471f3fb1a953fab38be3081eb835574694bc72b94f239edc400d1ce3d7a8ecb0

Analysis

max time kernel
840s
max time network
841s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-11-2024 02:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

87a4f3f9f6dc263378f2f01db5f2c988.exe
Size

630KB
MD5

87a4f3f9f6dc263378f2f01db5f2c988
SHA1

dab86879e6e423582fedab0cc00c95882d3c3417
SHA256

5d196e6481f38fa6657d74288fc51b91e273b62ec00100737d0d0cc8f1e8379b
SHA512

b2d98312e827c14702befe05c4262718a2e321a7200f1c08ddaa2517157b4fef960ba9508cec43654c77bec060c998d71f7be8e0b84633531e1cb5cd10b903e6
SSDEEP

12288:AzBsMGrB6kzTKOeW9dY82G+JTlJR8E4TeOb57BIAwP/wyBmrdTOVf8I6jTBwF2dO:ifGIkzGOeW9dYG0pFf0wP/wyBmrdTOVN

Score

7^/10

discovery ransomware spyware stealer

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

cmd.exe

pid process

1512 cmd.exe

pid	process
1512	cmd.exe

Drops startup file 3 IoCs

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\87a4f3f9f6dc263378f2f01db5f2c988.exe	87a4f3f9f6dc263378f2f01db5f2c988.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pic.bmp	87a4f3f9f6dc263378f2f01db5f2c988.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\87a4f3f9f6dc263378f2f01db5f2c988.exe	87a4f3f9f6dc263378f2f01db5f2c988.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Drops file in System32 directory 64 IoCs

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.exe

description	ioc	process
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\Licenses\eval\StarterN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\UltimateN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\Enterprise\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\eval\Starter\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\Licenses\eval\ProfessionalE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremium\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\HomePremiumE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\ProfessionalN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasic\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\OEM\ProfessionalE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\StarterE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\_Default\ProfessionalE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\EnterpriseN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\_Default\UltimateE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\eval\Professional\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\eval\StarterE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\ProfessionalE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomePremiumE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\Licenses\eval\Enterprise\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\eval\HomeBasic\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\OEM\ProfessionalN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\eval\HomePremium\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\eval\StarterN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\ProfessionalE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\EnterpriseN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\it-IT\Licenses\_Default\UltimateE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\OEM\EnterpriseN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\UltimateE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\lpeula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\Ultimate\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\HomeBasicE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\OEM\Ultimate\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\eval\UltimateN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\UltimateN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\WCN\de-DE\Add_a_device_or_computer_to_a_network_usb.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\lpeula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\EnterpriseN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\eval\Enterprise\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasicN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\OEM\HomeBasicN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\Professional\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\_Default\ProfessionalE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\OEM\HomeBasicN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\OEM\HomePremiumN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\lpeula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\eval\HomeBasic\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\eval\HomePremiumE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\eval\UltimateE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\WCN\ja-JP\Add_a_device_or_computer_to_a_network_usb.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\eval\HomePremiumN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\_Default\HomePremium\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\OEM\UltimateE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\OEM\StarterE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\_Default\HomeBasicE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\de-DE\Licenses\eval\UltimateE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\eval\EnterpriseN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\en-US\Licenses\OEM\EnterpriseN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\fr-FR\Licenses\eval\Professional\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\ja-JP\Licenses\_Default\HomeBasicN\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\eval\ProfessionalE\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\SysWOW64\es-ES\Licenses\_Default\HomePremium\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Roaming\\pic.bmp"	87a4f3f9f6dc263378f2f01db5f2c988.exe

Drops file in Program Files directory 64 IoCs

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.exe

description	ioc	process
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIcon.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Windows Media Player\Media Renderer\DMR_48.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384888.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02053J.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\LoginDialogBackground.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_Off.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BUTTON.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\COMBOBOX.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Resource\ENUtxt.pdf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099150.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175361.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309567.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03425I.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VeriSign_Class_3_Public_Primary_CA.cer	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierCloseButton.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\PicturesToolIconImages.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145904.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\BREAK.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0390072.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01046J.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\pmd.cer	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341742.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382836.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATETIME.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\StaticText.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0179963.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormToolImages.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0315580.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\NUMERIC.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309705.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\Stamps\ENU\SignHere.pdf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02829J.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH03380I.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145212.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\InformationIcon.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382938.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386485.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\RADIO.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\ResourceInternal.zip	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\VS_ComponentSigningIntermediate.cer	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145669.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_ContactLow.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveDocumentReview\MarkupIconImages.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\DATE.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382948.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0384885.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Settings.zip	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\ResourceInternal.zip	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0386267.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01221K.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02759J.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\groove.net\Servers\Management.cer	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\CommsIncomingImage.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\CSharp\1033\Class.zip	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309664.JPG	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files\SelectSync.xlsm	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\AUMProduct.cer	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe

Drops file in Windows directory 64 IoCs

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.exe

description	ioc	process
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-h..homegroup.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_f674612e35113616\OOBE_HELP_What_is_HomeGroup.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..homebasic.resources_31bf3856ad364e35_6.1.7600.16385_de-de_b20ebe05969f5227\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1cd8423c61339c71\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1043\eula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-mediaplayer-core_31bf3856ad364e35_6.1.7601.17514_none_698fc88e65b943d6\DMR_120.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-g..ets-slideshowgadget_31bf3856ad364e35_6.1.7600.16385_none_253e8c58002c48e1\Tulip.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_it-it_85a0fa7c3f10c98a\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..fessional.resources_31bf3856ad364e35_6.1.7600.16385_de-de_dab8991dcf40c3bd\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_1f13ba22df0a61ce\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-photosamples_31bf3856ad364e35_6.1.7600.16385_none_f36e0e659b8042be\Chrysanthemum.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_de-de_970a7644dc297d48\Add_a_device_or_computer_to_a_network_usb.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_15e4306ea29e7ff3\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_en-us_e9f79a70efa455da\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-shell-wallpaper-scenes_31bf3856ad364e35_6.1.7600.16385_none_a4393b1a254aeaee\img25.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_de-de_b57cde6a4a1831eb\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_be5cbd3b6b3e4c5c\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Web\Wallpaper\Landscapes\img9.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_e429287568bba98b\privacy.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startere.resources_31bf3856ad364e35_6.1.7600.16385_fr-fr_ea5de2412487a733\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_en-us_fe8f8ca0a21cfbfe\lipeula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_es-es_ed8c9bcde614601c\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_en-us_247c7f7ff2fcb4c5\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Web\Wallpaper\Scenes\img29.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_0a63b1ebc6aa1bcd\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-m..ttheme-za-component_31bf3856ad364e35_6.1.7601.17514_none_a5926b147a413e6a\ZA-wp1.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..essionaln.resources_31bf3856ad364e35_6.1.7601.17514_it-it_ba9377df7c776240\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-characters_31bf3856ad364e35_6.1.7600.16385_none_bde0eaed84920a21\img23.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-w..ar-wizard.resources_31bf3856ad364e35_6.1.7600.16385_it-it_cca6156795327692\Add_a_device_or_computer_to_a_network_usb.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_it-it_068a8aa70d654920\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_de-de_1f6d0e034bc137ca\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7600.16385_de-de_e73ca319a82aa327\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..essionale.resources_31bf3856ad364e35_6.1.7601.17514_es-es_75e8ec7939c0089d\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7600.16385_ja-jp_91573a6acf66313b\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-h..atement_r.resources_31bf3856ad364e35_6.1.7601.17514_en-us_b558e03eab75aa2b\privacy.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_es-es_fe5ae984a243eda3\lpeula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_ja-jp_e3b259cc3b13b0cb\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_en-us_8618b2759ddf665b\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Web\Wallpaper\Scenes\img30.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..-lpksetup.resources_31bf3856ad364e35_6.1.7601.17514_es-es_5a7985085aa15ed9\lipeula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..epremiumn.resources_31bf3856ad364e35_6.1.7601.17514_de-de_1f1c1bdbc5efe9fd\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..ultimaten.resources_31bf3856ad364e35_6.1.7601.17514_it-it_7a6c0813b0185bfc\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1032\eula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..ultimatee.resources_31bf3856ad364e35_6.1.7601.17514_it-it_7cee3b15ebef4ff3\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\v4.7.03062\1041\eula.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img10.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..nterprise.resources_31bf3856ad364e35_6.1.7601.17514_fr-fr_17db1b7ac306db2a\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..omebasicn.resources_31bf3856ad364e35_6.1.7600.16385_it-it_f149f1f62cfc0fd8\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7600.16385_it-it_1eef89e6f9091c8b\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..omebasice.resources_31bf3856ad364e35_6.1.7600.16385_es-es_4827f5a0b6c3696b\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..terprisee.resources_31bf3856ad364e35_6.1.7601.17514_es-es_b4ad6e797df4a310\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_4f7e32f76654bd3c\HandPrints.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-s..allpaper-landscapes_31bf3856ad364e35_6.1.7600.16385_none_e57abb2f66db71a9\img11.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-s..lpaper-architecture_31bf3856ad364e35_6.1.7600.16385_none_d99106b927aa7782\img14.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-mail-app_31bf3856ad364e35_6.1.7601.17514_none_f35f9773adf74c06\ShadesOfBlue.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v2.0.50727\ASP.NETWebAdminFiles\Images\help.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_it-it_62a9262ac5c2ba56\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..epremiume.resources_31bf3856ad364e35_6.1.7600.16385_it-it_37669c3d6397c19d\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-startern.resources_31bf3856ad364e35_6.1.7601.17514_en-us_c85de3fc3a9f438f\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Globalization\MCT\MCT-CA\Wallpaper\CA-wp6.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\amd64_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7601.17514_de-de_0410dad38ea2e84c\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..-ultimate.resources_31bf3856ad364e35_6.1.7600.16385_es-es_e9c2f754efcb477f\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe
File opened for modification	\??\c:\Windows\winsxs\x86_microsoft-windows-l..terprisen.resources_31bf3856ad364e35_6.1.7601.17514_it-it_a77516706ab8de8c\license.rtf	87a4f3f9f6dc263378f2f01db5f2c988.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.execmd.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	87a4f3f9f6dc263378f2f01db5f2c988.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Control Panel 3 IoCs

evasion

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop	87a4f3f9f6dc263378f2f01db5f2c988.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\	87a4f3f9f6dc263378f2f01db5f2c988.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Control Panel\Desktop\TileWallpaper = "0"	87a4f3f9f6dc263378f2f01db5f2c988.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

87a4f3f9f6dc263378f2f01db5f2c988.exe

description	pid	process	target process
PID 2420 wrote to memory of 1512	2420	87a4f3f9f6dc263378f2f01db5f2c988.exe	cmd.exe
PID 2420 wrote to memory of 1512	2420	87a4f3f9f6dc263378f2f01db5f2c988.exe	cmd.exe
PID 2420 wrote to memory of 1512	2420	87a4f3f9f6dc263378f2f01db5f2c988.exe	cmd.exe
PID 2420 wrote to memory of 1512	2420	87a4f3f9f6dc263378f2f01db5f2c988.exe	cmd.exe

C:\Users\Admin\AppData\Local\Temp\87a4f3f9f6dc263378f2f01db5f2c988.exe
"C:\Users\Admin\AppData\Local\Temp\87a4f3f9f6dc263378f2f01db5f2c988.exe"
1⤵
- Drops startup file
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Control Panel
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\cleen.bat" "
  2⤵
  - Deletes itself
  - System Location Discovery: System Language Discovery
  PID:1512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\[email protected]

Filesize
3KB

MD5
8f340d61075544f961ba2a39a4a61e0f

SHA1
8ffa69c03333000e2e80c2aa903ad9a865929ba4

SHA256
85f711aef5260da894d03cc76914cad6655b89763d6dbaa35bdb5643dda9f641

SHA512
3abc799892bd829c66b816e7461282685b2c76f3f6b3acedae21b44338380f0fca4fd8bc1ac063c4943b425666522b3096fe6f3b5b1d05be968640b145fd601c

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormToolImages.jpg

Filesize
8KB

MD5
6e714f5424cfa25d30d2212d517fd138

SHA1
a7903bb651f6a349186f2671d9f70b028e3642a8

SHA256
4c1bb60246faa30b06cd7da031518457c5585eb67ad92666511cda25da1fe5ec

SHA512
d48019b33f319cee62777c979545cd6c53d5a1dac8324caee1cbe31504c0a445acb8b52592716997c1fd6a4e2723537babb26c63bc1090a9974d11c2902e7e11

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\ViewHeaderPreview.jpg

Filesize
3KB

MD5
e2dd35042f59b1c4ac9d59e821e4f79a

SHA1
f2069f97c9187eadbec1bbc4a44828f0e0882735

SHA256
beffce82c52915df246c5f81931363ac8451198aa799377465efa54122a29b49

SHA512
727b2586118cc76deb894c6198fccda2b5b55af114ad68dce145a330421bc48f744e65d2f8b5c9a1ba6524cf5d8f2e54037486724257b10e85dc421c81eaf628

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsViewAttachmentIcons.jpg

Filesize
6KB

MD5
69337b0278b1533107f81a2aa04a5683

SHA1
6e710dc94f1bcc03559eba52f19672b60ae38f63

SHA256
97fd01e184205cdf0da5ab6fbfeaae3ce5ebe9c25f3e0a7dd6f235737a9bd536

SHA512
10a836910e932da754ff178974910bf11d4db54a9b788ac9ba9fdded117e8926a8983a580bd6970a2b89b39bdf1c222f0c916d329fbeced0ba7d0798a435bfa5

Download Submit
C:\Users\Admin\AppData\Local\Temp\cleen.bat

Filesize
227B

MD5
d6497ec019a727eed918c1f2f0a650c3

SHA1
0f522422b6f1ca9cb5dec89c63676bbca7a1e5bf

SHA256
3685684522f7015bba342f0f2e3f7d77de99ebe1c0d8abbda4f31c8ccced3a63

SHA512
8a974bc95f3d6f516ef69c3d0768f0298290709ceac6bc1ded24c7b88c555d6ef728ba6a0dafc06c257e54d3ea1a2bf901c6308d25d87f1503d56ba812a483a0

Download Submit
C:\Users\Admin\Desktop\OutRename.xlsx

Filesize
14KB

MD5
b90cc7975a271604bd5081cbf810c014

SHA1
eced4946605d107166df9c5a70465f6482dbde5d

SHA256
00f950270f18d866c1a94112cfa5b339e45dabaa1fb8fb8e039386b3bf9570ef

SHA512
a897a68a573ace344f7824108f8b2d50bea0e23f5737984b85db7366d95a17d1f532231d1a8ab1d7b9bff15905f7473063b2791a443025c5bf4916aa9d3678b8

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\ASPdotNET_logo.jpg

Filesize
26KB

MD5
7ae3f5e273d032e129573fd35ab18617

SHA1
f0448dbd8476d909386b3b7b6b03395d86c4f1db

SHA256
30b094f371e6e1838e62100ccc6a2c522eb174a4d245ad43607e2c497c7f711a

SHA512
e81462c02760a8ef31a87267df4f028a059eb40606d9fe228decfab0697da1bbf72527d91331c5d2b42c963fb549e1945896bbb19868c9b75e11c40efd5671e7

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\darkBlue_GRAD.jpg

Filesize
9KB

MD5
6a5cd90fbf5427110743d4a7e1a940a9

SHA1
ae3dfcc93782111784ba9b75bebdf9ed0e44ac05

SHA256
9cfd5e2b57446ce514648304dafb571304dbb4a2de421b0ca20b6f28b677e6f5

SHA512
50789e7e075c464b9b875bb6f8f28faef367e63ad4989bd34481d45bbe62e1ef74a3cebff52fe8065bd04a8e34d60ff4b020a06ea51afe648a1a295613e30734

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\help.jpg

Filesize
1KB

MD5
809f2e22aa6bd8d23044a96fe1ca0183

SHA1
f5963dbe5a820390661511e7a7a914c637094977

SHA256
0b86b7a576c3a86a073321895915b98713d83f0c637a53d254109b27883bc995

SHA512
9e46c0a6d6a5fdb40dac96f508fb419ebf5f528c53e9c0acea1674bf3da7f268c8c1d7cc956b6d11bba308978c46fce79fbe114d0dbb12ec34e94448822b212d

Download Submit
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ASP.NETWebAdminFiles\Images\topGradRepeat.jpg

Filesize
10KB

MD5
b7c4eaea9d8de103303bd2d5a5eb4e9d

SHA1
f61ea5cb72d86838a80cbad7d018f128f6f4c892

SHA256
c33557e20b798c6f987da2d1dbfca4df523d4dbc0d90b358ac51a063a86fc07f

SHA512
5a215ed8f157d17e319be7a9b6ef44ae94dfb4da0a7e70820b207196f5214545353cec3a614934f5ec87b92e3f822c91f785bc7820f87c9611051e725c465da2

Download Submit
memory/2420-1-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2420-238-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2420-2-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2420-904-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2420-1303-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download
memory/2420-3-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2420-1356-0x0000000000400000-0x00000000004A6000-memory.dmp

Filesize
664KB

Download