88bc1a68355ede0cb4f9686b6fb53c301ea0e8d2d275de57c764dfeedb9fdd80

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 94KB
Sample261014-jptrxayt2m
SHA256 88bc1a68355ede0cb4f9686b6fb53c301ea0e8d2d275de57c764dfeedb9fdd80
MD5 a42929b7e234b338335586f231074010
SHA1 ae29d776762ec4d82896852376fdee21b12c3fb8
SHA512 ae06dfae8d1b84ceb3205e20c683c89937528abab95d0f52be5cd5be67a5c62e85aa9c1a2b63f545c142ca8d6136e2e2567a9f10ecbf12409f042e49dfd7ae5a
SSDEEP 1536:OwSkmMoeJ0EZlH+JB8Z+lmrEssZrw84cZOfp0/erH5/gS/WiIScdI6RJV9zbn8R:TBoK0EZYKElmwssZccZOTrvIScj3zna
TLSH
T18493AEA362D0C262DF9F06715A4D396AB6FE0EE038E298417D1C69D9747DD4183FAE03
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2572	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
1732	urdvxc.exe
2548	urdvxc.exe
5716	urdvxc.exe
1356	urdvxc.exe
2572	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\LockFormat.htm	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\UpdateJoin.shtml	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\UpdateJoin.shtml	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "jnzsxsrrttkctkbj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "sxksjjnnhjlnltel"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "sbjxssevllvnztvq"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "ntrhnkskkbstwczr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "jjneqtrebclkhhek"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "vnbkhnejwkjjlkch"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "bvkheebxntrhhvhq"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "rckhhhebvkbbttzv"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "tlwkckexvcwlrlht"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "cjzewnejhrqvhjtr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "nerrcktsvsswrjve"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "jvxvrhhjhhbljjqr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rxhrznnqblxkwrte"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\ = "lthbjhstnheqjhkv"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "tsnsrlwlkreseeez"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\LocalServer32	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "wtenzzwnjnrnsrlb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "qsezstqtjklshjjs"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "hknrbbwjhnsjeztr"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1732	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 1732	1296	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	90
PID 1296 wrote to memory of 5716	1296	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	93
PID 1296 wrote to memory of 2572	1296	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	95

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1732
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:5716
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:2572

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:2548

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.html

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html
Size 3KB
SHA256 a2aa65c6582b17a50f90bfdd0040f3343b5cc0131c81958e9d7fe1c17ef00ea9
MD5 9294b2556549b6a2fe311046f5d0776f
SHA1 f29f46a32478110f235f4cfef52c48b58d66a07b
SHA512 3189942508e1abe0746998cfd573b6e687b580a2119102bdac715f45d7461fdb76a86beef06e1998b216f960de450ba442ae46d87dbe41b47e11ba25b78fc3ae
TLSH
T11171662A1D179C39723292B4F1129248C751C55BE75BCBB470EC016F2BE0BDC49976BE
MD5 SHA1 SHA512 TLSH

Submit Download

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6a165c678de22d78b04eebe2f9f8397747a5658d926353a3946e901787b5fb4a
MD5 0448139ea2bd6cf1d780bd5201fabbbf
SHA1 41616f6a4c836cfd1778f2184fcc6ac03173f436
SHA512 970b955bb78b4fa939496df1682aad42ee56483e92663dc8b397640f09f489193425a228b2e6f19223a771e76545c969945f905da95754df932cb25e74e30be3
TLSH
T11711E2EBE9E4DB12B76051E351E569D47BA982F51D63C84939118202D080E35C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 48179ef88048e876b0a7fa8157a4a054a509c36f185c4414d92b55c25179fd6a
MD5 0e2420c4d5ee945294c8a0cb1f00244b
SHA1 c518540b1df25a05304fbdf889f8ad237d2cb047
SHA512 40c0b11fd0aa6d95f10b8b9a16a2742e4b86e5cf7798ed20f56865b32e697a92a458808379ebc185ff785ee1aaa6b1bd65901ecadb08231820b693e768627273
TLSH
T17331F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 654B
SHA256 6fcd7fdc38d5c02cdccbfe530f3972eb4285a374c5a94179f90e9d331f7af04d
MD5 fd0613f95bddc3b20774697a14acfe30
SHA1 1fe5163e076f4be0dd092c2e815da3d8583deadb
SHA512 689dd36cf3a24c06c5629a2e5ae8979c80154c36885c97ef49b26b276bd5a86d2ae3ed2905a0778af193e2d878d5f7c88fa146423c7486748a42b2a407a53544
TLSH
T115F0FE6ADA40DD09D1B20EF130765E143516049A47A787B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 69b1cb697a2f5c4dd47c20d209faec53b905dbe0d026910756088a79c654ff49
MD5 6ceb92ffbc7c7a4d89d009b4a5f8dbdd
SHA1 4231c052c8e6a4cdace07a01a48d2908d45465a1
SHA512 3831b09cab68ac04d2180ceb905942145ea9e69915c5e7c9f85f778269a00ec6609e808303ed5c2ec744971374b878e3e7bf4a0f70da0c4350e106ea83b41ad4
TLSH
T130F0E1BFA115DD0DF5B30BF4A4B66F901A6A001B07928BB138D18CD3DA8D57C9E053C5
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 620B
SHA256 6b65d6b912acfc0375cebc1371b0c58f17bee707b3c4187c4dd83d306491d208
MD5 96fbedacd070a9b96cd6dc4230930921
SHA1 63229c8c3ae56207bd2fb9656f021c3ad6888564
SHA512 8d4a7bf02db1ffb292aba69d24f2310b119706457c6bfa0693731d444a74a7e25b28d5fb60f4fe5eec048d0b916aa79caee8b4f224e7d95aca9fc7a91f3d72c5
TLSH
T16CF0026FC342DC0B90320AFD11736F20096624124BE697963AE19C03E9CE93C5E8A7C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 f3aa6e8a156b3257787831bec62099ff48bd2e218e8fd891ca36b53d596aa8b4
MD5 2ae42c0d04b27cceb50286d6fe6ad6c9
SHA1 9f28b703852b925dbc11b6e88c953d486af40f93
SHA512 019aa44b583c4ef772091d87d4c4707178f18f41c62bd9014476e3033d2501726a5fec9b533a59e764442b15cf78756c8df3bb976abaf2bc242291ca11f54449
TLSH
T17CF0027F6705DE0ED27357F020231B442916046717A593B236E2C883D18C1AC1E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 75b80c34adbfa7dfe788c95c6f50b4f6402b080a4a459bc1aed02591918c574a
MD5 b0d0f0d48bd7258a129b4d71dae4a144
SHA1 232da953a26286c9eadfe0b4b3c421647e1726ae
SHA512 847051497b14001794f1039ce909bb6ea28f2fbaf91f1e69ec9ba6222f069791cfc3b162360fadc593860d0148013ba00d909601d7bdbe62e5da611214cafc18
TLSH
T16BF0A2AB9211CD0B92B20BF535B25F641A66043643A62BB235D08C8395CD06D6A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 590B
SHA256 54ca4cacbc6a17f15864504b229b8af8c1fcd799f420d2b931713d7b7306514f
MD5 b1c22007639b65f92a7ded39084a2005
SHA1 1ca3024e1919ae30347a64949f311f56ce9ca917
SHA512 b064ceff9bfda31d14979ab2c5b9de19b3fd17b4a552d539ad54d6179cd979935f459da9843d7c04f6675f46fea4bff586f6fda2be53b14b80dffd5deafedeab
TLSH
T11EF0A2FB6201DF0A99A34BB02535AB4825D6067A0BD646263D5189939A8853C59417C4
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 606B
SHA256 a5bd22e33e28d524072f92cce20d7f53c26bae508b8295bfe9895e14e2f28feb
MD5 4e262837dd932221903675162fccbdf3
SHA1 3ce4ef863c73b745a42d5a70aeadf7e9415f6df8
SHA512 c6a3ad054f791e3caf912fc6d84c9620201fe34eb03f488acee059bc5b4395c618462220d89a43f4459d31f018a79a7d30966ecd723fe5e65876ebe9657824c4
TLSH
T13BF0AC9E8202DC8EE4A64BF064734F641A22049A47EB4B9631D08C53AADD1A86E493C8
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 10a0ebd153b06b5d35e7991868468256119c76d02d79561f74387fb944b36a89
MD5 c6c4129304756387f0a33a138f836813
SHA1 8127f6c7954bc95893d360428f68cd27d52cd9e5
SHA512 16cfdf7374884123fca1a7f1a62e53f130f456fd984bdc8e5ab0f990fa7064d479c5949b53c156d6b5154bca020c95ef65ee4304a923e9632ecbd75c25c0acfa
TLSH
T155F00CFBA302DC0FE0769BB4A0B29F08193140164BE78B663AA098C3F5CC07C4E4A3C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 adac68b6a1b5a593ea18b3d56a231655a4b15b6702c89a08c783852bb7cbeb5a
MD5 4d853ea2077effff2704911bdffafb85
SHA1 90f5edbd48cbd594497b68ddb9a1b3fd002b4b67
SHA512 ed1fe69b06f81e27cb5242133a63233693c183598d498fe60678bc5e04e29e193582d46f53180d5c0f62079fbf0714c7bddffef8b299070dfe0ab88590b07ff7
TLSH
T100F0ACBEF901DE0AE6F347F920A21B502A1E101E135243B639D0C893D68E9AC5A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\VideoLAN\VLC\lua\http\index.html
Size 15KB
SHA256 d9faf496d3d4327ba8b87d4efc847864c571ba82db4eadd3b1e7c9e0ae68e244
MD5 e8785507ad1c58f0b7a0b68677846758
SHA1 5f14011a9bd1186d8cdf605011417030d85b1545
SHA512 c42d9c63262dc4d60891ad91f08d4b9bbc21b6ea772db08cf0e5fde9f31ac5e0c7bbbb015fac1013e8aedfc1cae1b29867bfb917a0b79217073eb2116ebcebe4
SSDEEP 384:U2HKAFP1ccA0BANiAnWStiKruUnfpNdypPmF6s92BEvIu/Jh:U2HKAFP1RAGST069/3
TLSH
T180625182F18EB63B1611154205BB27A4F27FC93ED340B51EF4BC20B711EE9D8512A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 08a7852bd6eaea5fb293086b884d8c1d21058139c6e0617f173926a2d44d08e8
MD5 8a7ac5ad074debf9208ffff22125aee1
SHA1 5fa238c9590dc42302917368613cead891846fd7
SHA512 8bf0721b296f75cf1ada5605ba7a2ab3e88fdc2586208d518461c1f85ed63153bdc7048ddc757aef2357a873f87cfaad8ceb41b519abf2366dea3ac6c5982d76
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtlF:6kEfytgP8qmrtfPFLhXv/j/wL/RG
TLSH
T19CB14685B489AB3A0311064251B77B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 be2444da786629081d966e76943b2ff1aa4e38e21b8410acde01230bac9271cc
MD5 6d265215b6a355657486b9b94b0966c7
SHA1 651049e5ac516ccd57213914b2b0241767d3e86f
SHA512 4e2d22fe68c251295a0e0d2787d5f0ac0dc06114cec6306163f48da0f7985abd3607df1107cd0765673a31209d5967c9c73354ef19ac0bd25b9fd6b6694ee8b8
TLSH
T12C517309BC09DE2D452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 cc3ca23a4f0713cac2a3f1749f34b348015c9b00bb0ddd860981bde7948652e3
MD5 13d8f4ca8259bc9e0321f90b8f61113e
SHA1 800826e7a3774ce582e5d10db9caa1063bb470eb
SHA512 4979ed9fd939506e51a965de289f809c06314e05f14ef994d6ca4a18a97c176bbac4c735602965f5edd68106dc49d0f32f34bd220f8d2660f56ff03a6f1a5a1d
TLSH
T124517745F80CEE39012044826072E39DD02FDB3EF354F8AEB1BC467F629AAE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 d3efc744a0ace51bc2f15f94157d24e383940a63470dd49fedc758526abb5564
MD5 30526b7bd50381ae8017bd9700a9ea92
SHA1 737554cbb8988bb8b47a960b68d725d87bd9465e
SHA512 f66567b06f0a7dc4c41b2bac9ba14ddf533516890688d847bdf8475366afa6ecceaf08b4d42c0307045a140f7df595ef993316bb3376aea63e1964156a0a590a
TLSH
T1D451324ABC05DE29452004C2A572E39DE16BDA1DF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 94KB
SHA256 88bc1a68355ede0cb4f9686b6fb53c301ea0e8d2d275de57c764dfeedb9fdd80
MD5 a42929b7e234b338335586f231074010
SHA1 ae29d776762ec4d82896852376fdee21b12c3fb8
SHA512 ae06dfae8d1b84ceb3205e20c683c89937528abab95d0f52be5cd5be67a5c62e85aa9c1a2b63f545c142ca8d6136e2e2567a9f10ecbf12409f042e49dfd7ae5a
SSDEEP 1536:OwSkmMoeJ0EZlH+JB8Z+lmrEssZrw84cZOfp0/erH5/gS/WiIScdI6RJV9zbn8R:TBoK0EZYKElmwssZccZOTrvIScj3zna
TLSH
T18493AEA362D0C262DF9F06715A4D396AB6FE0EE038E298417D1C69D9747DD4183FAE03
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1296-0-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/1296-79-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/1356-68-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-46-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-60-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-1031-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-83-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-81-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-76-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-23-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-74-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-39-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-43-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-45-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-44-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-62-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-72-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-49-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-71-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-59-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-50-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-66-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-53-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-65-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-54-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1356-56-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/1732-2-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/1732-3-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/2548-30-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-34-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-61-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-57-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-63-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-64-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-55-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-52-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-67-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-51-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-69-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-48-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-70-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-47-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-73-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-38-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-75-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-77-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-37-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-36-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-80-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-35-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-5-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-58-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-6-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-787-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-33-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-32-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-31-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-29-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-28-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-27-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-26-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-25-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-10-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-22-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-20-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-12-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-18-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-16-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-15-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-14-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-13-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2548-11-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/2572-119-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/2572-82-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/5716-19-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/5716-24-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads