5eebdf2b5f85aa22e19568c9400e15d58e7609062ff1ec6b0e64f72a250d4ce9

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 66KB
Sample261014-jplrasas5m
SHA256 5eebdf2b5f85aa22e19568c9400e15d58e7609062ff1ec6b0e64f72a250d4ce9
MD5 c8f2e5515034a091e54199e63068a450
SHA1 4a0b1eb2bd9ed44e45b61853cff548efead5de48
SHA512 6efe19751c1c1019266f9c21018fc3ad97750b3974f90ac45345a46c42dc3bce4dda7b5bc7312bf7b23d6637909343521fa2c5fa97b6f3cf42a58aceb2e1f1cc
SSDEEP 1536:0+fFhijc9dfBgJdEp7Rx5SB4eYbNAQCEW+teR5suiLS7v4:0QC49dfBfp7Rx5S6e2RCdHRuunA
TLSH
T19563D0DF8A74C9C3F4DB77BD4D06A29F6A38888531E515491BA40DCEE1A4F0227CC29E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1816	urdvxc.exe

Executes dropped EXE 6 IoCs

pid	Process
4164	urdvxc.exe
6108	urdvxc.exe
6032	urdvxc.exe
1608	urdvxc.exe
1816	urdvxc.exe
5812	urdvxc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "qlnesrhhwbseexqr"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "ntrlvbnwrjhwvlkr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "wzheelkshlhnrctz"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "nnnzbtbjtkbhtvss"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nbnjhtjzjtltljrs"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "jjhlllrltejvsbzl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "sebbkqshnjztwtjn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "wzrbshebthcrbtrj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "rnetvnjrbstvhrhw"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "rtsqetkccjktxrhr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "tkrelqbxekesskvr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "cwrwlhjhklnkkclj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ctlezhswenknbekb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "lbnczktqvesblhen"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4164	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4164	4916	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	90
PID 4916 wrote to memory of 6032	4916	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	93
PID 4916 wrote to memory of 1816	4916	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4164
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:6032
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:1816

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6108

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1608

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1936

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:5812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

hcjzqenb.exe

Path C:\Program Files\Java\jre-1.8\hcjzqenb.exe
Size 66KB
SHA256 57c19593c11597ffb516056c9588161384cea1581e4a721364179e19ce4ce382
MD5 46ed6354cb1df432e9f61f07a528b87e
SHA1 605c35636fc93b1bf791c13588de31e1dad8ad42
SHA512 d69ccceb3875afcee0189d6fe427a59ba5b2ca64466e0aa4267d2db88cc5043353b501a4eb158835ef791366a8681a9471ba25fdf405b5a54fc6efdeae055116
SSDEEP 1536:m5USSLNEggqvkRLy+HQwq4e01gS4JdW5ZYDzuiLS7v4:DVqdHBq4e01fZYDzunA
TLSH
T15F63DFDAC9B8EEC3F9F769390725B19BB535086122D9384839A049DCC1EBF4B231B5D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tsbknceh.exe

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe
Size 66KB
SHA256 6d795f2110547681259a779b1530fdeab07d6ac2a12855eb4b4575317c3ee3c9
MD5 ac3f7b8f9d653d1262324bd4dc69f3c9
SHA1 ba44339478bf3ad55a6672776e5c1f3b5a9280f7
SHA512 db7a1ce29075483da784b9e2e296e083fb6baa269a0188c409ca3b007749b0703b0b7622c2df0de5f1e8fbd04d2531f4b232985fb73ba6ba0e6642b42dd86395
SSDEEP 1536:fw3B+UpgVj/Et1Nbw2MgHxdZ75Tq/t/ZuiLS7v4:o3Z+EtMTmGVZunA
TLSH
T19263DFCEC5689ED1E6BB757C0A46FE5EB274172D76E0040B39F2CEDED48AA1143684C8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 53f5bc939a6344f14d1063308c9651446681de2d169e31ed0321948c48e1af37
MD5 6faeb89a4bcc602ccecdc362e9ba6cbe
SHA1 0e394dc5733d35e14242a8fc5ee1eab8a31c7608
SHA512 95339ef15cf43bd61ab5b2693ed5f320a15c0449cb3a07dde4932829ccae87d2a84fdc3347ea4c96d62f9b16f9ffd2f293ae7519269e953c350b61487c4eae18
TLSH
T1EDF0E1BFA111DD0DE5B30BF464766FC01A6A001A07928BB138D18CD3DA8D47C9E053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 622B
SHA256 654ea6cea0b55a5d042b5630f452badae885314081b14d751b8d426a2511c0c3
MD5 29339c6defa048f4fbd6f60de491674b
SHA1 7cd1c8e85fce85b7c673430003aa06dc39a3c7d6
SHA512 584f25b01ea2fa6101afb1dac228019dce2fed9a073ec26f9bf68a45ca504f6fdd644e341642e5854f8ddf64da8053a988a6844e2aba96c6568795d6a57b76be
TLSH
T155F0DD6FC342DC0B90320AFC11736F200D6624124BE6979636E29803E98D97C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 630B
SHA256 73ea9f76e168876c3ce635e5730d9547b7f33bb73b579e380eba48efc5744108
MD5 11bfae552a7930e24ae8b707158d1937
SHA1 548e0f1c039a1eac3ca6be0886bc8923e4735dc8
SHA512 8531357f46f0c8113b7195daed49142e6274dca4ce47a9034d7195e41014678c356cd78a8e2869aececb705b85e667783b5701c35ff41116299e7249e8b291d7
TLSH
T1C7F0A266E146EC0BA1F68AF474F15F641A3300190BE75B633580C997EACC4F8AF453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 167649355378a53d13d1c226a484740c54b5b65df93b48eccb547bd101e245e9
MD5 437b6d7cf3ac39cdc39905fb476dfe9b
SHA1 e6dfa686d1c27c33cc589181a60d191d3f8dd63f
SHA512 0ea08b52b9eb748f9645c75a0eb61e14da0806238b507a5865121df4a270e5e5a5258961039ce53525ca92abfe4c23a36d00967ce986494773b1780e7678aeae
TLSH
T14DF0027F6705DE0ED27357F021672B441A16046703A697B235D2C883D18C1AC1E013C4
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 1ad22ad5cd6d646e7b2eaa358921cdf00c5510ab2a7641d3188435fe823280f5
MD5 6f08a2f1e90daf7750930837c66b64e9
SHA1 362744f95907d11cd26564569cc29c8f2381918b
SHA512 681afc71acd65f8113005f5617c7dade5da964e8541f7aae7b86529f55002c1d2baba8f13f7a65136011a9a431050ff078b8228d9e4ca35f791413afce27b623
TLSH
T1BBF0ACAB9201DD0B92B20BF535B25F641A66043A43A62BB239D08C839ACD06D6A4A7C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 590B
SHA256 80a0cbe74b5e34f78f6564a81b4515de8f59451d743c59357f787c74c6aad27e
MD5 6a14694952b86ad83796fd32023685af
SHA1 5c7b812259c479e26e20da12f0ba7525eba0792e
SHA512 0bccf857a18389533dd08c377ebd7b75292c3479a0dbebd56fc75c2193740919ef32346506fa484b25fe22fbfb17669e0f42347811d74b7e9d16fc5b79e0739c
TLSH
T1B4F0A2EB6201DE0A95A34BB02535AB482596067A0BE647263D518993DA8843C59417C4
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 606B
SHA256 b7ccb55bd4884e09bb7950d78132c41dcd9364a75d5da7ee77cee3d2622bf4b2
MD5 505448a350911ae12344ba8856e2ba18
SHA1 72379666404ac7d54c4e09c66a94ea7b8191731d
SHA512 a4161398e84d0d6b68d6003d949768f72406dd447c2b846440fcd06e385d0c8fc023666250705bb6f0635df6f99e2007dda012a4ad78601453c70b38a9e2d263
TLSH
T125F0AC9F9202DC8EE4B64BF070734F741A22089A43EF4B9631D18C53A9DD1A86E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 54a272a6d4ac760e832a2fcff9bd06a10a8b2947fede90d665a9240881365960
MD5 870082e5ff8d55372abf1acbfbacad2c
SHA1 7f09bee94686d758b2437693813e214d3cdab97d
SHA512 485a6ae533c964db5655ebf5b30e91ee247657ab31670b6c104567a249d9c6d3d000754f039f4fd4264d438f0e46a528670fe5cf93c42b2278fb36476d90ef42
TLSH
T11DF00CFBA302DC0FE0769BB4A0B29F08193140164BE78B663AA098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 7fc9ca2cf8428b7bc0e9d0307a2fb1f6c0214f10f7f82a584cf7937bb8e5cd67
MD5 6d58b52bc488cfd50ccae3b36c8dc9bc
SHA1 7561d25bb3452d8560fc99c0c8ffcd6a1c0cc432
SHA512 d315d33fbeaf1bbf5f55cce4efecbde30889d7938fc555effd46abf01d579e12978ecbd179f8ce7ecbfd999471df685f566974027820f317a803410672915a99
TLSH
T173F0ACBAB901DE09E6B347F920621B502A1E001E135243B639E0C893D68EDAC5A867C5
MD5 SHA1 SHA512 TLSH

Submit Download

jlnjbnss.exe

Path C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe
Size 66KB
SHA256 117aca06a5e50142d63464f4cec56ffc751a5201ce704733b3384d3b2c09bf44
MD5 30d3a3c4f9bddb56e936b5e25166d356
SHA1 7fd75df9f5824ebbe6bd4ad760318e52d497615a
SHA512 64b6dcd7a049e362f78f6e14cb28a1e3ea1b79630db7c4844ddb62ddb94f3c740dfb4751003dfea8ea4690b62007e2327485f7ce3d261d699c3931ac88a362de
SSDEEP 1536:o5uwabRoEd5UKdEXJ+i1U3dEtQqSsYPuiLS7v4:og8KdIz7iWuunA
TLSH
T18163C0DE99DBCDD4FAAF3C3F0566A5A3B62D80AD76E041C728284DCCD1A42112E5D349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bkbbtzlb.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe
Size 66KB
SHA256 33b31cb9dd49f949698fb973b5306ef4e80624134a1cf774631bda974146912b
MD5 035ce8761ca1832991b9c16eb05de441
SHA1 3f2f66087a2df0f817f310a744f54c51828acacd
SHA512 bdeb04faf07bae9a19144bd52451d0a07b16307d76017e2083b3760264155d690e64b9f6f5e7f4ea1ecda68af8d73f70603b938344bca08a685044c041ba1bae
SSDEEP 1536:6g8tJbyEL7mA/blum7xFokcITOwEjom8xA0uiLS7v4:CtJbyMyFQx2CrE8m8xfunA
TLSH
T18863D0FE85B49FE1EADBBA7D050A3198793C01D4AAE0104B18740DCFD2E1A8DB6AC559
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 66KB
SHA256 5eebdf2b5f85aa22e19568c9400e15d58e7609062ff1ec6b0e64f72a250d4ce9
MD5 c8f2e5515034a091e54199e63068a450
SHA1 4a0b1eb2bd9ed44e45b61853cff548efead5de48
SHA512 6efe19751c1c1019266f9c21018fc3ad97750b3974f90ac45345a46c42dc3bce4dda7b5bc7312bf7b23d6637909343521fa2c5fa97b6f3cf42a58aceb2e1f1cc
SSDEEP 1536:0+fFhijc9dfBgJdEp7Rx5SB4eYbNAQCEW+teR5suiLS7v4:0QC49dfBfp7Rx5S6e2RCdHRuunA
TLSH
T19563D0DF8A74C9C3F4DB77BD4D06A29F6A38888531E515491BA40DCEE1A4F0227CC29E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1608-41-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-52-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-12712-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-60-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-22-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-64-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-58-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-66-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-56-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-68-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-902-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-84-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-36-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-81-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-62-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-80-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-43-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-44-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-77-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-46-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-74-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-48-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-54-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-50-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1608-70-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/1816-76-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/4164-3-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/4164-4-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/4164-5-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/4916-73-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/4916-1-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/4916-0-0x0000000000400000-0x0000000000420000-memory.dmp

Download

memory/6032-25-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/6032-19-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/6108-30-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-61-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-63-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-59-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-65-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-57-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-67-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-55-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-69-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-53-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-71-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-51-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-49-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-75-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-47-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-45-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-78-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-79-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-42-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-82-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-40-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-83-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-35-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-85-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-406-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-34-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-33-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-32-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-31-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-29-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-28-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-27-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-26-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-24-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-23-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-20-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-18-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-16-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-15-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-13-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-14-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-12-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-8-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/6108-7-0x0000000000680000-0x000000000069F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads