0fca4b182d78ca2993036d40d549eb1ec0c5fd5377dd32a072e62ea9ed294fef

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/10/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Size 92KB
Sample261009-vvbztsda99
SHA256 0fca4b182d78ca2993036d40d549eb1ec0c5fd5377dd32a072e62ea9ed294fef
MD5 254f89b353c49bdf1550e8080eabc530
SHA1 79efe9028e0686e352c73daf418673417ed9d9dd
SHA512 7227fe75ed65f9cdfd8e5838b5cc400a5482d464902ec6eba65352a61750bd834b3a4ae761e2efc0ed67961a7ca8d6ec92e5e82671e733b24b56ebc0db26b028
SSDEEP 1536:l5h2MxadUC+OLIZUhtB4zRg6mUq/4MyjcORZ83YacIyP/69QAq0Gb8/Z5H83oKz:gMxQUC+OLKoB4F7mTbyjRbKYBbWq0GQQ
TLSH
T1C793F1EFD120CE92EDBBAA3E75286835B631D40529E9F5C43C309DEDE4C16700C9968E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3936	urdvxc.exe

Executes dropped EXE 6 IoCs

pid	Process
3412	urdvxc.exe
5584	urdvxc.exe
848	urdvxc.exe
4364	urdvxc.exe
3936	urdvxc.exe
3324	urdvxc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 61 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5AD703F-0C2E-9F76-216D-2D69367D8DF3}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.e.exe"	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "hwbhshxszsbslhrt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "sxrctzxhjbhncrbt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "jnxlnnkshzsjjwrk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "tkxncbhswwvelbht"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ljslvjekhbneeehj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E5AD703F-0C2E-9F76-216D-2D69367D8DF3}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "brwebneenlzhsxtc"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "shnewztjenttqehe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "clnnbkctbhxbkkjw"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "jeqerbnlxqlleksk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "whhbsrbexswtnvnn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "vbehecbrzqnshklb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "trzjtkbbkexxsnkv"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "hbvsbksjllrbvkkx"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "rzxwhltthrjbnbxs"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "zssscqkqkbbhtqxt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "wbsqcexhtkcjeeke"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3412	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 3412	1292	jaffacakes118_Net-Worm.Win32.Allaple.e.exe	88
PID 1292 wrote to memory of 848	1292	jaffacakes118_Net-Worm.Win32.Allaple.e.exe	91
PID 1292 wrote to memory of 3936	1292	jaffacakes118_Net-Worm.Win32.Allaple.e.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.e.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.e.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3412
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:848
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.e.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:3936

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5584

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4364

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3324

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

tsbknceh.exe

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe
Size 92KB
SHA256 3edec7020aeba34098f1dd669efbcdfa45f329b12cd5ef3013695b4add4543a2
MD5 37f70d10c8081fab6addb87df1c10ff7
SHA1 00ed8cce39d2e3110c3a14946b717c5ba8a47665
SHA512 9647917d8ba922ca488f665220435a53f06ac67588dce1282e048cd291cceb0a9fe787e97675f861155057cc648412205f768073c60b7176e1e54bff18a3818e
SSDEEP 1536:ZsQlsjzvSu3gaY7CIjqFkbzGw3ElBAGZ83YacIyP/69QAq0Gb8/Z5H83oKz:plsJgaYxjTb6/BrKYBbWq0GQP0oKz
TLSH
T1C793E08FE038DCC5EEAB243D38AD746BF231914462ED02047FA19ED9F7C674165886AD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 653B
SHA256 2b46123359e67f3bd3e33b5a853faa259d5f6eaae063be712041add582171342
MD5 053159fc7da38511968ab3c40e221a11
SHA1 a2981930efbbd04122b0014069811d2b3df57fc2
SHA512 6603ff71d4a898af2243b028b1ef2fba7265d089842063456d8da9c6cb574d27be34a7756df831aacd999b08855ab9c255019d63b91919f69ef632ca40d36180
TLSH
T1DAF0FE6ADA40DD09D1720EF130765E543516085A47A787B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 d491497300ee2129b08a15bc6c67eb0ea0c4c6baaaab8b63caa27a3a88c358e0
MD5 c22f696c1609613f4cdc33c740c9d145
SHA1 aae766d5a4dd2b0d5d584df1d78c00e1cd024051
SHA512 a563f9bc88ccb0f2dd8155e67d55f0c89bd926f7c60a8f209a352acece22e92d08bec9d0c3e996ed7a2a9b60ea22e5599d1215d463ed35ee2b8465679e650f8b
TLSH
T1A0F0E1BFA111ED0DE5B30BF46576AF802A6B001A07928BB138D18CD3DA8D57C9E053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 611B
SHA256 a6c288b90aff6966455456669d581a3ef5eee5961904017f01ba1d5305213bcd
MD5 e40d5cbb486250b4371b5ef776f2bbba
SHA1 4a956f4841bae78fd718de3594070fbf9f4c90f9
SHA512 06888b0a059538bb427b57a633255f6bb69334211a1d7589f5f279676e9be5de78273c9fcdee4f2ccde47198966ed63b655759284b71bb2aaef668a4e0b80982
TLSH
T127F0026FC342DC0B90320AFC11736F20096624124BE6979636E19C03E9CD93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 630B
SHA256 cde873375b3d419c96900cc218756740697c37397cb2de116ca74fd448c810f2
MD5 1e5bad17cea1766199a19134df5ab628
SHA1 2cd1a362727af2145bf8823c43c2853e6f26b6c4
SHA512 c22372102efe4ad7940e2be519978acfddd23e931e29a5b8d2c2ceb1e306733a93bd5d8009804474d99327f54a7673a9e57a55878c913b8c5a78612579d6390e
TLSH
T14AF07D66D146EC0AA1B68AF464B15F750A3300190BE75BA33580C997EACC4F89B453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 4bb77ccba127f5848c98b69a2f1ed6741c2ddf4cd5ca1090ab584490868ca551
MD5 0daf2c76adc7d5cf2a81c3d8a16ab04b
SHA1 3de266f8691ff8584d33799101d9705332601639
SHA512 50f45a2b522401203d1fc4aaba86ec1f21b0dfd455dac51bb7a8ecf50be73fd3d90d224e87875a6851a87ff4d147e2b818f521a58bb4d83991b6a5495621e639
TLSH
T119F0027F6705DE0ED2735BF010631B441916046703A693B335D2D883D18C1AC1E413C4
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 20645d21f9915a1b5df53e1e5ffb322e48ac815d327bc7b34e613e8a6147759c
MD5 668ef6602429fd8b7751a983d87fe4cf
SHA1 6d018fba05477d3947d6b7f7aa06c08e48bcdb9d
SHA512 5eb42b9401956bc780f57652ad680912f0f4cad3085d8b4115540108d7f5cca70b199882c270930acf2f588e8e8b6d89c4c2b7cd1b167f5f3d3d1987c4820b37
TLSH
T121F0A29B5301CD0B92B20BF535F25F641A66083603A62BB235D0888396CD06D7A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 1cfa1f796aed4174761acd4c22d0df605946878bcbdda78da7d4cd725b65b158
MD5 292b7ce5d4f715f0d4356c92fcbc8cfc
SHA1 9431db8e1882f2589b9f7ea88692c617664b2411
SHA512 e3433ac734ce2dcefb3d68a8b7ec17d8c22de8db7e387810059c7cc5470748e018e6354d40b1fd6b615095f9257fe6847d2566d4a9e9553e227f6b74ec3e7d65
TLSH
T1BAF0E1EB6301DE0EA5B34BB03536AB8825D6027A07E64B273D518A93DA8C43C5E417C8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 606B
SHA256 961371c2b24c6dad28f8278abe704ed944dd4606fdc1a15e17355117bfb86a2b
MD5 aabe01c20891e148c2edb6a7b2968d7e
SHA1 5b7b1635892817c1bf9398a58b52ec058f161023
SHA512 65342b46581cb958816238596d2ef4b801acf4ecd68d83ba519cb0933201ae1077f10ba7f5cb5725f7534298c288e38959c3a6084a6738a1a5c8c83fefa736e5
TLSH
T130F0AC9E8202DC8EE4A65BF060734F741A22089A47EB4B9631D08C53A9DD1A86E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 622B
SHA256 ba0e4a87dd8de4026b72c1a42f059a0d308422cb01c582ee1bfd167c6d452df2
MD5 e7b486fed80300457f600652fe824e67
SHA1 79297506785e0179d3845315b2206c680b5404d8
SHA512 b012d0ecf28aa4cefbd031f3e836365de2c2ff3333d061165d2e98594995af2b17358c1ff1879e02808b4f12594dfa95140d8d4874ed0e9607ab59e38438322a
TLSH
T19CF0DDFB9202DC0AE1759BB4A0B26F08193144164BD747663A9098C3E5CC0784E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 4c3f0ca5a0e88010bbf1b7bb7537d089e8201e2432dfd301ba5dc7359ade4cb3
MD5 497239a998a8c221db2df40687825bb3
SHA1 b3c6cbd724bcc8a741bb6842d6a7534db15909f6
SHA512 5f96c59b6218184cbead454a5dd6f9fcc0edf5f702635b42744cc4ab21d3ca5f255dff84dd33d1c205666793e3eba16955337cd770ac679b893291541091e7e3
TLSH
T150F0ACBEF901DE0AE6B347F920A21B402A1E101E135243B639D0C893D68E9AC5A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

rvhrjtnt.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe
Size 92KB
SHA256 f12fde0267cf5fd9496274e70ec6e49654eaba83ff60c5b4dfa623fa9ddced14
MD5 424de6308605a15b9ebab71cfd31e0d8
SHA1 338613c9b3d2788b81b3aaab8c48f5c5ecdcb3ef
SHA512 3cdcff06ff447b64ba12b91e0e9bc483274f2068bb965e3f8863b07523249a32cbba5b239d9383a3727b12abeae63504dd662720ce1cd159c74f9cf0f7d8ec79
SSDEEP 1536:JqVAfLKjMJ7hZHIrP1lOsGHu/5QuhhNdSGyJZ83YacIyP/69QAq0Gb8/Z5H83oKz:01Y7ZcOsQANdSHDKYBbWq0GQP0oKz
TLSH
T17F93F19FC01DCCC1EDBB6A3E3619752BFA30D0C832E9D1806470ACFDE8D6661594959E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 92KB
SHA256 0fca4b182d78ca2993036d40d549eb1ec0c5fd5377dd32a072e62ea9ed294fef
MD5 254f89b353c49bdf1550e8080eabc530
SHA1 79efe9028e0686e352c73daf418673417ed9d9dd
SHA512 7227fe75ed65f9cdfd8e5838b5cc400a5482d464902ec6eba65352a61750bd834b3a4ae761e2efc0ed67961a7ca8d6ec92e5e82671e733b24b56ebc0db26b028
SSDEEP 1536:l5h2MxadUC+OLIZUhtB4zRg6mUq/4MyjcORZ83YacIyP/69QAq0Gb8/Z5H83oKz:gMxQUC+OLKoB4F7mTbyjRbKYBbWq0GQQ
TLSH
T1C793F1EFD120CE92EDBBAA3E75286835B631D40529E9F5C43C309DEDE4C16700C9968E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/848-20-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/848-14-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/1292-76-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/1292-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1292-1-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/3412-5-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/3412-4-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/3412-3-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/3936-77-0x00000000007A0000-0x00000000007BF000-memory.dmp

Download

memory/4364-894-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-48-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-84-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-34-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-40-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-38-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-41-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-82-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-44-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-81-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-45-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-78-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-19-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-62-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-49-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-12736-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-74-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-54-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-71-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-52-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-56-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-70-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-67-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-57-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-66-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-59-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4364-63-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5584-29-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-64-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-61-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-60-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-65-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-58-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-68-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-55-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-69-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-72-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-51-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-73-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-53-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-50-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-47-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-79-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-46-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-80-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-43-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-42-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-83-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-85-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-33-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-86-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-400-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-32-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-31-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-30-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-28-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-27-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-26-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-25-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-24-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-23-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-22-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-21-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-17-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-15-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-16-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-13-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-8-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-12582-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5584-7-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads