30adc6e820210bce4854246ce5c540f5313
SHA512 dd8eeed561d65ecef05e6829eb6acd03586e05c309f604c87f3d789b07073430b13852d848b89d6844d0bc9d2ea09541ff630411eee25f307dd80f7ed707ebbd
MD5 SHA1 SHA512

Submit Download

bg_FormsHomePageBlank.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_FormsHomePageBlank.gif
Size 19KB
SHA256 aa4f3a13d80338b71604630aec1bdd23757cd97b745f0c2e43446202c8204aa9
MD5 41b373e6ed4736461d50383930251bcc
SHA1 ff4525ad9eb8100d13617532b3cfd92677d542d7
SHA512 d88d61ec79c30fab0d82dc143bf6b68f63af20042ef960756d462019e867e8e636b12bc936e32b9b10a58433ac1949ad003eaae4bc01aed0f2266ff3db8265a5
SSDEEP 384:EIAiKmuKgNJWR3Y4ah7uAUQdU/I6L/MSf/0eqKJvUU0rjobDB0y:EIAiiKgNJaoFvtW/tN0eqQMHfG0y
MD5 SHA1 SHA512 SSDEEP

Submit Download

rtf_choosefont.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif
Size 896B
SHA256 052a56da661815a251bef9d343b9da8f306efc09abd3834191b64ce66ba09db3
MD5 f03dc6a4b6f02dd3823a91564479d415
SHA1 ce92cf80216a2b4a7c719d6922efaedefc5a67d4
SHA512 769f8b3f414fe30bfc837d0e92568f5d607e5d70b0b28a0aac1c45db3b0c542a00cee120f47fc099b31ea651aac4a04af099d8cd1422258f04fbe5d0c8b77b7b
MD5 SHA1 SHA512

Submit Download

rtf_italic.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_italic.gif
Size 864B
SHA256 7c4d31c9cacf3a0e3e60771a79b495843fdcba4afde90425d2654b946d78338c
MD5 81b8656a64e89c7f88f285aafd8dd3c5
SHA1 e9ba6a9b152b28a4279c01c7d27906d798fbc852
SHA512 2aa460de3f10f18b84ba2b6949bad7c905440b10d9c803ab40484988fd0e083e9691bd8256a9d24c29bcb459c10e35d1dc1d6edd45278c1ae817614ca28171e1
MD5 SHA1 SHA512

Submit Download

rtf_underline.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_underline.gif
Size 864B
SHA256 7384f2fe02d6d8a52f133742e6632b1ec125f8b3d5a795c85ca2ca8dc0e057c1
MD5 a87fbade612415322e93322ca5e4270d
SHA1 2289067a88b6313fe242d4363ecd29fdd33df661
SHA512 4b1770b66a99d862a83a69db5a14c944f0513c0d6205b32dd5bed05d5ad020a81ea91abfe80529ad8a872d613113fae2f5a1ce0819ad57496621d94ab62155c0
MD5 SHA1 SHA512

Submit Download

FormsViewAttachmentIcons.jpg

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg
Size 5KB
SHA256 aec847371055cad970e1e8ff267ea97fb6904dcb282a73bba6ed673c7247ca0d
MD5 44cd626b1ad54d3e711dfcb05c122876
SHA1 1eb393dbef4e245e6ec196245f565008b5f32a47
SHA512 63b45acb38a2d6cf4c23eda454e020c1fba1a1e127e779ec1bf110ac64b775216818807166955f7541392f367bad884eb554d28d64edb96a59f415d4d6e388c4
SSDEEP 96:KP60nEYI8I0CTBrb78ag3RX3kqaN89JraV3Xs9xrG9XC1Eh3ChOeX9:tY3IPX78F3RX3NSSmuxrXEsX9
MD5 SHA1 SHA512 SSDEEP

Submit Download

FormsViewAttachmentIconsMask.bmp

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIconsMask.bmp
Size 1KB
SHA256 765fb1b71af8e6c3d5c516f0deaf75090c16153a6f36517abe6be4b8133a91d0
MD5 fa5beb4b4f8be549ca2aea7df521d306
SHA1 23f811f2eab2d027519160f0ff7d46ad611a1db0
SHA512 6faf543279f5acc37f4e9929c65b198ce88631688a90f52197c692787ccd0309c4348fb68728377613f0ed1454ab87eb06ccd2db8a4054db3dc48e98e829a9bb
MD5 SHA1 SHA512

Submit Download

rtf_alignleft.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignleft.gif
Size 864B
SHA256 1d27810cf1f35d02866f93661cbc559511c7424af2ec4f1d67f500f97da16de7
MD5 7f6858bc8a4de680c51bc13732c42852
SHA1 4c29efeb020a53e126ceecf65c2be8241cbd443f
SHA512 60ed4a7b865a4cdef79b117f92c20c0fbdac35a160e07a77afa946a8f6aac444d405225295956ecee418476dcd510ec01f8dccfdbc59c7e31bfc8e4e517ce7d1
MD5 SHA1 SHA512

Submit Download

rtf_alignright.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_alignright.gif
Size 848B
SHA256 bf5c56efc22502de1a73452c5c086159352e5674f3a4dca19fbfe5cd997e03e2
MD5 8fe972a0ddbc757f8a58fb3e562d00fd
SHA1 e62e9fc2e125111275a8f10e38a0d683a0ecf01d
SHA512 f20fb0587f28f1ed80ed4ef5dcc83c240215833189fbcec54e04b242cdd069aadca7236c60594045d3612fc32113ec0fc32e165ba9a6a093ec3d7aee2508e90d
MD5 SHA1 SHA512

Submit Download

rtf_bullets.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_bullets.gif
Size 880B
SHA256 df5508b65e8fe7978b51220849b4b6a0f33f9ddfe07a6415ab97b6bcfe324bd9
MD5 04ab26cc612d98652d2f8dc1acc28934
SHA1 d596ede2785a05358988b92a0f30bdec25db78f7
SHA512 5df3afbb345ab56a4f71aa1161ec66810bbc96d09f2e58412e33fdf5206a3c308d399133cbb7ccc9862b5209225870db5225b9369658282b12c5c63df0013b88
MD5 SHA1 SHA512

Submit Download

rtf_center.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_center.gif
Size 848B
SHA256 96ba7274a0006ea4cb2636854dfc0f5cd6b187cabd52ed6d94e1dd99311d99fd
MD5 76d41c1c9bbb731534762d219f8758b1
SHA1 78c048bdab40a591364a66b8af6695a1a0cb48ed
SHA512 419cc9f7b22e8c610374634998a3edf1666f31ae11f8f182e144f7ddd1bf5472f7c4f06809a52992c0d1120bc8bbe23369e20dfbd460e3a7395736e430e64e4e
MD5 SHA1 SHA512

Submit Download

rtf_decreaseindent.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_decreaseindent.gif
Size 864B
SHA256 dd8e463fdb9f6b405c7a47870e3740368d0ea0f4c0189b49403907583f0833ff
MD5 a53e37a9d1a978160f83cc473cde241a
SHA1 db2a581a293efa61c61336e43557b86e00ccee3a
SHA512 c2aec384e91ec7a57d3f5b4fb7a138b925352a8a4bdc9ee7a0eeedc9f84213e42068a24976d590d8abc28b5ea064e8166dc4fc14292849d67fd285f6c0e4aad1
MD5 SHA1 SHA512

Submit Download

rtf_increaseindent.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_increaseindent.gif
Size 864B
SHA256 2b7bf6558f37f7d7551961be47046a03f231b3409a1bec9d1084df74764ac09b
MD5 d130621ce24b8ddedd0deb16b19af54a
SHA1 608bea4127cc49d00fa5983a9b717b5eb13a4f4a
SHA512 2aa7d67b039e38e2e63cc3d9027eb526459a9cc6c6741eeb8550d72ca676931eabced8bb6411abfd350f33d82797272cc821ecdb22ad0675f69d569f38141b5c
MD5 SHA1 SHA512

Submit Download

rtf_justify.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_justify.gif
Size 864B
SHA256 69ccc91965969c5ddd208579ecae4b9520e450a57398cfb026438d889c7393a3
MD5 b421d99e27ed23594ea3e7e22acfebba
SHA1 510edddb61dfcdcd58a2340d6dcad9f1bd39c47c
SHA512 ec178d2a25e199096e9b653839881a37f33bfbad6db08f0dfc2434cf728093d5dfc25204e75afd50ab0825d16c2599d01a17bff202b1dc5a29f5ba18bae1f61a
MD5 SHA1 SHA512

Submit Download

rtf_pressed.gif

Path C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\rtf_pressed.gif
Size 896B
SHA256 9dd898c23ea246490118ac84f5f2aaca226faa81362d51572623566521c9454e
MD5 441a1331fa3c7b6d1f964f79bbdc7b11
SHA1 703c0928ead47d2093cfae4b40dec093da9a4f95
SHA512 3fbcb336b2eafa41e43711d12dd3fcba8f485d0bddae94bf4752dbf86e525356496dcb430b6b3fb42be1195564734f643dba8600fe4b8cdb6dbfec99d47e5533
MD5 SHA1 SHA512

Submit Download

Microsoft.Office.InfoPath.xml

Path C:\Program Files (x86)\Microsoft Office\Office14\InfoPathOM\InfoPathOMFormServices\InfoPathOMFormServicesV12\Microsoft.Office.InfoPath.xml
Size 247KB
SHA256 fdf01d945d318dde260b289f16ffaa06d20c275ffdb00b33e4ade18169b55303
MD5 a8802fe1df80a55864a042f6b38a86f8
SHA1 6dcc04c954aaf3f37bf8571a058ac20e8be12d03
SHA512 f376a191b1ebdce0cf510d773ecfab6a905d6bf491de3bc1095b1aec78efc8afc8b90b07dbbf9dbbf474f1f9ef9295d8ef3bdb26b7d8af5b9e8c1b5b2e533603
SSDEEP 6144:LHqg8vlY+TgJVLW4kzatn2xK0Jw1gMzXUiSzuNhwV:LHqtvlYrHLW4Dnqw1N5SzYa
MD5 SHA1 SHA512 SSDEEP

Submit Download

msvcr100.dll

Path C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\msvcr100.dll
Size 809KB
SHA256 353875f6c9293e2b1bd16e4a21f5e94f2b0ad7cc9931fff9561daeb3cca347b8
MD5 564843d5a803afb86ffcc9393c6a1e94
SHA1 a258013b7d4b4d663c6da756cbb4d6a5ecf9df29
SHA512 618fcee80f2c815060f8a9310710e7c5b2512b055f4f4afc3856e9d8b4b4f273ec30a83d79b39a446244ca8a71a73c6ea13c351acbfd43bb2e41ae8a7090ed80
SSDEEP 12288:jTivtSnl5VKqyTI5uJY7WjYd8M/AUnOtqdSfAaa1yWM9iFBHtP1A6RFhQ2QtcEQc:jiU6qyTkKjcv/lSfAagylGti6HnQyb6
MD5 SHA1 SHA512 SSDEEP

Submit Download

win32_LinkNoDrop32x32.gif

Path C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif
Size 160B
SHA256 2be038955bec6b5208862ec50d9a7098cbc5e54db45cd04b237d20ead1a3aecf
MD5 2fa99714f417f6e9ebaccf4cab4e9046
SHA1 dc64c1d6c3e435d8738a38da2637ead5d74a3ea6
SHA512 eabb65c1d6b9e6650e802eb8e8756003e1988d1243468bb0c3b57c7de305ab679c65becf40935046b04b5b3ea561e790c027a28fe73f040199b58581227b6731
MD5 SHA1 SHA512

Submit Download

epl-v10.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\epl-v10.html
Size 12KB
SHA256 1928ea3458a271e628609936380f22495178c734bac8533906baca51bc16bc17
MD5 c3c6672309e0d05b0cc36a51b2d06726
SHA1 7eedb916d8720d6cb9f0a11fb13df994f294bff9
SHA512 d1a4fa8e110abb50757ff86875bc50fcdd51f3c30cdb51cee47e088714e2da0c7e744ec97b396e12ec80e84a2bf59d28a5abb7cbcb2894a997405c790170ab29
SSDEEP 384:3AB2uTcrkrHSb5dDKXUC7bfAbkHeNiFGwVw5L0:3buTcwYgUC7TuHiFFVwR0
MD5 SHA1 SHA512 SSDEEP

Submit Download

license.html

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html
Size 8KB
SHA256 0abf7c4964a285d742c82f6be4097896abb547b57aeb2a8ec060d5a887fb62e4
MD5 912f70bdefb9d277f2dc637bf6150bfa
SHA1 12c64178421f4705a864b2e38130d830121c04a4
SHA512 5dd04c88ea3356a00fc1a9242a462e6f096f300ad3516aad5dd6db8d58e3dadd3d61f39d6ae07144abe6a98da094599024f75ad4d7e152d80fdf065eb3a81fc9
SSDEEP 192:qD2y3WEp/Mh1vuEaXfEW6QR7naIiMPhdwjqOYTEla/q:qD2QWEBMh1zeEr4aIiGhdHFEk/q
MD5 SHA1 SHA512 SSDEEP

Submit Download

asl-v20.txt

Path C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\asl-v20.txt
Size 11KB
SHA256 575b3e627282952c9e39634f730ffc52422513e3ec3c10033995fad8d098a3e0
MD5 b5d1c5f3f6982f504c6ee3e0c20c84b3
SHA1 79887a7db7257c14399f93923e434d15d222bb83
SHA512 2a83832089ea57413bc57dd94454685c6592ac75671fd448fd0cf17c9d9a723003a356e6be74654550650f3fa20832bc53537f9893a18e666bd2ef737921e550
SSDEEP 192:68iKgqcV+KXQHNq2vTpkUi7en8R4UoP5tD2D8SbgTYS45dPdmFOg2/Q/1zuY:68an+NtdfCRoP5tDuy45dPdmFgo/J
MD5 SHA1 SHA512 SSDEEP

Submit Download

THIRDPARTYLICENSEREADME-JAVAFX.txt

Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME-JAVAFX.txt
Size 109KB
SHA256 9a72429577dd5c12f457fc9e91084f299564feef83a1bae78c7648dba3ac2f0a
MD5 61ec3f791cf039709ce9c3d88b77ac8f
SHA1 84dd0cd65dd63a61369f7a545ff7ff3875b56e83
SHA512 ece287f89a9fa57777b15d15b1b82051df5c1ba297b077ee29b64656c7307c6aacaf67f2e59a4bc72f3cb31a847980bf7ebab76f551b1dbf56d9146463d1853e
SSDEEP 3072:U21QixNyO9s+IO2AjwMwerzndPOhBCOt/1d9O2ETxGpXSLWzdSPC0:U2F0O9sZKtzzl2Cw/1RkwOOdSp
MD5 SHA1 SHA512 SSDEEP

Submit Download

THIRDPARTYLICENSEREADME.txt

Path C:\Program Files\Java\jre7\THIRDPARTYLICENSEREADME.txt
Size 172KB
SHA256 a92f47d8af9ba47312c4ef426a027dd56999f1f47b3d2162ad9ce540925e88e3
MD5 6d65743caf518e280bf97624586c4d35
SHA1 a41637c07eaf0a3673093c42fe7b383923ec4869
SHA512 9798876f49c2fefec1ca96916579e7eb14fe0884e13456666f2033e88a067c24f3baeb87d70a369632af3d92ffeb7b68ee8f214783152d7a38dbb1e9658cdba7
SSDEEP 3072:WHKXEIVhjjs+Big5LHzT+nkhIGF3wqoZz1KPZ9x7C6+etEb4e4:W6v8g5D3phIGF3wqoZz12xmdetEb0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Microsoft Word 2010.lnk

Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office\Microsoft Word 2010.lnk
Size 2KB
SHA256 b6f771f0e2fb5ce63626581b56e7e6ac0f908f4718311a1b75f9ee69f75f274a
MD5 f357d93c55e07fd7d04c5cadf43ed311
SHA1 949b1cafda8800774b949b3bcbb3289fd8ae6adc
SHA512 0e450396793421bc559d2ddf439c221cde958aad2d4a6d0c283a4ad5e9e5c99681a0a5e4bddc1a4aadb1111df8bbc0535825bb5f2d1e0c835bd0d4523f1b1db9
MD5 SHA1 SHA512

Submit Download

index.dat

Path C:\Users\Admin\AppData\Roaming\Microsoft\Office\Recent\index.dat
Size 389B
SHA256 1035f068bf589ec21b1ae9c68581d157b49419d6f4cbe6952224f272d4a92ccd
MD5 78a055e0a3c67dc8dfc8322e1ee0fe14
SHA1 53084cc3ac30ee7b9aefee6d5ac09c58e7e88a5c
SHA512 4b790a453143629ba140faa15a08f528f4c52c46e9585bafc560972b5e29555dfb5fe05891702b64db24bb8e9b0d1e87c8c465cddcc1bc8c3de82cb7737d81e8
MD5 SHA1 SHA512

Submit Download

net.bat

Path C:\Users\Admin\Documents\net.bat
Size 17B
SHA256 3118a1ee4550b8f0ad01cede2b306ce8af7f6d7c67a7b763a2276ba1f75fcdab
MD5 25a54e0c194534a4555fbffa6f2c76e3
SHA1 259753c09c05d8ff8e78f6aec6510101ce4e49b4
SHA512 d37ce78da35de0f8754ba170fceef9defb81d9695a74b29f6501a83553af0af6e9177f913e15ab970dd3b6ec50c9822d31558b29e89e863506a3754256a31dbc
MD5 SHA1 SHA512

Submit Download

Windows Explorer.lnk

Path C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Windows Explorer.lnk
Size 1KB
SHA256 dd4cbba5278f80743d7fb255a271a3322b47aa1f832d8505cc4a4191da2d71d8
MD5 35097f01bb65272fc65e401bbcc3a3b9
SHA1 b7e0a97e4390b80747b55115c12dcfa119243c61
SHA512 a0cbbd54be76918ecac925c5ed4a81530bf0f8515bb4dfbf61b1adaabc5e9196f0f7aca72016faf3092075ab9d4f8717bc9bc4ca44de7b995b169aebe3ea858f
MD5 SHA1 SHA512

Submit Download

MSI20FA.tmp

Path C:\Windows\Installer\MSI20FA.tmp
Size 19KB
SHA256 c1eda5c42be64cfc08408a276340c9082f424ec1a4e96e78f85e9f80d0634141
MD5 9cadbfa797783ff9e7fc60301de9e1ff
SHA1 83bde6d6b75dfc88d3418ec1a2e935872b8864bb
SHA512 095963d9e01d46dae7908e3de6f115d7a0eebb114a5ec6e4e9312dbc22ba5baa268f5acece328066c9456172e90a95e097a35b9ed61589ce9684762e38f1385b
SSDEEP 384:pAbK9gKmryZECM4fNlQ5MbSQ0n55KsldnMUYs4AI:ubK9gRrRCM41Z2Q0n55ruHsQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI211B.tmp

Path C:\Windows\Installer\MSI211B.tmp
Size 363KB
SHA256 727ecf287fb6f4953ee7748913dd559b4f8d3a022fa2ca55bc51cf5886c52086
MD5 4a843a97ae51c310b573a02ffd2a0e8e
SHA1 063fa914ccb07249123c0d5f4595935487635b20
SHA512 905c081552d95b523ecf1155b6c7e157652e5ff00cda30c1c21124d266eb7d305c3398d6832316f403dc45d1b639f1a5a67aea29922cd1a032f52e5247ec55d2
SSDEEP 6144:zLgkfLH3xSc7ItcaUTAXpjpZc2Yi4NC4oGKd+e:zLFBzHgBpZc2Yi4U4oXwe
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2208.tmp

Path C:\Windows\Installer\MSI2208.tmp
Size 85KB
SHA256 148199b4f3b6b2030e2aeb63a66e8e333e692d38691bcbe39139cf02bb61b31d
MD5 5577a98daef4ba33e900a3e3108d6cc1
SHA1 5af817186ab0376a0433686be470ea2b48c74f5f
SHA512 d37d511975b5331a5b1cdda736890c7d4f2dcba4abac2b9399c977bdb7e09c964327e3f771cd592e2632b0e776545c490f29fd391ec13c7948557957cd805dd5
SSDEEP 1536:1iMbdGsmII5BIgpAIC1HCO5cSgKMk4GpVbf951:1rdGnIm6His4GLbf951
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2218.tmp

Path C:\Windows\Installer\MSI2218.tmp
Size 571KB
SHA256 f2d5eb947b85f763f72de7f800118844a5207c9e3dd456f13186c2aaf0c485ac
MD5 5a1e6b155435693938596d58eaca74bb
SHA1 27fb323ccc215136ef350469072b6ad559d39c3d
SHA512 4fee8576ef5541d4923aacb514b09e1e4dc8d6cbb1dcaada67c65240358147b971c2a1d034faf50c594ae7edb4a3c68dd4ffbbb69893413ffb52e71a86c65388
SSDEEP 6144:cAOYeUAh9K9MXvDi0z7IRttRW1GgJZmmmMU/i:c2eh9KUvDi0HI/to1GEx
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2277.tmp

Path C:\Windows\Installer\MSI2277.tmp
Size 32KB
SHA256 aaf3e53a1a1aeadac1339b20e256eabc29502a9a583a7c18b29d6bba2adb1ab0
MD5 8d4c7e2792f92d8e7cba3098a54c8e66
SHA1 d21b486f78aef95b7041d7e6966568ac3c550e3a
SHA512 b81598b2c47ebe78fb9851254b576885e7ba68b637337378c9e8e7928c72ffc89734c9a729dcb947aa64f8a89f07ef9c1751f64526e60cd72931b92662d2b91a
SSDEEP 768:QV3pO/g/fo/K/CJJ0bsI9SP0PX7aAheHsWi:C3p/fo/2CoMcfSsP
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2519.tmp

Path C:\Windows\Installer\MSI2519.tmp
Size 350KB
SHA256 813ebc09bb3144d76f6f3a1550877c21590e0776f893915ca1178672e84ca1e7
MD5 9caf5e1999a4bd6ab8c4d4ea07818a7d
SHA1 fb1fe1d18fb670fbbf7461f449a473778b711717
SHA512 d40a70f7718adc63a21758ce43bd0c3f71abf4a4b7dd0639be3decf326a1b3281ac1043c519fd3f5cbae5ed6b3e59e3bd8d583c2ae253529fdd6d5225f41ab74
SSDEEP 6144:8Xw70u/jnvvTFnS12hrNlPE0xEQSIOjRX3psqd95/3g:8Wfjnv7FE2hrX5xEQXDCg
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI27BD.tmp

Path C:\Windows\Installer\MSI27BD.tmp
Size 28KB
SHA256 f6e34a4550e499346f5ab1d245508f16bf765ff24c4988984b89e049ca55737f
MD5 85221b3bcba8dbe4b4a46581aa49f760
SHA1 746645c92594bfc739f77812d67cfd85f4b92474
SHA512 060e35c4de14a03a2cda313f968e372291866cc4acd59977d7a48ac3745494abc54df83fff63cf30be4e10ff69a3b3c8b6c38f43ebd2a8d23d6c86fbee7ba87d
SSDEEP 192:XOdG/6G4nnykxsdYZ+mrv2ySzLUHypLGgjuXFw5acHKBNtHjhuHWrkA9uBP1WWzT:P6GuZBrvkzAHyxxHKBdaA2dWWzm0ZH
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2916.tmp

Path C:\Windows\Installer\MSI2916.tmp
Size 107KB
SHA256 0d44d40e8bda72a3d6ca26665100b256848e2183029a6728c18ad97cd650547f
MD5 9f0b9bc54bb73dfb7cf85520da1a08cb
SHA1 236f7b770317d782f0817fbf7542140cb1e1526e
SHA512 8acfb05a7b4723776fa66c0f71bde90dd49243de5dd2a8cf1a1f09a1175f9346c12a717050bff5f3938bda6cc4c610ca1eab75d4b9b7c8bcfb97d9158727a10d
SSDEEP 1536:85alnPM3yLYoviMPX1Mcz8W657EkkeXpADMVBmX0ItPHYGT:85alrtPCuE7TXlW0ItPHp
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2965.tmp

Path C:\Windows\Installer\MSI2965.tmp
Size 148KB
SHA256 4447faacefaba8f040822101e2a4103031660de9139e70ecff9aa3a89455a783
MD5 33908aa43ac0aaabc06a58d51b1c2cca
SHA1 0a0d1ce3435abe2eed635481bac69e1999031291
SHA512 d5216a53df9cfbe1a78629c103286eb17042f639149c46b6a1cd76498531ae82afd265462fbe0ba9baaff275fc95c66504804f107c449f3fc5833b1ed9c3da46
SSDEEP 1536:KJS28uK6Gf6oGFDrJMxiPXzr8iOE6uqR4JjAK3Xf5n4TbTwzx/JQ5jR1bQlWkjWt:wSMtlFCuU4F3tM1wWkaUfHM64kQ+
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2A23.tmp

Path C:\Windows\Installer\MSI2A23.tmp
Size 214KB
SHA256 b5129d385ac5d296142ba97faf663ffbb6c50761fc414d4528d8b8a26bc31ac3
MD5 399075975c41f7e85b12bc6668f59cf3
SHA1 04f5140a93f4fd7721cd305d12cdb80d75b36a16
SHA512 1266087db1d06405ccdb4e3cfc8f086b361da2a276a62dcbd2ecfa4532571cf57fdc568b07493fb5d0d9171c1eac8b9d371cd3e35600ee08b108b2688c0c95bf
SSDEEP 3072:vnEWUYQxpeCZMRN4K8NJwhWl4fvUOZkvPIEzKQoZM:7UY8hZMROwWlgvUO0tG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2A53.tmp

Path C:\Windows\Installer\MSI2A53.tmp
Size 83KB
SHA256 e75f900e7240da9993c267a11f5a68d4c2cebb205fa690200bcdf8e1d0b6e7d8
MD5 9471017b246f1b3dbbd8984ecc1f4293
SHA1 d498d3f0fdf3c5d90e244094f3df3e618da36341
SHA512 d950f8e613b8585ba8148cad5731134105bf992d160cdedffdf914e78e7b9f1eac0fa3d1071c87343ee942a92ad8ebd1970850edb5fb278326ef03e9ab4160c7
SSDEEP 1536:HC/xXYllwpA1uRQe/xyf0JnwssRWm+LjUToXTk2y7M:i/xIllmRXyf0BFmgUToXT3y7
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI3163.tmp

Path C:\Windows\Installer\MSI3163.tmp
Size 134KB
SHA256 796aea9a46fb7704222a7fe1f4e27455b14640c816d6f961344f89dc47537b33
MD5 b8255a1bc3c307557741d2c99b8256d1
SHA1 48cc6f3c1a566f06684c5184cf830cbd7db638c2
SHA512 85f685ad84f2208ad87ff34fb5e99edae50fc938a9335cb9747b7707d237c1b397c318090112eee0e9f04777ee004e26e7377f57c3e31159a96638b65110a69c
SSDEEP 1536:F1k/1pG91HZExPRVgRlPYir5QZbASHPJFZIXWLb+cAty3hX1atjbH1:FCPI15E5YY0aBrVxhX1atjb
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log
Size 108KB
SHA256 bdc45d52d2f5eee984d12b7e1550ccd037293b96ce1b4246844921e772e4572a
MD5 6f96634bc3cb5f94944c9d0493d9c4e8
SHA1 9cbfbe168d9af3937abb4634cc647c4f48e38da5
SHA512 5919a097169d41031f34aa91deffea5e8c3430b1f9a2235a39874a7ee32565343a0c3615428c5b1dd4fb65130e3aee89ee48ce2db7bd593b11f823f2dc0838e1
SSDEEP 768:+MezMh4ns0ugUPyX3TyQ7Qqu0wZP+QdejevwBvU9iY96u0efi5dtIUCYHR18pi/A:+fKGjevwsuW20l0/mKVMYu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ngen.log

Path C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.log
Size 118KB
SHA256 3adcad210b8ab55544208f780132ad81ec7f4c6c44b268b201d7fe462b967316
MD5 f00781de58367f4f2771e9071575773a
SHA1 5a379573c7b804bde234d1ffbcec405cbbf01133
SHA512 6dc0c996dcfe56a1c9a097e8b577691cdd70b5a529fecdc95bf80e76d04b6cb56810a9b0c0d1a93229a82297d8f7a75eb9ee12960f2f071158e857bbea71d609
SSDEEP 768:NiZJ/b+cUDU00lELifbSJe09pHaNcp7cdAcOwVPARvCJ6ywc46JNJiJqJFOhl90O:NiZJ/bBUu46JNJiJqJe
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI1FE0.tmp

Path \Windows\Installer\MSI1FE0.tmp
Size 257KB
SHA256 57cb8f01cf553c3886760180d1a74839f2f676640115504485aca9692f577acc
MD5 d1f5ce6b23351677e54a245f46a9f8d2
SHA1 0d5c6749401248284767f16df92b726e727718ca
SHA512 960e90894e7bedcc89894e77e57e8ee0c99dd2c530d02665e8bbd3a1793eccc1e295c5923d1f37c757fa1158097fbaae70898c16052882d3d210c29ea801b3ba
SSDEEP 6144:GHp/r0YSOJ0K5q0+S2M1evzug/xHvo6+A7sm:GHp/rrS60KIRpkyzumxHYXm
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSI2C86.tmp

Path \Windows\Installer\MSI2C86.tmp
Size 114KB
SHA256 9d849a8f5b39941ea32d47f0529977b1870f648736a483d86682436e3d3db748
MD5 00c3f5ca474a20c4a8dfb263a3950dad
SHA1 78b00a2e0490e1664af4d86fdbd3ac78330d21d4
SHA512 20a8a8655b61b464f29329a70daa95a36c8c54b549bbec26ed93c63097d6d7a4c0a3ca1cb9a85a0521d298885c00f22fbfa28abf9aa33737056b48cc0ebead9d
SSDEEP 1536:GCUrm0W6vgq+/LrHl1jw8H9PCAl1U24VGHVmh5Dg1MAP5J/f:/Amb6vgq8LrFfCAlu24VG825JX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/444-6755-0x0000000000230000-0x000000000023A000-memory.dmp

Download

memory/1248-7477-0x0000000002180000-0x00000000021C8000-memory.dmp

Download

memory/1248-7483-0x000000001AD90000-0x000000001ADA6000-memory.dmp

Download

memory/1248-7505-0x00000000005D0000-0x00000000005E6000-memory.dmp

Download

memory/1248-7504-0x0000000000310000-0x000000000031E000-memory.dmp

Download

memory/1248-7503-0x000000001B850000-0x000000001BD1E000-memory.dmp

Download

memory/1248-7502-0x00000000005D0000-0x00000000005EA000-memory.dmp

Download

memory/1248-7501-0x000000001AD90000-0x000000001ADAA000-memory.dmp

Download

memory/1248-7463-0x0000000000320000-0x000000000032E000-memory.dmp

Download

memory/1248-7464-0x0000000001F00000-0x0000000001F2C000-memory.dmp

Download

memory/1248-7465-0x0000000001F30000-0x0000000001F3A000-memory.dmp

Download

memory/1248-7466-0x0000000001F30000-0x0000000001F3C000-memory.dmp

Download

memory/1248-7467-0x0000000001F30000-0x0000000001F3A000-memory.dmp

Download

memory/1248-7468-0x0000000001F30000-0x0000000001F3E000-memory.dmp

Download

memory/1248-7469-0x0000000001F40000-0x0000000001F4C000-memory.dmp

Download

memory/1248-7470-0x0000000001F30000-0x0000000001F3E000-memory.dmp

Download

memory/1248-7471-0x0000000001F40000-0x0000000001F4A000-memory.dmp

Download

memory/1248-7472-0x0000000001FE0000-0x0000000001FEC000-memory.dmp

Download

memory/1248-7473-0x0000000002180000-0x00000000021C8000-memory.dmp

Download

memory/1248-7474-0x000000001AD90000-0x000000001ADA6000-memory.dmp

Download

memory/1248-7475-0x0000000001FF0000-0x0000000001FFE000-memory.dmp

Download

memory/1248-7476-0x0000000001F30000-0x0000000001F3E000-memory.dmp

Download

memory/1248-7500-0x000000001B2A0000-0x000000001B2E8000-memory.dmp

Download

memory/1248-7478-0x000000001AD90000-0x000000001ADA6000-memory.dmp

Download

memory/1248-7479-0x0000000001F30000-0x0000000001F48000-memory.dmp

Download

memory/1248-7480-0x00000000021A0000-0x00000000021AE000-memory.dmp

Download

memory/1248-7481-0x00000000021B0000-0x00000000021BC000-memory.dmp

Download

memory/1248-7482-0x00000000021C0000-0x00000000021CE000-memory.dmp

Download

memory/1248-7499-0x0000000001F30000-0x0000000001F46000-memory.dmp

Download

memory/1248-7484-0x000000001ADB0000-0x000000001ADCA000-memory.dmp

Download

memory/1248-7485-0x000000001B850000-0x000000001BD1E000-memory.dmp

Download

memory/1248-7486-0x000000001BD20000-0x000000001C02E000-memory.dmp

Download

memory/1248-7487-0x0000000000310000-0x000000000031C000-memory.dmp

Download

memory/1248-7488-0x00000000005D0000-0x00000000005E8000-memory.dmp

Download

memory/1248-7489-0x00000000005F0000-0x00000000005FE000-memory.dmp

Download

memory/1248-7490-0x0000000000600000-0x000000000060C000-memory.dmp

Download

memory/1248-7491-0x0000000000610000-0x000000000061E000-memory.dmp

Download

memory/1248-7492-0x0000000001F30000-0x0000000001F46000-memory.dmp

Download

memory/1248-7493-0x000000001B2A0000-0x000000001B2E8000-memory.dmp

Download

memory/1248-7494-0x00000000021C0000-0x00000000021DA000-memory.dmp

Download

memory/1248-7495-0x0000000000310000-0x000000000031C000-memory.dmp

Download

memory/1248-7496-0x00000000005D0000-0x00000000005E8000-memory.dmp

Download

memory/1248-7497-0x00000000005F0000-0x00000000005FE000-memory.dmp

Download

memory/1248-7498-0x0000000000610000-0x000000000061E000-memory.dmp

Download

memory/2012-7510-0x0000000000410000-0x000000000041E000-memory.dmp

Download

memory/2568-10-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Download

memory/2568-2825-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Download

memory/2568-6717-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Download

memory/2568-2826-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Download

memory/2568-5-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Download

memory/2568-2252-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Download

memory/2568-1667-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Download

memory/2568-2-0x000007FEF5430000-0x000007FEF5E1C000-memory.dmp

Download

memory/2568-1-0x00000000012B0000-0x0000000001562000-memory.dmp

Download

memory/2568-0-0x000007FEF5433000-0x000007FEF5434000-memory.dmp

Download

memory/2848-7528-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download