289bb15a5b6feba2af6bc29e757136f1b0f50a18466cd54b70f5904eba8293bc

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 62KB
Sample261009-vtflmasw2n
SHA256 289bb15a5b6feba2af6bc29e757136f1b0f50a18466cd54b70f5904eba8293bc
MD5 145a2cb78e18c73df562a94e8bcdf0c0
SHA1 02ac510b55098e4c24f1aa2c73c4f05fb86166cd
SHA512 94c2b47217f7763df58885e1a503ae6c9ad4cf9c38a865bd8082d20ad852704974e013575440eeb20e54a2eb7f35758f5bfa323c23055c3c826b0df957c772df
SSDEEP 1536:jhQXKOOQ4QzyXqxOrHPyUtdsP+83Cfp4Vj9FuYMCB+Ac:QXD4QzM0OzPyUXcE4Vj93lB+Ac
TLSH
T16753CEEF80719FC2E9AB283D1D03397BE405408939F86985BC650BEDC8F4B5DA6DC958
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (680) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2976	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
5928	urdvxc.exe
4068	urdvxc.exe
5412	urdvxc.exe
5668	urdvxc.exe
2976	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\ConfirmUnblock.htm	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\SubmitBackup.htm	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\SubmitBackup.htm	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kzvjvbevlsjkhwrt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "bkrsksjehjleektx"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "lbxcblkclezllnsc"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "lhrkslecqqlbhwtj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "tqznhhrseeclzben"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "ctjbjcjrllththrl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "hsthjkwbtkjjktjq"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "jtznqssntqxekkrb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "snztxkcrcseqnlll"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "stsekwsrttlnlwle"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "qtlejjxetkcwjbkq"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "lslestjrwkrsstsb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "jhehblrbwkrkwssr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "kshsvvjrhrsqhqtl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "njzrtlsnhcsvjtcr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5928	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 5928	3048	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	89
PID 3048 wrote to memory of 5412	3048	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 3048 wrote to memory of 2976	3048	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:5928
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:5412
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:2976

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4068

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:5668

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.html

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html
Size 3KB
SHA256 d98178e06fc4484478d554add70548ef7294eb55680b0e87b36df65e8c5cf522
MD5 8052fb4fc71ff4bf9ff63fe9241f0dc4
SHA1 60d40ba86c25f068d9518c0d425c231e47e42877
SHA512 bb890ce92858777496d3762882f0542055017257221345c63a5a5fcf92f630920479dd6058a663b180054bb1a26f1ff781b95d696d589d56c6516213eae10655
TLSH
T15871662A1D169C39723292B4F1129248C752C55BE79BCB7070EC016F2BE0BDC49976BE
MD5 SHA1 SHA512 TLSH

Submit Download

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 662B
SHA256 8c657bbe1f780d0353d38928d3662e9563ee458128324b91bed4b101114bc3fa
MD5 2a64cb93f5db04b0158f2acf745c78a9
SHA1 45d8b68c6eb1c69bc8976d8a567d2ec5af3e8799
SHA512 ef0b9c7298c1af5d8ef280c7ef613aae40381b61c72f6b421d10b5b6efcdf63cf550c5aab67e2fe78a9b13bc12cf41c2f92d5b34ac0dfc2163cdd9fe8c0a3b4b
TLSH
T13E01FE6ADA40DD09D1720EF230765E143516045A47A787B23981D883E7CD5BCAF467C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 7868dcf34a2a1950a0de0d1deb1263b2a95364143800f8e4b9ae6031aa832cd9
MD5 33fde251dfdd8be9687dec8a5ebe7733
SHA1 7152d2f955fd4ae4495b9d6c7d3c735ffaa8d815
SHA512 d8c5c2d95c1eedb958cf34f838f17a0443e90f39fc9870bce4b8674bdac7481a74e82376f075cb328a371d1e0e5ad4b1c4d43c2bb6b6d07889ed398559c1bb98
TLSH
T1FEF0E1FFA111DD0DE5B30BF46476AF801A6A041E07928BB138D18CD3DA8D47C9E053C5
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 622B
SHA256 3149be96e5a2303ecc36a1f12e9929feac9e77f8322c7c995328a9abbf5ec12f
MD5 89540743dcfc74e0a7f4672fba274801
SHA1 2c599e9835baa8b4b1d363f8f8a29044b25c7a96
SHA512 e75c2e45d2476e2f3af24e5f4a80c60805909fae20363aeb1c88228f919355680a635a49a1297a910ec8eff7e04a1a1cd94016297bca5b51d049a0592a7bf93d
TLSH
T1DCF0026FC342DC0B90324AFD11736F20096628164BE6979636E19C53E9CE93C5E8B7C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 90c4807777d148ab0b234124ab7e6fb986f4ab6466207643d87c61e562a6cc37
MD5 b2cf90172a311a160b465a2b3dfb4d77
SHA1 e25a51fa77b10b077a6144d9bbf1cb61db78fab8
SHA512 f298516b4a5ef2e58bf9979d882c9ed2fc753a8bef73160491e33184a31b2f011b79221090a0047e850a063a8e0b88d048a1935295c6b35fd4feefdacc3d5409
TLSH
T1BEF0027F6706DE4ED27357F011631B442916046B03A5A3B235D2CCC3D18C1AC1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 a13ffea84dbefd28b736b92e7db5d0befd07309487603d5c14adb7421a47d37d
MD5 8b6e93c98a2382a1658261601774e69b
SHA1 9b40f451c9ac19aee18a44eb2fff92d9c98eef21
SHA512 26361a9c4f8d1ade9e341e99f0e4fdfd3172b09c2844bf183d395be8116e18ee76bc9454235f8e9e082e5db4d2c9d39623de23a2385c876e580411389bd1fdc3
TLSH
T131F0ACAF9205CD0F92F20BF531B25F641A66043A03A62BB239D088839ACD46D6A4A7C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 39b46ff791bbd50cae58f0d3337ea818cc3f525c42ea37c4493e324c3189c609
MD5 712a90c30125922bfc9ba61cb30ecef9
SHA1 4314af2be2219739264ff43ff3d062b3992287ad
SHA512 cb3e5d43e0993aeea95d18d5407346445836472d393825ecf59f0ec763ef28d9b1f6562a9ca0920f16a451baf0002d49804a9560cf56ca3c8db55871e02d4fcb
TLSH
T192F0E7EB6301DE0E95B34BB03535EB4835D6027A07D647273D518993D68C43C5D417C4
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 595B
SHA256 b4bd11b4c6e500c387ca4138f1e02854a3a787085f98349faf7c3da809fb2a02
MD5 5b301ef6001ec9f06e65213d539dd332
SHA1 6b3b192e5527693993b2ec5a35994a7fa9f8cd51
SHA512 d0adc97f7374983b5137a69a6223fcf627ccf2e7f0a63f9be4741a323dce4c6f08498063e2762b505b49111dc8e2b7c4b4d14241103ed42799753969eac6a3cf
TLSH
T1A7F0AC5E8201EC8EE4A64BF060734F641A22049A43DB4B9631D08853A9CD1A82E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 622B
SHA256 d5ffbdbd784bf5cb80a3960b71438f5bcd725d9d82747b50e92f0c99db97b305
MD5 dcdf8849ad3c55e3e72e0f570a8276ba
SHA1 e417764205b12fe8cab70dbb0c436b15dd78defb
SHA512 b7af54002a114d416faf49a59be64001160ce22bf90e553b418fa1f537351f8357ac1fb623858263e32e19c2aa96ed39b93b4dbb81b1ab7a8c37c19f43b2ba0a
TLSH
T191F002FB9302DC4FE0769BB4A0B29F08193144164BD74766399098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 78dab3b0a7fc501ad9bb2526f78b4ed137689e7dffd59eede7e5b4c5cb7f5a17
MD5 b2993d702753aa2f7505bafab767e113
SHA1 294fbdb5f4d62192535e888e5fa2543aa33d0391
SHA512 ad5203d8515554e578682d1df5576c336fc7486f128c187bf3d8da146e77d9532ebbd8e25e9f3da2688e323d85d6d3d5e0542eb416b1b0d1a9c6e3ec05cd5f8b
TLSH
T1ECF0ACBEF901DE0AE6B347FD20A21F402A1E141E135243B639D0D893D68E9BC5E867C5
MD5 SHA1 SHA512 TLSH

Submit Download

rvhrjtnt.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe
Size 62KB
SHA256 67189c8bdb9c3975e502107ef8ba1fcf95e13b6dd073be6d82896d135e4eb237
MD5 7ef744befaefb3a6f4f1bd08581f81d1
SHA1 d780487354f2ba6eebbc905a8cbb0316010867ae
SHA512 a083db9b79385bb2c8c028c7d6384251ee7fb2ecf80d1ad2edbb2080441567e51f2fb25dc735079e5e2a4eca170523d292333a33d042786e7bffe21111ea060a
SSDEEP 1536:xIzccreR0xQCqxIdZ6/MLSAN9FYIipq6T6KrEnw+Ib:+ccreRY2IdZ6/MbFYXpqnnVIb
TLSH
T1CE53BFDFE63C9C44FDAB293C2319E43EA2F9799D31F6119DAD100AED84C452562F82D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\VideoLAN\VLC\lua\http\index.html
Size 15KB
SHA256 27d213fe73fccacb37741ab93f829a95a2372ba40c253d8b835d6f9bb9724f9c
MD5 33367294a83a2cad6f1d085fc7917e09
SHA1 2971938089dd978f3120d50274a1b68264a51a50
SHA512 0b0370e6bf56cba46a569c74275531743b598cf3ae5f95cdb0de9d696e4253ecc811adaf43c7bb7de69c563c4495b81da406942c3a6a7619491881ee98045721
SSDEEP 384:U2HKAFP1ccA0BANiAnWStiKruUnfpNdypPmF6s92BEvIu/Jl:U2HKAFP1RAGST069/3
TLSH
T168625182F18EB63B1611154205BB27A4F27FD93ED340B51EF4BC20B721EE9D8512A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 e4f050fc09989370129abccc9330bf2fb7f8b81e52893e1660e5bf4c75b80c29
MD5 6ad2464e37d360f3368122a5498823f4
SHA1 47019af6a1df5ee0ef8d08666631ac971571302b
SHA512 3c714952f75a5e93bbe89e84633debfaaddeddcb5434a4bbcad07838bd13883cdf8d44ef23402fe37eef95019b76028281121785eb23bb0bc76f39e8c9838755
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtlL:6kEfytgP8qmrtfPFLhXv/j/wL/R8
TLSH
T10FB14685B489AB360311064251B77B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 b9b38efbaad893e5e3f67f4faf96a1d3985af5c05011441ca020d9090d2d8760
MD5 0f7b069aef0a857bf557c92daee55294
SHA1 a2c8f0d8c274763312ef11d56eca0b738e36052b
SHA512 d46f79558fb5f51f62f44abe988b1032649909295ecc589b523ab47bcd3e04ab1fc9e977e7f3c9d920302142868fe6e45bf06e7acecf764607d1bace8f73b791
TLSH
T1B4517309BC09DE2E452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 d99cce2974bd90ccb19e9c4e6c33c364b6cc78dd0586ff06c61da1f0251eed83
MD5 4b38643940b3508e9a98b2c23ab84dd4
SHA1 39d53823dce2b9cedd4a032324dfcf614b33100f
SHA512 139e8c01bae7b3daf73a713fedfe4d2b88ab7061d98e0ab47b4d76226861f4db9557e6cb6eb7ce5b36912c3dc14513af8aebb6ae0bc749c5fc8a633b1a00815e
TLSH
T1B1517745F80CEE39412044866071E39DD02FDB3EF354F8AEB1BC467F6296AE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 f1163840f9469b99875b6022c048dd65cb69831a296aac20a6eadab6267bd219
MD5 2831b6290a8b96b8a962343970bbd3be
SHA1 b3f89afdcdf50931eee8e59ca08dfe66a88146d4
SHA512 69ed451548572deea8f15833293ee59e3a364bb61ee983e1e07de2896e5a561bdb0241d972b212d23bd5a61cfda82a116dc615db515f067eda7f868f42faa3c1
TLSH
T155513349BC05DE29452005C29573A35CD16BDA1CF398F89EE19C617F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

vlbvwvhv.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe
Size 62KB
SHA256 8c54b7e68a3561dd7e4e063c8a8b792ce52afddbeae2eff9f24cb92d3dada752
MD5 f6f5b8be76cc691c99388eac9e314614
SHA1 e96e74616291ccb647501410de8e5e5b2633d6f9
SHA512 830725a29426bab0f0e4c1a1b4318fb69f71ed1b688727162f971305dfac056c4ea33cc9c14eccc58afedf8cff294fc57df146347b1409a38021496f8d232f3e
SSDEEP 1536:z3Of1V8NqUHR50Mx10pi/3Ewdu0S8mAq30gskaYJ9qR7:bOf1s/0Mz0EPEwdmA27aYKR7
TLSH
T15C53C0DFC5B0BDC9E83B147C0774F065F9ED8D1956EC00061A305FEFE09962BA588AA5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 62KB
SHA256 289bb15a5b6feba2af6bc29e757136f1b0f50a18466cd54b70f5904eba8293bc
MD5 145a2cb78e18c73df562a94e8bcdf0c0
SHA1 02ac510b55098e4c24f1aa2c73c4f05fb86166cd
SHA512 94c2b47217f7763df58885e1a503ae6c9ad4cf9c38a865bd8082d20ad852704974e013575440eeb20e54a2eb7f35758f5bfa323c23055c3c826b0df957c772df
SSDEEP 1536:jhQXKOOQ4QzyXqxOrHPyUtdsP+83Cfp4Vj9FuYMCB+Ac:QXD4QzM0OzPyUXcE4Vj93lB+Ac
TLSH
T16753CEEF80719FC2E9AB283D1D03397BE405408939F86985BC650BEDC8F4B5DA6DC958
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2976-70-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/3048-0-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3048-1-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3048-67-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/4068-60-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-26-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-7-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-11-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-17-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-18-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-42-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-16-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-44-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-19-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-46-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-20-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-48-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-22-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-50-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-23-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-24-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-52-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-54-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-25-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-56-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-34-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-58-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-27-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-33-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-28-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-62-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-29-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-64-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-30-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-32-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-31-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-325-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-68-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-83-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-72-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-73-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-81-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-80-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-76-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/4068-77-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5412-21-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/5412-9-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/5668-53-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-43-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-74-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-71-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-84-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-85-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-69-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-608-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-65-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-63-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-61-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-59-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-57-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-55-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-82-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-78-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-40-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-79-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-47-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-45-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-51-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-39-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-49-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-15-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-41-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-75-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5668-35-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5928-5-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5928-4-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/5928-3-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads