ac97d2d662278eec2f691fc2a76e0a4a9f9b3bfffa83b5b10658eb2b943e99ee

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/10/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 63KB
Sample261009-vssjsscs2x
SHA256 ac97d2d662278eec2f691fc2a76e0a4a9f9b3bfffa83b5b10658eb2b943e99ee
MD5 a9d30b598f1045aa5b18db12f3686cc0
SHA1 ae67949a16dea1caa83d826c3f60e770b57dd2ea
SHA512 94c6204965e42b6dd2b3db3c4bd10d4c9dcd39397e453b05ac78b76397da8aa1d7d3aafbb2043d203ecace19b62810332f0b829523bcb86370c320fcd9284952
SSDEEP 1536:hFuGmNy6NSN+kqxZKgaDRJU3PQJIXzrbPnQLTeVa:O/Ny6Ed2ZKgalJUfQUnbPnQL6Va
TLSH
T14653DFCEB510E9D6F4D7287E350862AFA7913C6A36E74205A4D40ADCE4A012736EC5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2916	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
4624	urdvxc.exe
3648	urdvxc.exe
4840	urdvxc.exe
1608	urdvxc.exe
2916	urdvxc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\bootstrap.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\OutUse.shtml	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\MergeRestore.htm	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "vtjrlbzvljhhqehk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "jhswkkvqclzxlehl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "sszkwleqkelbchvw"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lthvhsehkvhstles"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "wrhjbcxresnwtjvs"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "enntsrxhswhstrbk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "kkqbltrzjewscnlt"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "rrtrbbslsqkqknxk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "qjvqsstqsbvqetkn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "xjzsjzekrqcsjere"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "jwjhqhwrbthqhekx"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "ktsnexcjwhqwnbnt"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "bztsqkstnnevrnej"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "qxcnnlkqrblzbvsj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "weeqrktjtjrkcjzv"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "lcebjtxkkcwhxvkt"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4624	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4852 wrote to memory of 4624	4852	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	88
PID 4852 wrote to memory of 4840	4852	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 4852 wrote to memory of 2916	4852	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4624
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4840
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:2916

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3648

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 653B
SHA256 5db85a58e207c56d032fc499f847b640ea413ffc34c8bb6a2358e8328ca53649
MD5 11f8e621706e70433d86bf0b139b1f38
SHA1 c50243891096a394ac40fab20ba5ffc87cb0f787
SHA512 05db477df1cc055f17df3b23f93e43444dcbc2f99e3508edbddc7e69b002539671ca2e45cfa912828b23e443e24a4499eba86949d02f5b4515103e3d5788bfc2
TLSH
T108F0FE6ADA40DD09D1720EF130765E143516045A47A787B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 248f6d0716c285cdf660dfb5466040b27bfaf25ba31b546c5b9a78979bcf0cc3
MD5 36013224d66d68a90199d4455b9d8695
SHA1 8746994a8ee6b31b596c3c7f95b9e918d762adf9
SHA512 486daf5c63baad6a33198a8f874f0e696ec2e15d3f6cea5da119c9763adfd7f098cfba96d1782c13300ac6947203ce946fc16af782d6030c597bdce8129f629e
TLSH
T10AF0E1BFA215DD0DE5B30BF465766F801A6A001B07928BB139D18CD3DA8D47CAE053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 611B
SHA256 a6c288b90aff6966455456669d581a3ef5eee5961904017f01ba1d5305213bcd
MD5 e40d5cbb486250b4371b5ef776f2bbba
SHA1 4a956f4841bae78fd718de3594070fbf9f4c90f9
SHA512 06888b0a059538bb427b57a633255f6bb69334211a1d7589f5f279676e9be5de78273c9fcdee4f2ccde47198966ed63b655759284b71bb2aaef668a4e0b80982
TLSH
T127F0026FC342DC0B90320AFC11736F20096624124BE6979636E19C03E9CD93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 0d76b4ffeec55f9a1c18e100aa4a5439d24602ff2124bcae9cef09f8b7fe130b
MD5 d12c5c021b537687661cb578612d8688
SHA1 57f145f69f04903bd9b910d5d8a71b44000d2193
SHA512 02ca8044ae6b8cea943881d7afc1792bfaed27a34dd08c4b8ffbb901924b799f405ca4a5336101fbf4065f269b1cd25c7dc221faf489ba9a15673a310fed4420
TLSH
T134F0027F6709DE4ED27357F010231B441916046B07A597B235D2C883D18C1AC1E413C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 33a7efc40abad73a2f3f90589b318a503c6b0085601b335f86440eb9b09824c6
MD5 d8c6d3fcb69decf88d33681b3b8b06eb
SHA1 8d5fbd422ed70e5e4b26576e8e20f09f06a5b7cd
SHA512 7f15f0ac29f55e208c13c39529281e32de4afeba48bbf44b2c73ae926c9992ba103e26bb9650975082b232abec2afd6ad5ce2a44cda4c4736f987bdf8c560d8c
TLSH
T1BEF0A29B5215CD0B92B20BF535B25F641A66043603A62BB235D1888395CD06D7A477C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 c29d0b5bef115ed920a95d8462ade0b528ef8cadc03d7ff05c8e7c380cdaf9ac
MD5 bf286864b465aac915a6ee746f91d0d0
SHA1 f664ec18e672c5fe7692bbb909ff46ebb8f92f2a
SHA512 25b836ec5b00375a927a8262fb9d32278c97857bf561bc21669de6e659d0dabceb92faa44e0283cd141e26abb88be9a9c895b043f04f1b2b524f5e1a6ab2f851
TLSH
T1B9F0E1EB6301DE0EA9B34BB03536AB8825D6027A07E64B273D518A93DA8C43C5E417C8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 595B
SHA256 299773fb3061ad725c86ae88bf18ad3a33a5f2fbd998f7349487ee7c4c345c10
MD5 9ad3310ce51d889596608af5c6d195ee
SHA1 22d3c61aec7af9340500d6fa368f2ead1a32ff22
SHA512 5860f060b015c51e18b62f84be528b0f09ff543b1001220ec25820adff35839287dfcc4fe9cb6fba1a8a903927af5be368bcc55338500cb3dbe2cb03b7dec8b6
TLSH
T1E3F0AC5E8211DC8EE4A64BF060734F641A22049A43DB4B9635D08853A9CD1A82E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 fc4034babe9ef9e628e872d39f854ad86dbe4b98cf6fd71734e9ae7384c678db
MD5 61738323ca592ff7bbe9f4eb64f4361c
SHA1 5f7a118d6ae0cdc8ece0f18901b95bc2b04dea77
SHA512 a87ed764cddca7643378895bac480cb945b3c368838d9ebdea145e5eac17976f717d7e11c72a1931bba253d656a5827e9f5ecfd78c0ccf850768fc81d74c3207
TLSH
T160F0DDFB9202DC0AE0759BB4A0B25B04193140164BD7476639A098C3E5CC0784E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 578B
SHA256 4b06b53df602c040ed3f6d847788e86f9e193e63dd6e9aefe16cb226bb124826
MD5 b0b482ffe501b91b4ca638839d49d098
SHA1 b65544bb9b787bd301a3e5e46a3fa9f5b946a676
SHA512 f8db0d92c11dede87dca393c37463fd7827bdcda66d04427f313817676834b59816f21910d767d3a6c1b232d676805b918528d631081b6064ab2b7734f733e85
TLSH
T1FBF0ACBAB901DE09E6B347F920621B402A1E001E135243B639D0C893D68E9AC5A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bkbbtzlb.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe
Size 63KB
SHA256 d10de9f658274194badcb3934184e6fee51e4e111a192a514232ee664e3594ef
MD5 bf7dd86bfde77f2e0acd55a06c4beec4
SHA1 621e70c53361373af8757a203f32f3e5723d96c7
SHA512 cf4f07f254ab9dcecd46dac435c71eebd809c86aa7dddb212b8bb86b5a7a0783f8c46d6a6eb8bd2065f85774cb013d8bf17fd2da5153218bdb43f28f49a33fdc
SSDEEP 1536:mVmBX7HW27Jx+Tc8XSZWT/bMN5c+iP379ihiLQaQd28:vBX7l7Mc8YW7bMk+s35Lik8
TLSH
T1FE53CF8FE1B0FCC3E4FB6D7D478461AEB770A2D925D83548856255CC9007F0E43AAAB9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\VideoLAN\VLC\lua\http\index.html
Size 15KB
SHA256 fafd09abc8d33f454a6a43b419b36d49032ce5ef27e59b56343a74653b604e38
MD5 b471c8ce4d7c9b728d7fc91b1539d161
SHA1 da907e3068d0fef72bbdbb3196985334d8c62a33
SHA512 2989667cd667c8aaaa6371f580c79d663b394e2109b65098bc59abe7d5cfaae29c35276be4727bf8819b4b88ec848a3e7002968f3d217f310bdee5c4c9811864
SSDEEP 384:U2HKAFP1ccA0BANiAnWStiKruUnfpNdypPmF6s92BEvIu/Je:U2HKAFP1RAGST069/4
TLSH
T141625182F18EB63B1611154205BB27A4F27FC93ED340B51EF4BC20B711EE9D8512A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kznjrtew.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe
Size 63KB
SHA256 bd03bc6e9e5f65cd5eab25a8e67f90b4dc29cceecc4a6f216b84c76d9da14baa
MD5 d949817c0926dfc2dc9e5a4d8c24e720
SHA1 46ca3cddba509d513f7b192481b162ff2130f006
SHA512 3f15f594f62181bc1d2185018b8ba45264deba4afb789e5ecd7475ff67898d90fd69b93fca879bedb508b5fb6e02ee8538abfcfa491732f8a42dbf4d3c610cf9
SSDEEP 1536:TO4Tvly71ZlJyjPS6eH1K+VSE/WsSVad+npqkRI4asR8n8i2rH:TXybT87eH1K6StDAmhnRdT
TLSH
T14453BEDFC279DCC4FF9729BC1E40A0AAF2DD124A75D84111686D0EDCE0D526922D93FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 be2444da786629081d966e76943b2ff1aa4e38e21b8410acde01230bac9271cc
MD5 6d265215b6a355657486b9b94b0966c7
SHA1 651049e5ac516ccd57213914b2b0241767d3e86f
SHA512 4e2d22fe68c251295a0e0d2787d5f0ac0dc06114cec6306163f48da0f7985abd3607df1107cd0765673a31209d5967c9c73354ef19ac0bd25b9fd6b6694ee8b8
TLSH
T12C517309BC09DE2D452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 3610e2fc9b60f34e03ac6806482bf4a02c93f64fc5d9dc2f03792c15c88e09f8
MD5 09ead541ab1caa8566f6b95873ec10fc
SHA1 efe68cd78130860c538fbd63ca8676c67a21ed5b
SHA512 ba779f22a924d6efbe799a4bda0dba447084df9d665c17ffc905de54893f8dfbee441a4fc37cefb0e9408e3805aa11e2ec8451cf0594a87a8cffd04af1f7e9e2
TLSH
T1B0517745F80CEE39012044826071E79DE02FDB3EF354F8AEB1BC467F6296AE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 66dbb5626106c321650af0cd5cff2040a1921e118bf2fe634b4223ed841dbfbb
MD5 5a7ecf038c59c002c2531e1b42d2b5e1
SHA1 60abc6e8eb73c8fc4a49b44a140ab6f4f88fbf91
SHA512 73f4ff00f96ff95b7593c266b702eb041646f301f5644ad796189a71117912b48315fba9cee5d506f19782c89ceb5aedb4fbfb5aab8fce9fc28d22ca5928a8e3
TLSH
T1CD513349BC05DE29452004C29572A35DD16BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 63KB
SHA256 ac97d2d662278eec2f691fc2a76e0a4a9f9b3bfffa83b5b10658eb2b943e99ee
MD5 a9d30b598f1045aa5b18db12f3686cc0
SHA1 ae67949a16dea1caa83d826c3f60e770b57dd2ea
SHA512 94c6204965e42b6dd2b3db3c4bd10d4c9dcd39397e453b05ac78b76397da8aa1d7d3aafbb2043d203ecace19b62810332f0b829523bcb86370c320fcd9284952
SSDEEP 1536:hFuGmNy6NSN+kqxZKgaDRJU3PQJIXzrbPnQLTeVa:O/Ny6Ed2ZKgalJUfQUnbPnQL6Va
TLSH
T14653DFCEB510E9D6F4D7287E350862AFA7913C6A36E74205A4D40ADCE4A012736EC5BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-86-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-79-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-15-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-818-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-90-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-36-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-89-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-43-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-41-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-65-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-44-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-47-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-84-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-49-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-81-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-14-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/1608-50-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-63-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-53-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-77-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-54-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-57-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-72-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-58-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-71-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-60-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-69-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/1608-66-0x00000000001D0000-0x00000000001EF000-memory.dmp

Download

memory/2916-80-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/3648-34-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-91-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-67-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-61-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-70-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-73-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-56-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-10-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-76-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-51-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-48-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-82-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-83-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-45-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-87-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-88-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-37-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-35-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-64-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-357-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-33-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-32-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-16-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/3648-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4624-7-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4624-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4624-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4840-22-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/4840-12-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/4852-0-0x0000000000400000-0x0000000000427000-memory.dmp

Download

memory/4852-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4852-1-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads