976cfd8f7660af96e9ddfad4c9e9dcbc88493580e59adaa8299ddfff87def4fd

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 56KB
Sample261014-jpb7vsas5j
SHA256 976cfd8f7660af96e9ddfad4c9e9dcbc88493580e59adaa8299ddfff87def4fd
MD5 d4f25fe0e342f57452cfd7e743b4d370
SHA1 c5c02fd3ceb8e5783e4cec3f9fdbf5daee691132
SHA512 9255f058e5d678e88187f142ae0c807707cafed3aca974791178b2dfdee4fd0886c388e2f5fbcaf3753937d441282abb868b386997a079f31a9b188a52087518
SSDEEP 1536:Y1k9Md/ebSIlkTH9aAUaungmudKEvoSJW4maze:tMdOjycdaunoKeJ7j6
TLSH
T1D743D0CD9E593E95E5A332FE198426A9F21004BC36F523425DB1CDCDD3D8F1806AE0EA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Contacts a large (1050) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5600	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
1180	urdvxc.exe
4664	urdvxc.exe
4660	urdvxc.exe
5564	urdvxc.exe
5600	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "bcnnjesltbltketj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "nehqkvhtlnttnrrj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "rjkjwjlrqhzctlzz"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\nxqsxhql.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "klksctvtbvjcvjkl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "qnbbsensjnhqkqkx"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\etberbbs.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "lrjcncqztsklltcl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "ehjxjcwvblhcjhtk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "cctsbcterenlvjnn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "tcxkrrhnkxtsncql"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "stbjhkjhtljlvceh"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "estkxlrtvjechhkn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "hethjelvxbnkrrjs"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "jlqsjjkjsnllerlr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "xnhzzbkhtehnterr"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "shcrhjehekrjlhsx"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "llwstznevzltnjbs"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "lqewexhqlljenrql"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "bhxzsbbbllrksrql"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1180	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 1180	5460	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	88
PID 5460 wrote to memory of 4660	5460	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	91
PID 5460 wrote to memory of 5600	5460	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	93

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1180
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4660
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:5600

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:4664

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:5564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ltsbrnkb.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe
Size 56KB
SHA256 7a0aa768770909e7ad6fadfecbb4fc3d756079ef8ff0385e1de5c2c898d0742c
MD5 93542c02b382f661ade71dd26f6ca018
SHA1 7265d179355c2828c8818a49bde6014a2425d521
SHA512 918e35d6f9ce18565c26117eeed6ec455c6371c89a69765c4ef64416a79f85108845b22141a492980cd6ede1e3d3552b84e051152164ffec11413499d2ea6ed1
SSDEEP 1536:ZoYRDvO8Ul8oWus5w6NA/zzmALqW+rJqAIJGfpz9HXb:xUWoVWwwAu8qdMYpdb
TLSH
T18343BFCFE462FCC5E8575F3CC042A5BEB1E81566B7E94023349069ECEA409151B3C6CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

tsbknceh.exe

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe
Size 56KB
SHA256 d16e847c99b34d3e342082b2548939acc8ad2fe3c084ee4aabed35bfc20b5866
MD5 fc8880bb8066689da8c6c3d845e07de6
SHA1 d8534a2d0c2ada3dcec158da53caf7888f54e454
SHA512 aa993a863352f851be4f7998ce8540186a11f3b7f9372441c89ec00ff8f5f0bc75b9de4d045b157bb520798184eea213093da10534df9d6f1d9c689334846e6f
SSDEEP 768:Ozyh2ap/vROs8MtUmyuKmjsRCiZCXmDWncAY2Fe5zHYt1/OYHEGY2NI71tBTNyKS:JAo9YRBZCBnRY2Fe54Oq5qBT8KS
TLSH
T10B43C0DFE6D08ED5FB97603D500972FABDB0190867F836145820F9DFACA290815AB49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 653B
SHA256 4712887c2212e13c0088b0554b463f4bfd24bff60a8780947d30cd2399994815
MD5 b6360a7c16d8f46862aac4f88cf8a32a
SHA1 f63d5c03ed09fcaed8f6d5e727581a89026d3c2d
SHA512 514957a51070e6db5890f8f855ad04b2fc9c3bfd1cef9d2806e89a7c8125af69d3fec3d2b1e0f59813d1635e43a950adb590221bb117d64698dd13cb9172cc09
TLSH
T121F0FE6ADA40DD09D1720EF130765E143516045A47A787B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 587B
SHA256 2301731ea018f36781ad65f04042408f60b555ebdeb6e29e7471f7649f4cbb84
MD5 0abb7447d589372f1845f40ee0ad7cca
SHA1 f080f1eef12e7873f97dfb2a88c4eb6657105486
SHA512 3f3d05358c9a5c899e7821442e00729a2dc2c6d14ca561b025b2b15d50eda8b2798987d51140d22385506393b1ce8cfd86f46cf86c7e49259ff2263f4efbaca9
TLSH
T1C7F0E1BFA111DD0DE5B30BF464766F801A6A001A07928BB138D18CD3DA8D47C9E053C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 622B
SHA256 edb71d4f4ae5fae9f4a186a7e6b1e1e10fe076b4fdc009a023bdafb85b6c56ff
MD5 99012f8a2980d291608a045b89b7035d
SHA1 6d2174209a188cc0f95271f961315c8461fa3739
SHA512 d462ce8ff3ed16d151baf6c56407075512a2bb89e4fa456c7739423cf20d840d3aebfa5adac057d3e0d4d33f86b917c07961f5d1141536bc1a53b13579ece40e
TLSH
T1A9F0DD6FC242DC0B90320AFC22736F20096624124BE6979636E29803E98D93C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 599B
SHA256 7c4bf0c6e7ee3c2e6e9b0a6cdadb01acbd5803e17b4035d3630e8dc64bd39cec
MD5 2f6c3c05b9a362781c2018c7d19d1973
SHA1 2f41f72e7cad30bff216576257ca3542dc30e4fa
SHA512 787b11e6f9783a66ff0df5a77d1955fa32331ccc3ac7d11b8847185c4c1fa7877dbf334ee5c15b0b29aebdfb9ea3e263a9c13bf18f14a052d170946c4ff91110
TLSH
T1DDF0027FA705DE0ED27357F010231B441916046703A593B235D2C883D18C1AC1E013C4
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 4c7c74cc7c2d37674fe2d1415f92af87ab7220a7dfdebce044d1191403c6b494
MD5 d9a2717c15e6cb34ffea797b633cbe29
SHA1 6ff6bdbe2ec5677cd1d5c5dadb8e2cad6d1bdc75
SHA512 95e7b2a2abb1ab7f4048e5fd70225468dd46b0cb7f12e30920c5ab17b47e1cbc42072089f806b9c1ccb9a4a28d1198f3c6f9b42ed09e399946d15f1ed2148a46
TLSH
T1BCF0A29B9301CD0F92B20BF531B25F641A66043A03A62B7235D0889396CD07D6A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 4e5c7f77a4d672b5a48c73d9b41cc0070f4764f574ffec3b377e88a32aa7df86
MD5 328421745498aa1d2f46fc02b141ea22
SHA1 ae78ee6d3928c4dce2e182f8070d0d6b17fa364c
SHA512 ee65bf3159790184ae2cd6488a34de0cb750a422ee6ce74ffbb5090dd259532eb47dc991e9dd1e0ad28847a38e5b867a5f24295a752074388adcc3ba59cce13c
TLSH
T18CF0E1EB6301DE0EA5B34BB03536AB8825D6037A07E64B273D519A93DA8C43C5E417C8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 595B
SHA256 93e8c03f308f582d199de6f3e571349ca6ee7afd04df7b7e5f3b08197a778dd2
MD5 f2d433b94182f477fa2362bf665f5a66
SHA1 fee6e29e6e0487b4889a6bbbc92c792602ff56b9
SHA512 2a6c3269f9e2ab03bd5d61441ee216004b3c72b605db44fd4dc0ad91f435c8b6764f6869ffea3a855b689eab98382ef8ed4ac6116c3107700aa65557b3dc5cc1
TLSH
T16AF0AC5E8201DC8EE4A64BF060734F641A22049B43DB4B9631D08853A9CD1A82E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 ad570909b3e21b37feaf789be9f6466541b263961a00797afe6589f4b72a3689
MD5 e914fb6092d184a2423349d2ed5ce391
SHA1 721796a1c07fd92b8ba669287ec6702b20e83529
SHA512 d089ade0c6cc621b41e888cbf46ce7148078c5d9fb17a1c4e074b7c440581fa3f79b466d725ab8a9b2ed84b3e330d28266e0210242706e1f9a789280c2b43932
TLSH
T182F00CFBA302DC0FE0769BB4A0B29F08193140164BE78B663AA098C3F5CC47C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 ce16ff5b9ddcf9908f75e6154f3946fa6c6b23492288c47fbe5da158155c2221
MD5 f9447500e8b78474af895de9c1840a89
SHA1 250b0e7986c9b0ce7dfa1c6090dc6ab3293a106b
SHA512 fe60f1a3c061d7f27c838c1db39777bd9bac43004983a5990bfacad678aabd6cd94388b01473ec938407299e3539f3c619832dffb66d03158f5183bd90c7768b
TLSH
T1B5F0ACBAF901DE09E6B347F920625B502A1E101E136243B639E0D893D68E9AC5A867C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.html

Path C:\Program Files\VideoLAN\VLC\lua\http\index.html
Size 15KB
SHA256 3e24b189194cc434f7df8b3b79e01756623ec4b6ef0c6997b69d2e4b7bd62869
MD5 3a465638e0d9b385d2abe28fadeecd05
SHA1 fb267b6cdf09b9bef6fae1cec443f2fd374df9b6
SHA512 ba8bcbc70a130f1aeb75be72f290a196998eb30c0965ad5f372421bd23c7fb376168cc8cc38a5275bcdeb4bea543d921a66c6a87734c2bb54c2ff70d2c0660d4
SSDEEP 384:U2HKAFP1ccA0BANiAnWStiKruUnfpNdypPmF6s92BEvIu/JE:U2HKAFP1RAGST069/G
TLSH
T179625182F18EB63B1611154305BB27A4F27FD93ED340B51EF4BC20B721EE9D8512A7A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 6c8175fc67981254bb7807e14ca2f1b3087d616bdf6a5291e5f1e8303a5636f8
MD5 da4ac0344a6cea4ea1c12d3980412fd7
SHA1 619cad8e29076c79fdda077444f2639c693fb9c9
SHA512 4d0da60a29c4b8933304aa976c608ec5210bfd6bfffa4019648c4f4071e295c33b0c84bf76f1e32d96a8be2b41f44cbd69eccf8ee30a18462d8e3c25de039153
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtl4:6kEfytgP8qmrtfPFLhXv/j/wL/Rd
TLSH
T1A0B14685B489AB360311064251B77B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 be2444da786629081d966e76943b2ff1aa4e38e21b8410acde01230bac9271cc
MD5 6d265215b6a355657486b9b94b0966c7
SHA1 651049e5ac516ccd57213914b2b0241767d3e86f
SHA512 4e2d22fe68c251295a0e0d2787d5f0ac0dc06114cec6306163f48da0f7985abd3607df1107cd0765673a31209d5967c9c73354ef19ac0bd25b9fd6b6694ee8b8
TLSH
T12C517309BC09DE2D452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 6e8ad49268294d948c65b504df57c03ca90c982b8631791a50bb9d7dff585fe4
MD5 8621336a8a0dc2dc16493afdb5828c64
SHA1 486ed225935db023664e19bb708686458cdb8af0
SHA512 1a0825445e8193d22a5af50dfd4accc0a527399e4049d9e3e49d04aa2196d509b90b66bebc32616066a2d98342b5c6b1bce479b305fc6c0af07f079b91754769
TLSH
T139517745F84DEE39012044826471E39DD02FDB3EF354F8AEB1BC467F6296AE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 386d7e02d684f5f31b3611076cf979cbd293793a4a8400e1d5d431061b87c4ad
MD5 1c33a68fd3cdd70c32fc006c96e06464
SHA1 61e3f2a8e80f624f3aad4051bfbdc7dc2ab69af4
SHA512 5c559ec024585ddd5e230edbba7e85fa81b45213ee0945ee70578e0d27d7e8a06d266b954a9dc7e143fae0c6e6694610f1817dfea32a208129baa44b0c6df3b0
TLSH
T19951324ABC05DE29452004C2A572A39CE16BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 56KB
SHA256 976cfd8f7660af96e9ddfad4c9e9dcbc88493580e59adaa8299ddfff87def4fd
MD5 d4f25fe0e342f57452cfd7e743b4d370
SHA1 c5c02fd3ceb8e5783e4cec3f9fdbf5daee691132
SHA512 9255f058e5d678e88187f142ae0c807707cafed3aca974791178b2dfdee4fd0886c388e2f5fbcaf3753937d441282abb868b386997a079f31a9b188a52087518
SSDEEP 1536:Y1k9Md/ebSIlkTH9aAUaungmudKEvoSJW4maze:tMdOjycdaunoKeJ7j6
TLSH
T1D743D0CD9E593E95E5A332FE198426A9F21004BC36F523425DB1CDCDD3D8F1806AE0EA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1180-3-0x0000000000670000-0x000000000068F000-memory.dmp

Download

memory/1180-2-0x0000000000670000-0x000000000068F000-memory.dmp

Download

memory/4660-15-0x0000000000670000-0x000000000068F000-memory.dmp

Download

memory/4664-58-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-29-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-5-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-10-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-12-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-41-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-13-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-43-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-6-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-14-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-45-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-46-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-16-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-19-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-48-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-50-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-20-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-53-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-21-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-22-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-54-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-23-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-57-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-24-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-25-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-61-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-26-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-62-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-27-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-28-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-65-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-66-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-32-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-30-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-69-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-70-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-31-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-73-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-523-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-80-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-74-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/4664-79-0x0000000000680000-0x000000000069F000-memory.dmp

Download

memory/5460-77-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/5460-0-0x0000000000770000-0x000000000078F000-memory.dmp

Download

memory/5564-59-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-37-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-75-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-72-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-572-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-33-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-71-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-68-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-67-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-64-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-63-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-56-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-39-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-81-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-60-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-55-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-52-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-51-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-49-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-18-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-47-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-44-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-42-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-40-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-78-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5564-38-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/5600-82-0x0000000000770000-0x000000000078F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads