e8bd79f473747369b90686464b2894a3e7788eb9344dca6692de6637ea2e6166

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 62KB
Sample261011-1lr8cahe28
SHA256 e8bd79f473747369b90686464b2894a3e7788eb9344dca6692de6637ea2e6166
MD5 a46c9440c7b296502fcbeb78462234f0
SHA1 3d33a28e5fac986aba18a2d35260b6def3900887
SHA512 80c80d1c4454f2affc1b85ffa07a29751028445c7d12e8457a5c8a462fd3ae12a39bd2cf244b9903c16dcf743ae3aafc1726f5f669d0dae7ab3e06848df5e985
SSDEEP 1536:d6YUzimWqpSf5rsUdRUWZRUSgKux6uDz7k3LkIhWhdi:dpUzuqpSfpsUduWZSSgHz7MgIhf
TLSH
T13F53BFCF87549D83F8DB297D3605D2FAB6A3476475F926B06C651ACCD0E021163BC88D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3172	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
3688	urdvxc.exe
3508	urdvxc.exe
3340	urdvxc.exe
6068	urdvxc.exe
3172	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "wqrrwqhqklwsjxbk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "jrbblzttrkwjlvbr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "szsvthrshxbkvvsj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "jeqnctvsklxqqjvk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "ebvjbsnvjrntllvk"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "xrqbnbqnrevbnbee"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "brzqbjzjcjtsjcrv"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "tnckejkwtnhljknh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "btjssjbvvblhrcjc"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "njhzjhhnxrctlvnj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "xxhltttshhnrhsvv"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "sqtchrnsehnxejrn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "eejehtswnhtqjjet"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "hwsbekbtxznkrbrz"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3688	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3688	4092	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	89
PID 4092 wrote to memory of 3340	4092	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 4092 wrote to memory of 3172	4092	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3688
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3340
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:3172

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3508

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:6068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 662B
SHA256 17db0ec5d27f0a636fae2b3b87559c6216437c08e343bc4c8419d5a5b751c784
MD5 ea52fd0d5d33a33eb262a61979d4b055
SHA1 0bc1b4d6e073beb5f51831e9ce841bf123d2284b
SHA512 ef12ef325b3bb17f5eeed771dc0dab8e6adc318bbec4b489dce9d407d043f0eb0713a3e0838f049d9f87fb495ec487f09a88ac69a22c852be4860353608bc55f
TLSH
T1DE01FE6ADA40DD09D1720EF130765E143926045A47A787B23981D843E7CE5BCAF467C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 587B
SHA256 2301731ea018f36781ad65f04042408f60b555ebdeb6e29e7471f7649f4cbb84
MD5 0abb7447d589372f1845f40ee0ad7cca
SHA1 f080f1eef12e7873f97dfb2a88c4eb6657105486
SHA512 3f3d05358c9a5c899e7821442e00729a2dc2c6d14ca561b025b2b15d50eda8b2798987d51140d22385506393b1ce8cfd86f46cf86c7e49259ff2263f4efbaca9
TLSH
T1C7F0E1BFA111DD0DE5B30BF464766F801A6A001A07928BB138D18CD3DA8D47C9E053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 611B
SHA256 a6c288b90aff6966455456669d581a3ef5eee5961904017f01ba1d5305213bcd
MD5 e40d5cbb486250b4371b5ef776f2bbba
SHA1 4a956f4841bae78fd718de3594070fbf9f4c90f9
SHA512 06888b0a059538bb427b57a633255f6bb69334211a1d7589f5f279676e9be5de78273c9fcdee4f2ccde47198966ed63b655759284b71bb2aaef668a4e0b80982
TLSH
T127F0026FC342DC0B90320AFC11736F20096624124BE6979636E19C03E9CD93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 c497f7de60157caaf645331068d0dfa6a17c0c0f817e4976ccfc3325324b3475
MD5 09cd73b48611b49dfa5727a6a54c02e3
SHA1 b7a79e0220abaddfd67156af0f972a8a87f8ef75
SHA512 11d0c5ff6923baff3e82f82403c0b2209aa3f64c9300e0f995a4dee037d052adb47774fa7acb53c112282a912410a7c17372c61e3ab5a4bc2227c5f48101f28e
TLSH
T19EF0027F6709DE0ED27357F010231B441916046B03A993B235D2C883D18C1AC1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 575B
SHA256 00cc80922e2a2896ce6d23c7ac9de53b9a2681fc1d94a4e010d8cd95fcd13712
MD5 69900fc80dd1fc004be69d8359818cfd
SHA1 fa169719b0cf64b83dd554653cafe2880a5dfc43
SHA512 d3994980c4939be924bf8cd1d17c86a134b8107150b0b7f0197a312cdcfb449ded99cb5d110deade71e1060d585622f742aada5c2c7fc6d14ec7be1b3c26abe9
TLSH
T101F0ACAF9201CD0B92B20BF431B25F641A66043A03A66BB239D088839ACD06D6A4A7C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 0f402791751b9dd803abaca5f5c66aa8596694418adf96f46e98e53e060013da
MD5 cb8c3739673a0e9c93078b2403defd1d
SHA1 8b2371af544fb9d38998b5f28a1ee492709615b8
SHA512 69030e619b2e0c0922bcff26cc547bbfd6b9369bd0d47f5db6b3f54c12d6f7de9e5078a3ef570a00f01722833ee74290db5d5fb544c552b8d85a8f7f2f329345
TLSH
T10DF0E1EBA301DE0EA5B34BB03536AB8825D6027A47E64B273D51CA93DA8C43C5E417C8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 606B
SHA256 8b24a233f19b00c3890eb0de129c80e30cb1bcfc2086454a286aef2d97c554ab
MD5 8347b57098781ed83f691d5402951621
SHA1 db1e387b076aadea3189ab8337d17576899805bb
SHA512 959b69ce1ed46e269e3f3471e75652e3261e1faf3609b2b56d09e92129bf33bea6be95aa6067bac5898c78cc0ca7558925c1c132fa2fa8d15ea950416e10effb
TLSH
T124F0AC6F9202DC8FE4A64BF060734F741A22149B43DB4B9631D08853A9DD1A82E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 2a97932600f2b6cacf7ec792f943ae04285df7091a65308dbd0d9d7c605c200d
MD5 4dd48c65e7063eee8817903bf1f4d571
SHA1 862b1c1589ca7a54bb0835232e4277051a3904f7
SHA512 a165ca11ee28985b2655ab3b5c4fe09c4efb3b211013508d410122e61dd8c534cbe52ddf95896ab47267b0a17ab72479349233dff3f3c3538562f289fcc9015a
TLSH
T1F2F00CFBA302DC0FE1769BB4A0B29F18193140164BE78B663AA098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 579B
SHA256 cf104900b2cff954d9d836b4669b585aea56514dfcc7711d73baa0c9591ab4fb
MD5 49f46fb27526284d368031debd63c5b0
SHA1 ccae9e15dfe345ef13c189b1e7c1a47485e969a5
SHA512 61ed086ee95ae39027cb414d68ab35acb1effbc8f0a89861834cb6092c814d3ad30f7dfcd48c7237fea19025138870576c91b5da4c891bcfecb1b40ae5729425
TLSH
T1A8F0ACBAB901DE09E6B347F920621B402A1E001E135243B639D1C893D68E9AC5E467C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 62KB
SHA256 e8bd79f473747369b90686464b2894a3e7788eb9344dca6692de6637ea2e6166
MD5 a46c9440c7b296502fcbeb78462234f0
SHA1 3d33a28e5fac986aba18a2d35260b6def3900887
SHA512 80c80d1c4454f2affc1b85ffa07a29751028445c7d12e8457a5c8a462fd3ae12a39bd2cf244b9903c16dcf743ae3aafc1726f5f669d0dae7ab3e06848df5e985
SSDEEP 1536:d6YUzimWqpSf5rsUdRUWZRUSgKux6uDz7k3LkIhWhdi:dpUzuqpSfpsUduWZSSgHz7MgIhf
TLSH
T13F53BFCF87549D83F8DB297D3605D2FAB6A3476475F926B06C651ACCD0E021163BC88D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3172-77-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/3340-9-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3508-83-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-404-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-27-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-28-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-29-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-30-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-12576-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-79-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-80-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-74-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-36-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-40-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-73-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-7-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-41-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-44-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-10-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-15-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-45-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-48-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-17-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-50-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-19-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-53-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-20-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-21-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-54-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-57-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-22-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-23-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-58-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-24-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-61-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-63-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-25-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-64-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-26-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-87-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-67-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-68-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3508-84-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3688-5-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3688-4-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3688-3-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/4092-71-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4092-0-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4092-1-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6068-65-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-78-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-81-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-75-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-82-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-72-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-69-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-85-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-66-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-86-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-62-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-891-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-60-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-59-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-56-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-55-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-52-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-51-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-18-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-47-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-46-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-43-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-42-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-39-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-37-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-38-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-35-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/6068-31-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads