227cce50b33876cedcf0453ef5d494eddbd4ad48a5bba7dbd403c4d89608c5ff

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 128KB
Sample261011-1ml3qahe52
SHA256 227cce50b33876cedcf0453ef5d494eddbd4ad48a5bba7dbd403c4d89608c5ff
MD5 a4ce8b75d05ddfefab77b90121c4b3c5
SHA1 49c0a9c6c05460a826d3ded2d393d0f166bf56ba
SHA512 ae09f5a6ffb47207dec7482c4bb757a57b1bf7fdcdf8e999b99d6663e0bad1d5dc0e2813d7cf744e5f6c5c3b46f3e4109e4f8c445897fbd47fba97ab8b872800
SSDEEP 3072:1ixxjSoRgC7vONVXSYPhxOp+Tw51fzrf7B4YjTRLecaV:Ux9b2NVXlxOpdLb7BfTMBV
TLSH
T1EFD301DC6021FD58F9DB6A38061EA6FCB26170ECBAA941507CEE0BE8C5F1F511ADC605
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (899) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3868	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
4584	urdvxc.exe
6020	urdvxc.exe
2440	urdvxc.exe
3724	urdvxc.exe
3868	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\ImportFormat.htm	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\RevokeApprove.mhtml	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	urdvxc.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "crckknsnnqklqetk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "sskwbhxkqxztzrzh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "ckzntbbherjjkstl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "xnlsctetnrtzvezr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rtcbrsnbhjzcbskb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "qlnkrtrktsskshce"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "nczkesvbvslqrvnq"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "vswznlvhevhrtkbl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "wlhqshrtwrvbnenw"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "jrbwscevkbhtttqt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "jkvvkhkwhxqekwvj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "kqkewlhlqehvqztq"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "jkrwssjqhvbvnrsc"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "rtvsvkskrlbhrbst"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "sqtzlshseknljbjb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "trekkxllxbkvezvr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "qbnltknknsejvczb"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4584	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4584	4356	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	89
PID 4356 wrote to memory of 2440	4356	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 4356 wrote to memory of 3868	4356	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4584
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2440
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:3868

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6020

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:3724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 7b391099cf216d79e6cc5fc1bdbfbb66d2cf441129c3137d8c20f2fcc48deb59
MD5 83911f1a48ae69ddc42c491d1d4f0a5b
SHA1 06cbf3e33dac091c4273fc063c32225d608fe430
SHA512 42e4bb6f7ca528624ae33eea465fd5dc64f0136c69fbdba2c84c6df4c7b79da632d93b5fecfbe69ec785f312bfea9968a9f5a245c53330f1cfc85b742be98f5e
TLSH
T1EA11E2EBE9F4DA12776051E312E469D47BB941E51D63C8993A1192029080E36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 9767c8591031e018f8b1440bddd3b7c681db1a412f1c6ce2008dd910a07b3375
MD5 7ecf0e501b94690a48f9e3e0c45a6baf
SHA1 84539491cfecbcd0b485fbeb29961d4f51c44ad9
SHA512 9cc284d2df332f6df681dab62228da7445e93e12b6a68b86275752956c4b4d5695be096a7a3727a28079a26ffb7421725b39e4253e38431bcc7bcb73fad60db9
TLSH
T1A331F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 652B
SHA256 b6f240d2da4288456fd9161836412b9b9b8203b38ee27de89e1984c2209c728a
MD5 69b373636759fed8698e568fdc8584fe
SHA1 86f8f7dd69ec79a6da2648315cd7714a69de243e
SHA512 b64e4d03459cd23b5061bd9b181555de65096cb3f1650740990695a0c85cfbf360a4aa46bf9c0c07351b0bea18976eceefdecd0f3e4ba237b50ee5ee22cdf982
TLSH
T141F0FE6ADA40DD09D1720EF130765E143516045A47A787B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 587B
SHA256 2301731ea018f36781ad65f04042408f60b555ebdeb6e29e7471f7649f4cbb84
MD5 0abb7447d589372f1845f40ee0ad7cca
SHA1 f080f1eef12e7873f97dfb2a88c4eb6657105486
SHA512 3f3d05358c9a5c899e7821442e00729a2dc2c6d14ca561b025b2b15d50eda8b2798987d51140d22385506393b1ce8cfd86f46cf86c7e49259ff2263f4efbaca9
TLSH
T1C7F0E1BFA111DD0DE5B30BF464766F801A6A001A07928BB138D18CD3DA8D47C9E053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 611B
SHA256 a6c288b90aff6966455456669d581a3ef5eee5961904017f01ba1d5305213bcd
MD5 e40d5cbb486250b4371b5ef776f2bbba
SHA1 4a956f4841bae78fd718de3594070fbf9f4c90f9
SHA512 06888b0a059538bb427b57a633255f6bb69334211a1d7589f5f279676e9be5de78273c9fcdee4f2ccde47198966ed63b655759284b71bb2aaef668a4e0b80982
TLSH
T127F0026FC342DC0B90320AFC11736F20096624124BE6979636E19C03E9CD93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 7574f78d0a36524d3427e89695dfbe55493244d5aad96b691a40725446c1de5c
MD5 5b954df644c926ff1ac98e40c5f93130
SHA1 c7fae7a822ca6814fb8c40079794a2b7fa807c03
SHA512 46f2f3bf0eaa30f893c197759f20d79b76694f26b90e1e68590d4aff2ab45293fe38f44a81f4e795b3f7de664d6352ba64585f0aab9f94477c77165f6df8221c
TLSH
T163F0027F6705DE0ED27357F010231B441916046703A593B236D2C883E18C1AC1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 ed21c528d1bb45f7acb22fc201d38e08b92604578a2e989bf0cbb985c5a68dd5
MD5 1156135a6db1ff90b84b74a67cb7d312
SHA1 e074168a8e53b19d82e75d5f5507f53ba7fcf5e1
SHA512 f1d8cf968f1e6fb99ed7fc668744461ee0a173e566025b7c29fb4919bd6d53cb45c4ef936f9789c8d2d5c717801f2ddd456ebb1ab053928b1da987f5546da7ea
TLSH
T107F0A29B9201CD4F92B20BF531B25F641A66043643A62BB235D0888395CD06D7A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 d743081143a28e397e4bb0f29418928ea1f8d8ee32d7349960c2689c1154cb29
MD5 e2068361bff766aa4ec9028805d2ac8f
SHA1 15f52c86e148dd0e9859edaec455c8f2609f5c4a
SHA512 5776e58189a4562e501c085a5bd9f750a1a40b1980669b27b852e51404447c8ed9ea8816401671e1137154dc47abb9fd47b54d1fc3a7597a38323e82ead5f960
TLSH
T140F0E1EB6301DE0EE5B34BB03536AB8825D6067A07E64B2B3D518A93DA8C43C5E417C8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 595B
SHA256 8acc1803f259a414cad539e6eb38f5a8f0326b894c18f6fe6c4e09f398a834ad
MD5 9d567b986710898e246d3ebc82007a13
SHA1 2d29706fc8bbd76c057e086bde3ee277835e88ec
SHA512 98c19b5d12659592fc7ff534c5d313b1d3f21a961d5cd19901c3620093efed77c2cc2b0e37207baf9f598c2399999f7b2145fa670f1b44976f952997f018691c
TLSH
T123F0AC6E8211DC8EE4B64BF060734F641A22049A43DB4B9631D08853A9CD1A83E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 2e5ea7faca19f0b084896e8ef062e24cf99f870dae9c248bb481d18bafdb2f4b
MD5 3d45face09b7630ee75ec05cbbe35ede
SHA1 cbca5e823cb7c005ee2b84d85cbce14ddd5d0f1a
SHA512 c9139bf68f4b386e1f85f1d41254352df0673420a59e606428be1a890d04dae3d1f3a8fd8611956f2df99810444063ab5f98bed6fa84692a192d0fac0ba976fa
TLSH
T1F8F00CFBA302DC0FE0769BB4A0B29F18193140164BE78B663AA098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 729be52bdc2047333715d54a10863d5c4a50d2a03a47f3757994b0d7e1a60484
MD5 f5f2406b9c0a5ccb7dbb0336d34e6cc1
SHA1 4b86d554efddd7cfccf6dd21573891a94462acbf
SHA512 286060ac255ca48faabe8062872daf5b13b8e952de08277c79570f5c40751d6d79bb98946f995b4b1ea4f867c25721fcbf25090ff1b5515a5ad45990a2fba968
TLSH
T1B8F0ACBEF901DE0AE6B347F920A21B402A1E102E136243B739D0C893D68E9AC5A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\VideoLAN\VLC\lua\http\index.html
Size 15KB
SHA256 fafd09abc8d33f454a6a43b419b36d49032ce5ef27e59b56343a74653b604e38
MD5 b471c8ce4d7c9b728d7fc91b1539d161
SHA1 da907e3068d0fef72bbdbb3196985334d8c62a33
SHA512 2989667cd667c8aaaa6371f580c79d663b394e2109b65098bc59abe7d5cfaae29c35276be4727bf8819b4b88ec848a3e7002968f3d217f310bdee5c4c9811864
SSDEEP 384:U2HKAFP1ccA0BANiAnWStiKruUnfpNdypPmF6s92BEvIu/Je:U2HKAFP1RAGST069/4
TLSH
T141625182F18EB63B1611154205BB27A4F27FC93ED340B51EF4BC20B711EE9D8512A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 747242cf1e5327cc98c2c0c787266cc42a37ffd7ca208a7fd1591ff3ee577b06
MD5 44b56d178f697c19e5ed545d55c8a124
SHA1 36fb58c5a8020658ddcacf2dbfe9a723635d8a7d
SHA512 fc4131615a6ea5e56ee5c39bde5863965a8d94a12e9f27d78d9251493609c9b28172d847886a830244843650b8d58d153aefcc8cee44362c15c2bf3465e01286
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtlI:6kEfytgP8qmrtfPFLhXv/j/wL/RD
TLSH
T137B13585B489AB3A0311064251B76B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 be2444da786629081d966e76943b2ff1aa4e38e21b8410acde01230bac9271cc
MD5 6d265215b6a355657486b9b94b0966c7
SHA1 651049e5ac516ccd57213914b2b0241767d3e86f
SHA512 4e2d22fe68c251295a0e0d2787d5f0ac0dc06114cec6306163f48da0f7985abd3607df1107cd0765673a31209d5967c9c73354ef19ac0bd25b9fd6b6694ee8b8
TLSH
T12C517309BC09DE2D452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 3fcef4e86a9d26faa9dc968baf072f783c5c2d8c194dd6406fef109cceee6735
MD5 5945376ac03f03ebc543ab61eb3102bf
SHA1 cdc9bb1b85566736a814bea1c4a4a99b73f6394f
SHA512 82f56f1e0d6f381c4f88b26adee241b228cbb7c6cfec94087c8586f3c4ec808284859d9c806de504c11996cb49395dee6f84ad718439a73c00254efedfd3f07c
TLSH
T1E9517745F80CEE39012044826071E39DD02FDB3EF354F8AEB1BC467F6296AE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 d39f416335fae507011f618fecd45fc20cc4eaecdb2c922838409a25ce5d0609
MD5 e5f924b2796aa64b37b9eca6c409134a
SHA1 ba4124556dadca4cee71a80adb6e079d681c6060
SHA512 f2412d1ca798df80484ade1a13145019525882d5422c74f954ba182f9fac8ddf4f62cc3b96e353c1225cf100c3c9da44cc5f793c78ede8776e49f0f9c5e033ed
TLSH
T1FA51324ABC05DE69452004C2A572A39DE17BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 128KB
SHA256 227cce50b33876cedcf0453ef5d494eddbd4ad48a5bba7dbd403c4d89608c5ff
MD5 a4ce8b75d05ddfefab77b90121c4b3c5
SHA1 49c0a9c6c05460a826d3ded2d393d0f166bf56ba
SHA512 ae09f5a6ffb47207dec7482c4bb757a57b1bf7fdcdf8e999b99d6663e0bad1d5dc0e2813d7cf744e5f6c5c3b46f3e4109e4f8c445897fbd47fba97ab8b872800
SSDEEP 3072:1ixxjSoRgC7vONVXSYPhxOp+Tw51fzrf7B4YjTRLecaV:Ux9b2NVXlxOpdLb7BfTMBV
TLSH
T1EFD301DC6021FD58F9DB6A38061EA6FCB26170ECBAA941507CEE0BE8C5F1F511ADC605
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2440-14-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/3724-88-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-56-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-67-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-71-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-64-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-33-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-38-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-37-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-72-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-39-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-42-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-19-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-43-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-630-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-46-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-90-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-47-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-75-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-50-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-85-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-83-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-51-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-55-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-78-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-62-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-68-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3724-60-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/3868-80-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4356-77-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/4356-0-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4356-1-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/4584-4-0x0000000000400000-0x000000000043B000-memory.dmp

Download

memory/4584-5-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/4584-3-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-49-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-28-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-66-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-70-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-65-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-73-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-74-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-63-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-59-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-79-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-57-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-54-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-52-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-82-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-86-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-29-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-48-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-87-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-45-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-368-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-44-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-69-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-27-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-26-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-25-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-24-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-23-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-22-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-21-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-20-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-41-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-18-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-15-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-17-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-13-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-9-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-7-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-40-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-32-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-31-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-30-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6020-6081-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads