60304f22d09929386cbc5e47ee8a634a79806ef8f65f4c695c73969ea14bc21b

Analysis

max time kernel
150s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 21:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 62KB
Sample261011-1lyecshe32
SHA256 60304f22d09929386cbc5e47ee8a634a79806ef8f65f4c695c73969ea14bc21b
MD5 12e55336ba0304bd78061327d1f75ff0
SHA1 8156a8eb93fedee8db0703729e95e3c7be523edf
SHA512 5f1005fe34e34d6f3ea73810ad4635dd121df13e273458ed8024b06cf82e5e412848b8732845b66c9caed215c0530404429bcf636159a97639252564307db395
SSDEEP 768:rZm2G6rOZuFMwfoeoTd4GH2ppNqgqlCrKPSIH1C+O1biC7OGz3XVaFKyUkHpXL7v:1VLdMwQNFtljStbhyGoKVYVak76vX75+
TLSH
T1FC53BEDB95389CD8FF6328381E02B59BB1EC2509B4E80106297D2BD9D5C53D522CD6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2300	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
4212	urdvxc.exe
1288	urdvxc.exe
2008	urdvxc.exe
2344	urdvxc.exe
2300	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "vltbjkexczeehtsj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "jxwbervjrjhhzevn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "betcqbseqljektnc"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "lqhkjkthhrlskhhr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "skxnrbeknltejnxn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "tjrvlbkqkktrelbh"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "bhqwkxkklkhrrqtt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "vrelswsblhrtnjje"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "vbsjthjrezqnhqce"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "ebxeebehklljkzxl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "eqezbntntxrkjkkr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "krkzkslzkcklrtxb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "nhrlwvxjtlrvbknb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ehkrqhvlnhssvjjk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4212	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 4212	3320	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	89
PID 3320 wrote to memory of 2008	3320	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 3320 wrote to memory of 2300	3320	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4212
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2008
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:2300

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:1288

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 c1ce92d036c9c5a7e88a910ff6b92b44e946e28520f8a5fc3cab122b9b2184fe
MD5 ad2df51b525b37d500b856a43f089f0d
SHA1 44a8d2ee8b613172091838556ccc29c9dffd330b
SHA512 e7afe5da5a75d10e859b074212af2f30c3cce34218273948cdbecd06a9f31636eedbc8c9802ea333b10f0ccb5f9321a606fced4ad0d94c629837fe77a32b3245
TLSH
T15211E2EBE9F4DA12776051E312E469D47BB941E51D63C8993A1192029080E36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

tsbknceh.exe

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe
Size 62KB
SHA256 d7e75886c77282d34b9e1d279c2736a77eb2611eca5fb6a78bf4ee4e52136276
MD5 7b736f96ec82aa62fb458ce17d336eff
SHA1 eb47625a98b81bce860905c5994cb5bb3255123c
SHA512 381bc94191d993b07833407ca9278082d71cd5d84851cf760b39ec3d3110dd72c6e60b50bc3e31ec0e0b0ae3b4b363407a842b86e8f1223a383dede9d9822672
SSDEEP 1536:DDqF9X1/UoP45t7006qHGPTOoJrhW93gQ/g1+nl4eF9p9tK4Q:aF9X1/Uo4H8qH2TOoJtWqQYo39K
TLSH
T10853CFCFA039EAC9FCEB243D108265FDF3B284DA6AE21901B99196DEC084751D97C1E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 662B
SHA256 2843f674910ecc848dd47503c807f0c0b7586f99a20a86dca680388e28b9b6ac
MD5 62029dab8b8bf428f3ff30c82e5f2b6d
SHA1 b9f2571188e2a3d9d5cdabaaab3afc65c963eb6d
SHA512 8cf84597c4e4528aff58401e794163453a158b7f353a7dcfcc372612d99df1970fdba52b998122294746d080c54ba4a98b19302a414fcbd513062c6e28983321
TLSH
T19A01FE6BDA40DD09D5720EF130765E143516045A47A787B23981D883E6CD5BCAF467C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 437a5b50bc71ec9b9d6577ef88331b7c150e823216af746341ff5713530c6e72
MD5 0d65b5a6b1003a43ca8878d97ba0e920
SHA1 9ed748c275b0f4d6e9e37979e3a9060621e2838f
SHA512 967ef7806f95a3044fa7462afc06f386c7a282059607250ed16028362dccfa7e8155d54868939bb52a62f1845957ee3f3b56e72c1109ac8c7018bff26fe728e6
TLSH
T103F0E1BFA111DD0DE6B30BF464B66F801E6A041A07928BB239D1CCD3DA8D57CAE453C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 622B
SHA256 0564db869a58a80cf8b4fdb3fb42b7d18cf6d9b4e29203e1f7d08b00a16d8076
MD5 a10bfbfe27c77da3a3c34ca3519fa68d
SHA1 d27587f9c2968dda3585c3af390405ff685d79f9
SHA512 96a48dbcd566a4dad65cdc7dd7252a4c6b6b35df13eed9ef1c5c1e768902fecc09788efd5263173b037a6ffb488fda5ab9c91d8c83905df9afd32a0e2b9aed02
TLSH
T17FF0DD6BC242DC0B90320AFC21736F20096624124BE6979636E19C13EA8D93C5E8A7C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 618B
SHA256 6bcd3abdbc2c2698149ba8971e069781f6f3434ba3a4115f987e03df588b3b2b
MD5 14aab463c038652f89ca3a7ef80b4f1f
SHA1 1ebaecd08c6f34b75a60c4e2a8edefdc563d6d57
SHA512 42fe251a2c8ea8d5580d13d5ba76ac3d1c25354482dc37d63e26c1db6b15e603a8b154d50877b362e2903d4c2ebe6f3af4466fdd80671121a6d5dc8767653a38
TLSH
T1B8F0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 2b0f936d46e789d940f7f0b0df4ab86dc6b4100960ca3e0ff5b926a5436ae036
MD5 3b8964eac43e3ffa6cfbdaed31a921c4
SHA1 427b09a3916b1135c35b6d1f20556adff5c7580b
SHA512 ec39b2927eb4356027792cf806d44c51692dbdcae6f10697c819591ab26e449e4a0624244620cd69e86be654066a28d6020d4b80fee41e6da9463bd53331ffa7
TLSH
T10CF0027F6705DE0ED27357F010232B441916046707A593B236E2C883D18C1AC1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 e140ac473b593a2156754017dad396f04365a810325e62e30d4067b96b1668e8
MD5 000c4b86ed8d897773f3db2d89355553
SHA1 d7df3dcc8fb7f4e8e15c25c2a737f35b36446206
SHA512 de2e9751577228432a9f61f22d63a595738869f90654a5082c830bf1a954c58e9dfe7c0e3c75bc631df7c7359d3095e30b1e607c6c477615947bbb3ea2837979
TLSH
T195F0A2AB5201CD0B92F20BF831B25F641A66043603A62B7235D0888395CD06D6A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 590B
SHA256 1d379c950ec5f33c704476062acba2dc7aaeca3f317ef08c354e407c684f6678
MD5 027c34adef000b30d8e08fc74ddfad9a
SHA1 d85dd21a9fbc547cb77df2fdbf2a72b1e4a2f87d
SHA512 1d4a50c26f275df38433deb7803371e7367dd4c36f72315a639fc697f2ab944a1a3013976bb73dd405e96c11e77f56edff04c2b1d347daf01ee36478b0d97eb7
TLSH
T149F0A2EB6201DE0A95A34BF02535AB982996067A0BD646263D5199939A8843C59417C4
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 606B
SHA256 ff1c224cb1827b3cbe87b4c5c8e37d00f0eb421b8b656a284f09d9c39fae098c
MD5 90f2aff711d028aa659ec2a327ef8274
SHA1 ea5f12d484e5e30e22b1261bfa0faa14f809a42c
SHA512 077675012c017f426277596320c60cee83288dffe4d26707a28df511e1db7bde8d3066177b440bb2427a2b5d87c75e9c0512b89e7585279bac08295c16af9f2e
TLSH
T186F0AC9E8202DC8FE4A68BF064734F641A22049A43EB4B9631D08C53A9DD1A86E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 622B
SHA256 e6bd37a6fe7c2be8be94886ae9a95338f1b525e0dc1167df36cf132910258b09
MD5 2050a15470938392f637973328cc7628
SHA1 69f1cb9f72772437de9885bf792b89d9df491bf0
SHA512 c3c1d364f20a26c0a4468e0c9fb8235991a10484cca25b6b4d4d9f64a6d126157236449724b7c7718d8de2005b530892f3e2f5d5d38f058196b93317d5af036f
TLSH
T120F0DDFB9302DC0BE0759BB4A1B25B18193144164BD74766399098C3E5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 8c7c50aabd9780555b70db58f0267583cf11a40349c8886b35d13846fe3b2ba6
MD5 6c4019badbac8ce4fcec466a6e572190
SHA1 430ba1203807a62b3d77d818a28e612b39b07a78
SHA512 195e888c704c1323604753401085fc563865ea639aae321fdc544a172e71614b9503929a3a0afc919e1665b61b64881519d0d0164372b1c9dc0d838d4f32b08f
TLSH
T180F0ACBAB901DE09E6B347F920621B502A1E002E135243B639E0C8D3D68EDAC5E867C5
MD5 SHA1 SHA512 TLSH

Submit Download

rvhrjtnt.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe
Size 62KB
SHA256 3e945dd548bbfc2b0099767f81430bb7790ff8e1ae13428b5e4c282c499fb9a8
MD5 f91732f6b46813aee833a02fefaa1313
SHA1 fca38905752b57ee5c8ac8c070e2e92f70f0a438
SHA512 17f6d1c7e51977c2649e08f3fca28bed74746cfbf49a9218a93bf8e2e443acd38f09c7f058bfb6e01eb489d9c439860521810d2e4d8680969da90475f786059e
SSDEEP 1536:7FtlWjyJQY9qjsnKGxAy7q7DbqjBReqOF+ERRfIOzZBETOn:IjcQjsnKGxAye7DbqjBRbkXww0Cn
TLSH
T11553CF8ECB78DD97E4B72C7C2700E6FFF523452936F61130B83A99EDA19465884BC099
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 62KB
SHA256 60304f22d09929386cbc5e47ee8a634a79806ef8f65f4c695c73969ea14bc21b
MD5 12e55336ba0304bd78061327d1f75ff0
SHA1 8156a8eb93fedee8db0703729e95e3c7be523edf
SHA512 5f1005fe34e34d6f3ea73810ad4635dd121df13e273458ed8024b06cf82e5e412848b8732845b66c9caed215c0530404429bcf636159a97639252564307db395
SSDEEP 768:rZm2G6rOZuFMwfoeoTd4GH2ppNqgqlCrKPSIH1C+O1biC7OGz3XVaFKyUkHpXL7v:1VLdMwQNFtljStbhyGoKVYVak76vX75+
TLSH
T1FC53BEDB95389CD8FF6328381E02B59BB1EC2509B4E80106297D2BD9D5C53D522CD6EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1288-81-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-48-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-24-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-12528-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-68-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-27-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-28-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-29-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-30-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-31-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-32-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-33-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-34-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-35-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-7-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-8-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-10-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-13-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-43-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-14-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-44-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-15-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-47-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-71-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-16-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-17-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-51-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-52-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-19-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-54-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-72-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-20-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-57-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-421-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-58-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-60-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-22-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-82-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-63-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-78-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-64-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-67-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1288-75-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2008-21-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2008-26-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2300-84-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2344-41-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-55-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-73-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-74-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-66-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-25-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-79-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-65-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-56-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-80-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-83-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-62-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-61-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-85-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-69-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-59-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-36-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-912-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-53-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-50-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-49-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-46-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-45-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-42-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-70-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/2344-40-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/3320-0-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/3320-1-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/3320-77-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4212-5-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/4212-4-0x0000000000400000-0x0000000000426000-memory.dmp

Download

memory/4212-3-0x0000000000780000-0x000000000079F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads