c60ece6a2c7dac358382799a8b9b94d4100a0f3173f79640acd4ea14d71df5ca

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 139KB
Sample261009-vtygfada85
SHA256 c60ece6a2c7dac358382799a8b9b94d4100a0f3173f79640acd4ea14d71df5ca
MD5 a78922a57f5ade8b65e3b9e1362de970
SHA1 579a84820d0f50c2678415122bd5c39680b5462e
SHA512 f4532ae4b2a0789e7dbd6947509dc62d92b788b2d0c034f0e6932ba97f22b3f74b75001bd672a114f9e6c7d3112925c76cfa317dc1b65a9bc6bdcba731b91a97
SSDEEP 1536:uN6/6nEkisWmunXDdH5teZBaKDkexvpV49asU/edhZKz/U8+UQyEKCUNrHPh6:otnEnBXDdZtYoviAa5ekTEFjKHPh
TLSH
T10BD3E0DE91284D80E4A37938243972FEFD91BD04A1D91515AE3447DAFCC8F383E98A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5380	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
4464	urdvxc.exe
5156	urdvxc.exe
4964	urdvxc.exe
4628	urdvxc.exe
5380	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\NewWait.mhtml	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\NewWait.mhtml	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "hksjjtteekjjhnvl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "sslerbehetrkvctj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "vkbbjtnnqtewezbn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "cvcewhklktscktlk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "hwhjwezlthhqvxhz"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "qzebrxejbbssbntj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "vwheljlrwrskvbrk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "vnejhnrntsnhvsbs"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "vqhsenzbjtbelbxt"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "ekwbkkhsbjrrsbjn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "bsncnjkxvekwvbtn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "lxkbrnntrlsrtste"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "skntkhlrcshtsbrz"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "eesqhwhskkseqqcj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "lhskzrnxkkervlkr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "rzzjjvjkknnletsk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4464	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4464	1808	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	89
PID 1808 wrote to memory of 4964	1808	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 1808 wrote to memory of 5380	1808	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4464
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4964
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:5380

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5156

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.html

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html
Size 3KB
SHA256 bc3f640f3b95d98fcd9ea00bf3a68eb8c53c0e7954c3ede94182954048e26bc7
MD5 6ef6d1cfb8ac3a39b5ea9d8c2c6765de
SHA1 7be4a9fc2b3bac1646f7f5b30b06d39692a43271
SHA512 b1af57b1b92a0116a895b203e2a92bdba041148a2116d2c90b0ea5d3cfcc2fea54b22103aedb12f75380495906066ee0fba41ee8382f295b6689a1d83d1b292b
TLSH
T1F971662A1D169C39723292B4F1129248C751C55BE75BCB7070EC016F2BE0BDC49976BE
MD5 SHA1 SHA512 TLSH

Submit Download

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 5a2d27a1b680b15e0f126b86eaa0a0588fafb5945ad3794b339bcee7249c4a6d
MD5 6fdb4af867187d03032c48d0ec9ed294
SHA1 b910f61560dbed22217eda7afa843b71d06be1a1
SHA512 89bd92eb5cf1886bfb59a339acd33ba04bdecbce45d723567cba6771a2168262800450d9afaf3824fcf29cb766df47852be3a53aac343f44e0b908176bd4adf5
TLSH
T13811E2EBE9E4DB12B76051E351E869D47BA992F51D63C84939118202D080E35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 652B
SHA256 b6f240d2da4288456fd9161836412b9b9b8203b38ee27de89e1984c2209c728a
MD5 69b373636759fed8698e568fdc8584fe
SHA1 86f8f7dd69ec79a6da2648315cd7714a69de243e
SHA512 b64e4d03459cd23b5061bd9b181555de65096cb3f1650740990695a0c85cfbf360a4aa46bf9c0c07351b0bea18976eceefdecd0f3e4ba237b50ee5ee22cdf982
TLSH
T141F0FE6ADA40DD09D1720EF130765E143516045A47A787B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 587B
SHA256 2301731ea018f36781ad65f04042408f60b555ebdeb6e29e7471f7649f4cbb84
MD5 0abb7447d589372f1845f40ee0ad7cca
SHA1 f080f1eef12e7873f97dfb2a88c4eb6657105486
SHA512 3f3d05358c9a5c899e7821442e00729a2dc2c6d14ca561b025b2b15d50eda8b2798987d51140d22385506393b1ce8cfd86f46cf86c7e49259ff2263f4efbaca9
TLSH
T1C7F0E1BFA111DD0DE5B30BF464766F801A6A001A07928BB138D18CD3DA8D47C9E053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 611B
SHA256 a6c288b90aff6966455456669d581a3ef5eee5961904017f01ba1d5305213bcd
MD5 e40d5cbb486250b4371b5ef776f2bbba
SHA1 4a956f4841bae78fd718de3594070fbf9f4c90f9
SHA512 06888b0a059538bb427b57a633255f6bb69334211a1d7589f5f279676e9be5de78273c9fcdee4f2ccde47198966ed63b655759284b71bb2aaef668a4e0b80982
TLSH
T127F0026FC342DC0B90320AFC11736F20096624124BE6979636E19C03E9CD93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 8ce128ada92d16b64e5faeecd23bb7a822e0ac75695e4246a951424df5a7e553
MD5 7965fdc08dd41b17bbba305ca9c7878f
SHA1 ede5077f40682a85ab3f0eab6b2da37a21aa5d77
SHA512 ecf0ae3f0114d337b1a8d25cdf9a75f638c070c55bac263c86ded05408b84b6208654a3228641800e8891133cb6f7771ab451a97cce2984ef6504d87e13e47de
TLSH
T1BDF0027F6709DE0ED2735BF010632B442916046703A593B335D2D8C3D58C1AC1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 bf83dcc1047515b4b7350ab508608ba9398ba1f195f1d880744048b6f75053fb
MD5 bb33adbfb7c407192db6cbf9ff375d43
SHA1 0d022d1bc46597c24ed516a7a7dd125b96963c25
SHA512 fe7ef9cf90313e51a0a7184aa7563b1e3ade97999116895e8d2cd7ee2104ab58a5b978854f3690413ce6bcaa293556a15495c95505382be72b34d8ff7b64346f
TLSH
T1E8F0A29B5241CD4B92B20BF531B25F641A66043603A62BB235D0888395CD07D6E4A7C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 590B
SHA256 69180e95536522e3f38126a8dd0b9248a29d23314f7eed9c56edacd8c2d90e6a
MD5 f89eb0f0402a9262a44a7675fc20dca4
SHA1 8851a58e7766c72d56e2429a0afa5502554b7d89
SHA512 f1e40b4fa538888fb2327665ac1b0de0ac7e7351873e66541d7799a0a34f12ff09bc441eefa1727c3daad56d2584a6b00e6fb2c45b1271f6ea23d3de2f2eff42
TLSH
T1DFF0E7EB6305DE0FA5B34BB03535AB4835D6027A47D64B273D51C993D68D43C5D41BC4
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 595B
SHA256 d1c3b5f8ec2d7aee99e513f2d40d4a82a89ae225cd549455d1a97dbaddd3bf05
MD5 d2886e3e1e51e0df3180be40c3b84a15
SHA1 c22f4b76846095752e69ef4c23512c2b6f9fcba4
SHA512 f5dbcf5d5aebc7fc2e141fa6eecb241dc0dee506db404d214dfda8c07665a55698e1aa6a5973f3f1cab4fb34fdaf8a3ef1fd6148c45dded9644bf8ee4cb3158d
TLSH
T1B5F0AC5E8201DC8EE4A64BF060734F641A22049A43DB4B9631D08853A9CD1A82E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 83f5a764ed628525b2ab017568b59b754bb88c9d436b406596ce14024bac4e66
MD5 7d7a1f04f7036a59222e71ea6efc74ed
SHA1 8eefe81e4a23753886b0010a6ff815a322f28943
SHA512 2fbf2f1b7c22e8c5a6459b382616b03a8aea76f725c630c8a5421ed42720157a16a50af1dce94b8c0805bc48f54200a7810b89ec2c5ee9377bf38de534a57701
TLSH
T155F00CFBA302DC0FE0769BB4A0B29F08193140164BE78B663AA098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

jblhnrhj.exe

Path C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe
Size 139KB
SHA256 7ab1c8668434b4e2215f782d757449b28b96c706fa5d276e226691f85ce61ef0
MD5 b823528eca1b421012f3b665d7cf860d
SHA1 0b5de19debe01bddf30d0d7a6e5ec608a1dab069
SHA512 13e4bc1b25fcfde47a50595b38b81c062a40a7fbd2574a311487388da26df691894bebff11abf317e24bbeb563b2c577caf84679621a51663c7b1b5901b7264b
SSDEEP 1536:eIyzkZjpuD9DSYQD5L9TsaA5KsU/edhZKz/U8+UQyEKCUNrHPh6:FXZjQhmhpHAo5ekTEFjKHPh
TLSH
T16AD3F1DE8450FDC1F46339FA2D49B0BEA631682832D67B154D79C9E9C7C8A28171D2DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

srselhtw.exe

Path C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe
Size 139KB
SHA256 43a7b31f41db51500642f390d5ed15affac02df8a6a26e75e179038d5f4a4b28
MD5 5642317e3aa83f4b8de0b849c9cf5cc7
SHA1 7949fbca95575ff74b322261dd9bba3e6ea791c0
SHA512 92ff4ef472e2d1df4c7e33e544bb7a5e75668fcf0bda94ae799e01a178515c859a33a8dd61c69f7de473471592ef0c78a00c21e3219ec3887934a8f1303f3d1c
SSDEEP 1536:nhnPyTlX4WfDfbkZ4JLzUstcdfWxsU/edhZKz/U8+UQyEKCUNrHPh6:JPKX4yvS4JLOdfE5ekTEFjKHPh
TLSH
T1BDD3F1EBA024B8C1F8B325BA2335FAEFA56EAC5470DE00571A791CD7E4C0667274C529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

rvhrjtnt.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe
Size 139KB
SHA256 ea45eb2a74a7a927a6226520ff93d06f311eee0c866f0f5dffa219632ca8bc32
MD5 f45951ce4761c5bc87f99fbe63b64bee
SHA1 8d75ac025e1905c1465f4250e642e0f551fb8d09
SHA512 14f2404fc20e677689948e2f5982dd95320edda6f0c09c3d61bb0e867a859209c9dde5941934e9ed76248a61932f752e31fe46b1950763397f31ea63695cc30c
SSDEEP 3072:ZCT+0TBjMcyJy3ZEGySiR5ekTEFjKHPh:maJgZzi7eUOjKH
TLSH
T1FAD3F1CEC730DCC3F48329BC3229F2F6F5635642B2FA543469B694ED9480AA82B5D549
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\VideoLAN\VLC\lua\http\index.html
Size 15KB
SHA256 fafd09abc8d33f454a6a43b419b36d49032ce5ef27e59b56343a74653b604e38
MD5 b471c8ce4d7c9b728d7fc91b1539d161
SHA1 da907e3068d0fef72bbdbb3196985334d8c62a33
SHA512 2989667cd667c8aaaa6371f580c79d663b394e2109b65098bc59abe7d5cfaae29c35276be4727bf8819b4b88ec848a3e7002968f3d217f310bdee5c4c9811864
SSDEEP 384:U2HKAFP1ccA0BANiAnWStiKruUnfpNdypPmF6s92BEvIu/Je:U2HKAFP1RAGST069/4
TLSH
T141625182F18EB63B1611154205BB27A4F27FC93ED340B51EF4BC20B711EE9D8512A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kznjrtew.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe
Size 139KB
SHA256 95dd3d338b816c901cbe7c69b419c86dd2da226ebc36eeae3e2c0ae80872542c
MD5 0558101269a809705983506a951decdb
SHA1 31130ff1413342ce57f2a45785b3bcc05971cf94
SHA512 d21648226093a7f2e8a0351c718820a60ca186b6cb0d90f7c4e0828282b586be4d87b27cd8fc5a008035e007d179c22bb2781bf5e1653609db9f714d6e19a1e9
SSDEEP 1536:enToAJMWKlZO0xoSs7syxlPVzBYPYGQIh3aBgisU/edhZKz/U8+UQyEKCUNrHPh6:8TaxHcj7IIBV5ekTEFjKHPh
TLSH
T1FBD3E1DE81A48FD0F8337DB02965BEBFA512F95531E5001FA9B4C8DED88AB75230C649
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 be2444da786629081d966e76943b2ff1aa4e38e21b8410acde01230bac9271cc
MD5 6d265215b6a355657486b9b94b0966c7
SHA1 651049e5ac516ccd57213914b2b0241767d3e86f
SHA512 4e2d22fe68c251295a0e0d2787d5f0ac0dc06114cec6306163f48da0f7985abd3607df1107cd0765673a31209d5967c9c73354ef19ac0bd25b9fd6b6694ee8b8
TLSH
T12C517309BC09DE2D452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 3e21cd4028ae22f5f88579a1a355a90af02f3d8fabd932ef10ae5517c67bd3e6
MD5 0d12c6c60680a65b8a6604f63670b103
SHA1 7d303091c1ae738ec946b66eb6b35a1625c35182
SHA512 f4441368ecd6d35025840385be39f997e9fa733c94e70a971d3e33c385bd7e9eb9c478d42dbdb1f0a66b0512c6cb98e60f063b05801f148660b850c567235535
TLSH
T15F517745F80CEE39012044826071E39DD02FDB3EF354F8AEB2BC467F6296AE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 3b4886342d130024d6fca5a62af5c575cb830d62bb11ba999b570cf4b466cd6a
MD5 b8d8ab4246397a28b78f10d600e106b9
SHA1 b30f67338f172e5f482910b97fc8966c41deda3c
SHA512 bcaaa117d0fc5861fbf1b190ab2dd8358ca8358bb4cc6a9449bd453375a0df50de18351a7b581d289e31165438376cd9757151cfe3d686a32a2aa5e21687f62a
TLSH
T12851324ABC05DE29452004C2A572E39DE16BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 139KB
SHA256 c60ece6a2c7dac358382799a8b9b94d4100a0f3173f79640acd4ea14d71df5ca
MD5 a78922a57f5ade8b65e3b9e1362de970
SHA1 579a84820d0f50c2678415122bd5c39680b5462e
SHA512 f4532ae4b2a0789e7dbd6947509dc62d92b788b2d0c034f0e6932ba97f22b3f74b75001bd672a114f9e6c7d3112925c76cfa317dc1b65a9bc6bdcba731b91a97
SSDEEP 1536:uN6/6nEkisWmunXDdH5teZBaKDkexvpV49asU/edhZKz/U8+UQyEKCUNrHPh6:otnEnBXDdZtYoviAa5ekTEFjKHPh
TLSH
T10BD3E0DE91284D80E4A37938243972FEFD91BD04A1D91515AE3447DAFCC8F383E98A5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1808-0-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/1808-75-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/1808-1-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4464-5-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4464-4-0x0000000000400000-0x000000000043A000-memory.dmp

Download

memory/4464-3-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-39-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-52-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-66-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-34-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-42-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-69-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-45-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-890-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-46-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-49-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-85-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-50-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-84-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-41-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-81-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-80-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-55-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-77-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-57-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-58-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-20-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-73-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-61-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-65-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-62-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4628-70-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4964-9-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4964-22-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5156-59-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-47-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-67-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-64-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-71-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-72-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-63-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-60-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-78-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-56-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-7-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-79-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-54-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-82-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-53-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-83-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-51-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-86-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-48-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-87-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-403-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-68-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-44-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-43-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-40-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-33-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-32-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-31-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-30-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-29-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-28-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-27-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-26-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-25-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-24-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-23-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-21-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-19-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-17-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-14-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-16-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5156-10-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5380-76-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads