9c0840843603e091618687277411c3efa322666fbeb566b25f53b0e62821cd7d

Analysis

max time kernel
150s
max time network
155s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 63KB
Sample261009-vtsaeshx2l
SHA256 9c0840843603e091618687277411c3efa322666fbeb566b25f53b0e62821cd7d
MD5 a851fa302cddb32ab8f3b76f53f820d0
SHA1 3a7e80d7664851d8f6a28fac1b762439763d7363
SHA512 d334d02637affe01b7636bac6f9a2cff10b7dd39a26033ac95c7daa73e7b0a941b689d1b9fb82cfeb2f707adb50733ca5ff5652f1e3d9a1e56299042d67b9ea5
SSDEEP 1536:wsnOesaGlimOHeaf5qzgj3GJmMeDwpCjrNEKT67D3:wsOexGOHe1giGwp096X3
TLSH
T16553CFCE81A8B9E1E5E378FE4D4065BAF1A0947831E467822D70CBCE83DC725925D4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5748	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
4908	urdvxc.exe
2056	urdvxc.exe
2072	urdvxc.exe
1392	urdvxc.exe
5748	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "jkzqbjsxrsehsxjh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "sstqcwlzlnqehkbj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "belsnekkrsnvrbwl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "lqsrxnrbkvskkqks"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "zchcchrezwreqkql"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "rcvvexhvqlljrlte"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "ktsbbzjzjqjnller"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "hhssrwnsshwllrbl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "bsrxnklqhlhsehte"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "jxlkewlcqwxrzzsl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "elsxvksnbrkvnnvb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "hbbzrkhckjqlnenl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "bnshjtskblstzrjh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "zwhectkrtzjrbzhs"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "nhjwhcnsslhbetjt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "lnbnseckbkhhztnk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "nhzweblbelbjlkxk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "trhlwklxtxevqkch"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "vbelwhnjwrhhjhst"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "khjcnttrrkhhbtee"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "srhnxqsbtxrnwqns"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "slstskkkecebqsbb"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4908	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 960 wrote to memory of 4908	960	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	89
PID 960 wrote to memory of 2072	960	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 960 wrote to memory of 5748	960	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:960
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4908
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2072
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:5748

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2056

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ltsbrnkb.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe
Size 63KB
SHA256 d69c95b3839cf2e9542ab2d193bedf26e137fae4765a54b88538e791c67543d3
MD5 3c147bcf776de7385f879dfda4b6422e
SHA1 6bfb7ca0ddf23120daa2e75d340db3a38b48091d
SHA512 a1f599c92a6733b9fc7d0b25a487d8d5cdcec97e4ca2445310cbc87aef63db7035b57ba64a063d43de5e7500fdb3b56d59ab77820067e243d10027cf6c11e799
SSDEEP 1536:kisp0Byl5tSx+cILaHgdk/rvfJ/vyNza2qtENaF1a5drKwFL:kispShqaHgdk/9/KNzaik+PrKwF
TLSH
T16453C0DEC257DDD2E6AF7F35510B60E8F364350C32DCAA2658688ADEF1C110059CC9AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 a75b341c8fd6f80e845643209cfdebb28fae8970ad1ca845f25e14df5ebb5114
MD5 f231cd04c77f2a4cb55327e2c8cadcea
SHA1 b14e21b7418ba874436bdf18a0800c66d9989ba8
SHA512 ed23fcb1163cb40dffa9449e9fa2dbc78f09cfa285a1434ed6d5d3353cd32dc80c7ecb5706d3f5cf08a6e1be72d08bfc0c14f0752f9d6eb0274ae39218683992
TLSH
T17C11E2EBE9E4DB12B76051E351E469D47BA982F51D63C84D39118202D080E35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 19e1c1ab82567c764ae0e79e4bce4376fee0228f3e5c063eead493dc66629961
MD5 9f71d576982898e3292c41d91a44a33f
SHA1 e97cc1b2aeca38c9c6da513ad6ad8d63ed5c87f0
SHA512 39952800c0268e91b4842b028188309151d599b948bd2085f752205bbb2654ba92df14c664b3f7f09db5cc13a4fda581bbf613f6a3eece1b9a3d950e2f810c85
TLSH
T1B911E2EBE9F4DA12776051E312E46AE47BB941E51D63C8993A1192029080E36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 654B
SHA256 033773d3d6f806730d1014b9c33f39dd9ccd55c1e2802bfd61b127d1691c138f
MD5 16ae85ee2ddc74c0d9422d394fcc9f53
SHA1 366f8ac940d521adbca6ad2ec6c3e1d5747e0ee3
SHA512 8aff5a9c9b22aa4294a42d8dacb0be1c9512847075011aa4561857038e130af44cc0d1ba92f707e4f6d44247ca10f572177863f8f14de7ff59fd0ffce7d85391
TLSH
T12BF0FE6ADA40DD09D5B20EF130769E143516045A47A787B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 f26cf5bcc8c73c4fcf70faa4bac6a8a525ef4f947a7a247c1fb804512e7bfb85
MD5 9eb1fad1d796c2f4dbbc9ea9f07dc2a3
SHA1 9781543d025e548ba39dff09d39fcc4184943a9e
SHA512 5a05cc60ac7874dd1e3a4b42c410608b17e0f31a6988bca7d091f1c0068c07e16221690a08c2c62680f427c0e59c8089e7f1b0112d7f8752aa7e0fd1018e02a7
TLSH
T128F0E1BFA111DD0DE5B30BF464766F801A6A001A07A28BB138D1CCD3DA8D47C9E053C8
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 611B
SHA256 a6c288b90aff6966455456669d581a3ef5eee5961904017f01ba1d5305213bcd
MD5 e40d5cbb486250b4371b5ef776f2bbba
SHA1 4a956f4841bae78fd718de3594070fbf9f4c90f9
SHA512 06888b0a059538bb427b57a633255f6bb69334211a1d7589f5f279676e9be5de78273c9fcdee4f2ccde47198966ed63b655759284b71bb2aaef668a4e0b80982
TLSH
T127F0026FC342DC0B90320AFC11736F20096624124BE6979636E19C03E9CD93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 772c223ed38776e855cd1387321cf959c70ba331512e5d340b4ae4860bdd6e51
MD5 ef356e3f35825f9886673a630f3604eb
SHA1 344a05040351b6cf177abff4af02900f673f10df
SHA512 13491ddb52b5e21259db0f968942c50cec517520812c6d7cac1eb35a646e87040833befd330dc89e5fec5b483e4ee3f04908dd664ab62c4811baff472086ebb1
TLSH
T158F0027F6705DE0ED27357F010231B441916046703A593B235D2C8C3E18C1AD1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 579B
SHA256 7e320105a13421ac6e1604ae3529c836a8c4468cdaec63025c62940fc559b9ba
MD5 e6f07fdc18c9bf2480e04b8f67fe908a
SHA1 e6bfe8a5432d88127307b2da30c51ed4f5cbe54f
SHA512 a68eeaec1340931916df1faa37011061c770edbf8efc62b33bd948c19c60a783d7cef2061b521dac6d9af98119cefc3dc3c735e8d0fd261fea536b2aed69bd5e
TLSH
T1F8F0A2AB5201CD0B92B20BF531B25F641A66043603A62BB235D0888395CD06D6A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 11938b4f3c0a54a5d1e02466eddb4d9c6ae55188d693e5def514cf724f657b8a
MD5 d811a36206c50574d1a9a2f06dd7dedb
SHA1 93c6f957b8cb629760be61cb4a9d39bb05d6e7dd
SHA512 d070f3481116fcd396a468a7938f2264a3f5c5a9fd348903ef11967fc04f9e69c77f10bfc7ea250561c181f2ca46aee26cdbd4f387e432e7be2ce227639ef36d
TLSH
T149F0E1EB6301DE0EA5B34BB03536AB8825D6037A07E64B273D518A93DA8C43C5E41BC8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 595B
SHA256 823604421cf850090df8d640ba0343d094357665f35e86190aa4943dde0b96f2
MD5 24e57aba034c66821e36372d20e435fb
SHA1 82eff55f2ee88c1784cc0e2ec691ed4ae94dce81
SHA512 5bcebc6ad8c94dce1d2ffd20f39c5c125bdd94fa2440124171fd07fa1a652526999ee49d0b25f4dedb76c2560f4342f349cd9e4076dd0c1fcd206a0863eb7288
TLSH
T1A3F0AC5E8201DC8EE4A64BF060734F641A22049A43DB4B9631D18853A9CD1A86E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 69545ad571c9947fbbcafd02cf071b2d12219e0193247bf2c8dd8e105d088f2b
MD5 cffcdf1af27f626dbf82e4440672cf2b
SHA1 df51a31167a4ebbfc350e98359be2348b9011b90
SHA512 e14fd5908510d062e5e33ababf49684cb99346f7bf4e79ca1ab88697ee9f73a3cd2cb50ba24cb37a5990c27cd1d1d582c176168909b0106b333d6d27315c6b0a
TLSH
T147F00CFBA302DC0FE0769BB4A0B29F08193140164BE78B663AA098C3F5CC47C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 08e4798d998c1bbf970a62fdfe0c6bf011f9b4b2282ec3a0afe6e9da113fb775
MD5 3cb3920751f5de5f6b0ecd20ca2db014
SHA1 af3918b5139f289c9d257bf8ec41ad2343c7fedb
SHA512 939b0bbf45eb2fbd7d2741646a01b26df69fe2b917c7219db8faabf1b2dadc7312d222ff15d95ba4b02a84774ed78f29c8f12a73f43c4b4a5b49b0d0f62659ca
TLSH
T168F0ACBEF901DE0AE6B347F920A21B402A1E101E135243B639D0C893D68E9AC5E867C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bkbbtzlb.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe
Size 63KB
SHA256 d2394ddabed9135da35685bedc9db85e75ae051f03a62779dbcff30c1dd551ce
MD5 cf9825c29f819118e25a77c4c629dcce
SHA1 cf66e53772ae8c5845f75a86a98145b266930b7f
SHA512 a82bdcdea3c50fb4858c3edaa638758700b1c44793b8afac3ce5c45d6c7d671ca41b37413b8aac9169ccbe7f0bcd7b2a0081c7f3c26447442a8d9908817421f4
SSDEEP 1536:6CkdLu0le0hpyUsLK6EqqQ4YKsRvx0WPAfebVuBusH:Klu0le0hp9CEqqQ3DxBPAfwousH
TLSH
T18F53D0CAE710EEC5ECDF28BC588EA0B9E268F4C9F5E812514EBC5FDC9094E1059EC149
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\VideoLAN\VLC\lua\http\index.html
Size 15KB
SHA256 fafd09abc8d33f454a6a43b419b36d49032ce5ef27e59b56343a74653b604e38
MD5 b471c8ce4d7c9b728d7fc91b1539d161
SHA1 da907e3068d0fef72bbdbb3196985334d8c62a33
SHA512 2989667cd667c8aaaa6371f580c79d663b394e2109b65098bc59abe7d5cfaae29c35276be4727bf8819b4b88ec848a3e7002968f3d217f310bdee5c4c9811864
SSDEEP 384:U2HKAFP1ccA0BANiAnWStiKruUnfpNdypPmF6s92BEvIu/Je:U2HKAFP1RAGST069/4
TLSH
T141625182F18EB63B1611154205BB27A4F27FC93ED340B51EF4BC20B711EE9D8512A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 e9ff3b8538706c51c79ec63d976e5dc355b4d22e998efae2cee5895600d25ff4
MD5 cabeed3503e8ff688c8435b33d5755e1
SHA1 f15605f9fd57bf34f7e437dc1258d456ee54e327
SHA512 22600e26439da9a8400a2044353839e176c7d8005ab53c319f4bc70b9e6fed032c6b73ec7fe82dc59563217d9e2241f38f444e4cb0b0ba2d0e2d613fc75388c3
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtlE:6kEfytgP8qmrtfPFLhXv/j/wL/Rj
TLSH
T110B14685B489AB360311064251B77B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 465a41d6193c5f20310f092f20672eeef3f74d1901118ef0e80d3b662bdaa588
MD5 21528c849bafe03f7209212421517c64
SHA1 7840467da9468ad42dc22541661c45d0d5d6c710
SHA512 72df9d5530d6b8f375ebc27d9569c9851ad4723f12e3ae6dc199931304bf670b66874bec9b066e3603f10ef68b5c6db0e338d4c76ac3b9faf1f1ef651f6f76ea
TLSH
T1F5517745F80CEE39412044826071E79DD02FDB3EF354F8AEB2BC467F6296AE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 8c76541c1fbb926e4bc036ec9ab1630b3262d3f6ecc46762bfdecc5b007bef92
MD5 ebb0eea70000e8116917d79d8983d3d5
SHA1 9eec83cf41358e65aa687c5ca012f8b61c32eebc
SHA512 6342f9a91c690af62873c083c832bb27cd171e4090ca2eda3f22242b6850425f323fd51518c182de8c45fb7886994a7136b86502f590cd16880145a6319e1442
TLSH
T16251324ABC05DE29452004C2A572A39CE16BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 63KB
SHA256 9c0840843603e091618687277411c3efa322666fbeb566b25f53b0e62821cd7d
MD5 a851fa302cddb32ab8f3b76f53f820d0
SHA1 3a7e80d7664851d8f6a28fac1b762439763d7363
SHA512 d334d02637affe01b7636bac6f9a2cff10b7dd39a26033ac95c7daa73e7b0a941b689d1b9fb82cfeb2f707adb50733ca5ff5652f1e3d9a1e56299042d67b9ea5
SSDEEP 1536:wsnOesaGlimOHeaf5qzgj3GJmMeDwpCjrNEKT67D3:wsOexGOHe1giGwp096X3
TLSH
T16553CFCE81A8B9E1E5E378FE4D4065BAF1A0947831E467822D70CBCE83DC725925D4CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/960-78-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/960-1-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/960-0-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/1392-83-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-60-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-22-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-907-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-84-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-80-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-38-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-75-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-43-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-44-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-74-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-45-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-47-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-71-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-49-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-70-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-51-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-68-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-66-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-54-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-56-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-64-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-57-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1392-61-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-72-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-35-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-62-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-58-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-55-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-63-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-65-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-53-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-67-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-52-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-69-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-50-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-48-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-32-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-73-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-46-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-37-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-76-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-7-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-36-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-79-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-82-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-31-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-30-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-85-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-59-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-86-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-386-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-34-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-29-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-28-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-27-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-26-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-8-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-24-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-23-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-21-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-33-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-19-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-12-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-17-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-15-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-13-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2056-14-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2072-18-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/2072-25-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4908-5-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/4908-4-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4908-3-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/5748-81-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads