7a663fee18d3d11486a98d97e1a37d7c61e6fd5a2b7fd65884310de289eaede2

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/10/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 56KB
Sample261014-jpr83sfb84
SHA256 7a663fee18d3d11486a98d97e1a37d7c61e6fd5a2b7fd65884310de289eaede2
MD5 aa9b60466f44aa893a22032df2856f40
SHA1 00c7f8476be5027ed023939c29719334274ae211
SHA512 09e79aace85449c31caea47d09fd5bbdf429c4b005880bca5e50550e2777d11bd47b44e343876021238e88637494e36700f90321f7e0a083d1f268d115fc94bb
SSDEEP 1536:ldL3hJK0K2ngXIDVlbHi0v9xJ5s098j8fMItb:ldLRJK0DBDVw0v9xs09a+b
TLSH
T13F43BFEF9164BED1F4F7283C0774E8AAE55C4E6075EC102629384FFFE182552069C6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5056	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
4812	urdvxc.exe
4932	urdvxc.exe
2320	urdvxc.exe
904	urdvxc.exe
5056	urdvxc.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\DismountPush.shtml	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\DismountPush.shtml	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Advertising.Xaml_10.1808.3.0_x64__8wekyb3d8bbwe\Microsoft.Advertising\vpaid.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "hexrjhjlhsvlwxre"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "sjrjjjxlssrxntcj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "jqnlqzhtthhlkhqh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "shtxntvveznkrbvh"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "etkrjlvwtnrsecrc"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "ztxzrveerswsentn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lbjnrtrl.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "ejvekslhrvbwhwkl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "sncrrczbjtkettns"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "nsrwhwrrtqhkrwec"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rsczjbekrljhxbjt"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bnsqtcswsrrktttb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "kejvjjzlleqhxenj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "lksbbhbrxjjjhrzt"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\lvsxvbxs.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "ktkjshwnnvthqjts"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "vnnkhevbevbwshzs"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "thqxwhnhtznnkwle"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4812	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 4812	4768	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	86
PID 4768 wrote to memory of 2320	4768	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	91
PID 4768 wrote to memory of 5056	4768	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4812
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:2320
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:5056

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4932

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 94709d185d4c1cadae19522a68fdc60de2e6f46f839613934835f4127b0517f4
MD5 bf59791bb80d61a8593a27f4ea9851c2
SHA1 4cd4f6539cc3b17a49c173aba5477a5217293c31
SHA512 f46356d70518bfe0c6ea83a9798a3a54f076c1657a9dd05b3ab9f8c76f23cb60cfbda0e50f275ade7005decde276214f870994cea3406e4e0e47483e7a205ba4
TLSH
T17A11E2EBEAE4DB12B76051E351E469D57BA982F51D63D84939118202D080E35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 662B
SHA256 198279e9a52a2fff060311c47c63996f61669edafbf18b56e3387b50b0b7dd2b
MD5 07c2afe5355f832517ac7ba80b5c9fe4
SHA1 823c01bf9212fee4d915bab65cc8699794cac8ee
SHA512 68bda2be87f48d60bf0528e4aba5891d3a6c5b25a38c07a44ca93c54382cb3f791c65160d1d9c11fa0e9340530466c74a8435ece8db72761382181cabdad8e6e
TLSH
T1D001FEBADA40DD09D1720EF130765E143916085A47A787B23981D883E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 587B
SHA256 2301731ea018f36781ad65f04042408f60b555ebdeb6e29e7471f7649f4cbb84
MD5 0abb7447d589372f1845f40ee0ad7cca
SHA1 f080f1eef12e7873f97dfb2a88c4eb6657105486
SHA512 3f3d05358c9a5c899e7821442e00729a2dc2c6d14ca561b025b2b15d50eda8b2798987d51140d22385506393b1ce8cfd86f46cf86c7e49259ff2263f4efbaca9
TLSH
T1C7F0E1BFA111DD0DE5B30BF464766F801A6A001A07928BB138D18CD3DA8D47C9E053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 622B
SHA256 159e234364fbcddb6484197f56d4c5c845abbf0ecead47bf9e2573a340e11226
MD5 24ad99c8b5d6b2e3904349514ce49717
SHA1 6b1002306307cf1c24096d22782d0b45518041ee
SHA512 5d3e755deb23faf054b4d593d0ea84ca2e095ce2621ddee898c90a084359c9ae92f95ab14cfeffb4deed41b293d7611ec30ee047faf859a69f1a442616b019c0
TLSH
T1E5F0DD6FC342DC0B90320AFC11736F20096624124BE6979636E29813E98D93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 c97098ab104532ffc1841446846d60c14f3e82dcecd1d59ee66acd6f09a2350c
MD5 178c57ce01688ccd47914525549fffc5
SHA1 911032ec29da6cdf0f84e1447ed986cf3f2ca9f7
SHA512 7e1231e66026629a7634d107cc030f3491a9063b1ef401d65293870a7f61c382c316c361e8d2a366fd7eb708e294974961baaaa0aa2cf499c4d15cf08c84e77d
TLSH
T13CF0027FA705DF0ED27357F010231B441916046703A593B335D2C883E18C1AC1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 575B
SHA256 7a80f4b9d83ab071a0b5a9c72e45401962830f579cef1ded29533230a52ffb6a
MD5 01888ef7861baa98bf5f310ab64c91d4
SHA1 5c1ff415b9e6b15b711d19b917053093d3aa83b2
SHA512 8668dc667b64f226848a77d2fa4bbdc3fd1305f768842f47accbc49dc729a1b8ef3a26b6fbd24833ad8c1e21bdd01fe9b7e3b465abd6293740468a51a5acc36b
TLSH
T17EF0ACAF9201CD0B92B20BF431B25F641A66043A03A62BB239D088839ACD06D6A4A7C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 580B
SHA256 9c322496fb9f0b24d0fe5a689ba5e8713588fcf70b173a0f8c9ee11e46385c21
MD5 a10df6d84906d9d90fb0b2b42a679dcd
SHA1 0d137cd8ddc2b8a516f9264cccd9360a6d5b1397
SHA512 2830f46831d99a0ca96b45c21e4357b3efe42a9592eab43ed150c62e3daa8a92847169e0e2da874f3419f66d82cae2895e5e650677935aa088beba7cb628ead1
TLSH
T114F0E1EB6301DE0EA5B34BB03536AB8825D6027A07E64B273D518A93DA8C43C5E417C8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 603B
SHA256 71dae170e02749b8921acaeffb31449c21251dff831cadc9053039913530cea2
MD5 5581c4766ba93758b99cdb432df88495
SHA1 ef5cacd4ba6f3dfcd8b287de05d9612725999825
SHA512 3bc4fae28357985a7fbad6a4673a7945f117a9fd0e7bbb0ad75ab4b73ea69bc744c24419172ee3a652ee583245304d43f8ad31958bbd460bc2e71d63441068a1
TLSH
T188F0AC9E8212DC8EE8A64BF060734F641A22049A43EB4B9631D18C53A9DD1A86E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 f7a904a422fe171df2de6964331acdadb70ce8bb0b24e785eaf167c5d365256e
MD5 006bb7e1eeb357801505fc31326341ac
SHA1 908911eada56fcf1b02e2e5a717f1ed6eebdddc3
SHA512 fab58363659c00de7e374bc371c09c272c0b3d13879db8efd2a1f1864b5359dbb5d21d02c78261d33bc0dbba319b8e3de2752b508ba1ee0254cfd8cb09972562
TLSH
T166F00CFBA302DC0FE0769BB4A1B29F08193140164BE78B6A3AA098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 580B
SHA256 9f0e12f7731ce4f0952d0be667121dd37dc3034aa7c6b969fd2ccb8b44b6c948
MD5 0aca517660f31ca9b1c86888ae62d411
SHA1 788dddd1c8a39db9ec8eec1050381f1a70b9ec90
SHA512 c12e12174d186138962c70186eb985f506b8d6f2014d902dbeae6e9055b8fa8128b8d28f88c7a332910fd79af7020c528c08421e4091cdf6d40a7e885154d77a
TLSH
T185F0ACBAB901DE09E6B347F920621B402A1E001E135243B639D0C893D68E9AC5A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bkbbtzlb.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe
Size 56KB
SHA256 3b7378a1575c93c09125753a2717df527a56604512364cd6a181acce2d4e51b3
MD5 b19444a3e0b3c7014ae8cb0d51d991c7
SHA1 39c0a5efad4e0edb1587416c214f7715684b90eb
SHA512 d80fe7e5a99323aa6057351428783575fcdc7df0098721503dd30b723d4647b2220f85231b27d1572bc3a67578ba1742e8327b21cb44cc679b966dd7995e3a0d
SSDEEP 768:MfsLDTVLK96yMDekXu2IecxjpCiTqhYJqoadD6a90Vzt0gNgItE5GEyBbrur4sdp:FDDyHRxDTq6cJ6j5wFryBrsp1djxKY
TLSH
T10643BECF9550EBE2E9EB343C6D0BB16FF2661008B1FC880539A4A2CDD4B525CB2D955E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 a5fd99829aaf18f91680dd0e7e82a60f7d9f4af351b10c70e1b7b70206d80fa4
MD5 75e6df789b4b32e70b0c66c36a08bc2d
SHA1 77d7835631990d9e118490b545034181b85c039e
SHA512 9f47bc423c6c5ee1f8312daa169ede6af6308f9c977fcbf64c3d4ef8b413d6205d97c572a314599aad2fbad623f6c43c077085d301f41ff62385a826eb9bf2fd
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtlI:6kEfytgP8qmrtfPFLhXv/j/wL/RH
TLSH
T1EAB13585B489AB3A0311064251B76B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 be2444da786629081d966e76943b2ff1aa4e38e21b8410acde01230bac9271cc
MD5 6d265215b6a355657486b9b94b0966c7
SHA1 651049e5ac516ccd57213914b2b0241767d3e86f
SHA512 4e2d22fe68c251295a0e0d2787d5f0ac0dc06114cec6306163f48da0f7985abd3607df1107cd0765673a31209d5967c9c73354ef19ac0bd25b9fd6b6694ee8b8
TLSH
T12C517309BC09DE2D452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 328156070ca22a447206dd46538494fd411f27695d67b8f14462e463d0b1b212
MD5 13bbb270386610a4c6b30f49c49b1f01
SHA1 c2142324c6aa4bedd40e06fe553dba6a69a803e0
SHA512 147b9c29f08842b05087970cebe5e90cd4f45acb621021d1aa9f36b0a489851d5e0391c86348d7065dfa74ac38f719c845c02e856a4319b1c626ae13797fe1fb
TLSH
T1A4517745F80CEE39012044826071E79DE02FDB3EF354F8AEB5BC467F629AAE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 cf5c192bdaab386fc211c83470094ef5d6616465701ea4b48d19c0d20842e7e9
MD5 7167d7ff3c8039d6231cc0bda6a6ec42
SHA1 cacc449c9e655e95d9a69b6b4fdcda935c0d7551
SHA512 eca902ba7f23d25feb2436d5ee50e79201b6bb82b05f2be8ec633b05568482573d865212e7bdea8ab3c66c1adbd1ff55e9013709fafadeff37971cf545b1af7f
TLSH
T17B513349BC05DE29452004C2D572A35DE16BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 56KB
SHA256 7a663fee18d3d11486a98d97e1a37d7c61e6fd5a2b7fd65884310de289eaede2
MD5 aa9b60466f44aa893a22032df2856f40
SHA1 00c7f8476be5027ed023939c29719334274ae211
SHA512 09e79aace85449c31caea47d09fd5bbdf429c4b005880bca5e50550e2777d11bd47b44e343876021238e88637494e36700f90321f7e0a083d1f268d115fc94bb
SSDEEP 1536:ldL3hJK0K2ngXIDVlbHi0v9xJ5s098j8fMItb:ldLRJK0DBDVw0v9xs09a+b
TLSH
T13F43BFEF9164BED1F4F7283C0774E8AAE55C4E6075EC102629384FFFE182552069C6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/904-36-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-76-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-38-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-37-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-67-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-12-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-40-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-65-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-41-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-70-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-44-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-45-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-64-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-898-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-48-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-84-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-49-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-51-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-83-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-80-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-54-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-79-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-56-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-57-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-74-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-32-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-60-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/904-61-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/2320-10-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

memory/4768-0-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4768-72-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4812-5-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4812-6-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-58-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-46-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-69-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-66-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-63-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-8-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-75-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-62-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-77-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-59-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-78-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-55-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-81-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-53-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-52-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-82-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-85-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-50-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-86-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-641-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-47-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-68-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-43-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-42-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-39-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-31-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-30-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-29-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-28-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-27-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-26-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-25-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-24-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-23-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-22-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-21-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-20-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-19-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-17-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/4932-13-0x00000000001E0000-0x00000000001FF000-memory.dmp

Download

memory/5056-73-0x00000000001C0000-0x00000000001DF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads