7a663fee18d3d11486a98d97e1a37d7c61e6fd5a2b7fd65884310de289eaede2

Analysis

max time kernel
150s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 07:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Size 56KB
Sample261014-jpr83sfb84
SHA256 7a663fee18d3d11486a98d97e1a37d7c61e6fd5a2b7fd65884310de289eaede2
MD5 aa9b60466f44aa893a22032df2856f40
SHA1 00c7f8476be5027ed023939c29719334274ae211
SHA512 09e79aace85449c31caea47d09fd5bbdf429c4b005880bca5e50550e2777d11bd47b44e343876021238e88637494e36700f90321f7e0a083d1f268d115fc94bb
SSDEEP 1536:ldL3hJK0K2ngXIDVlbHi0v9xJ5s098j8fMItb:ldLRJK0DBDVw0v9xs09a+b
TLSH
T13F43BFEF9164BED1F4F7283C0774E8AAE55C4E6075EC102629384FFFE182552069C6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
420	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
932	urdvxc.exe
6008	urdvxc.exe
3824	urdvxc.exe
2496	urdvxc.exe
420	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\StartRestart.htm	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\create_stream.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\ConvertRestart.xhtml	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\StartRestart.htm	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lvsxvbxs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe	urdvxc.exe
File opened for modification	C:\Program Files\ConvertRestart.xhtml	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\ctjbenlk.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "ljqkxhskwqkxrkbk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "rwjbhsjvwslzhjbn"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "zsejhzhqljqqlscr"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "jzctstwrkzvhkrhk"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\vfs\\ProgramFilesCommonX64\\Microsoft Shared\\Smart Tag\\1033\\rvhrjtnt.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\ = "wkxsbvkxhjesrvzh"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "nrsjbbnkkkqzrznl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "nhrnjhbnvwrkrssh"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32\ = "C:\\Program Files\\Java\\jre-1.8\\hcjzqenb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\ = "nhhjxnrjnbhnhrrz"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "rjjejlzewlrsesbt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\ = "hjhhqxlscntrcsbj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\hrbhlxhb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{BC0BCAE7-1BBA-0458-2B32-4B8627D5174B}\ = "hvjbshjejwvkhjnt"	jaffacakes118_Net-Worm.Win32.Allaple.b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "kernssrxhjsrssjj"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jblhnrhj.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Office16\\PersonaSpy\\tsbknceh.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "lxnsnsqcbtsrxlbj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\jre\\revhnlhn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\ctjbenlk.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\nkkzhhqr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "kvetebqjzrvvbkbv"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\rkrsbexs.exe"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	932	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 932	4332	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	89
PID 4332 wrote to memory of 3824	4332	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	92
PID 4332 wrote to memory of 420	4332	jaffacakes118_Net-Worm.Win32.Allaple.b.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:932
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3824
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Net-Worm.Win32.Allaple.b.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:420

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:6008

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.html

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html
Size 3KB
SHA256 d4369b3f3de02a2e6fafb115bfba1f41b02ecb1d105a9a32dfe3ccf226e4f74c
MD5 f11cae2041fbbcc9bfe486caa22d49a8
SHA1 49270692ba0633c62cdcf13c856d96411c35448b
SHA512 b13e246e835643fb396ffc8f83886a1025fd8369664ce355617b66bc032a98059bd303f85c0d93eadd050a482d9c12cfb5116504f5b8e9d6807b06e41ef2dd26
TLSH
T1C071862A1D169C39323282B4F0129248C751C55BE75BCB7070EC016F2BE0BDC49976BE
MD5 SHA1 SHA512 TLSH

Submit Download

ltsbrnkb.exe

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\ltsbrnkb.exe
Size 56KB
SHA256 59d6135485168a05b16157e080c7a957a1d0c375ea86f9bd3d11e3729b5517be
MD5 781bfc6d3fc84a3e887faa0198796542
SHA1 e44728b0275dc7d9e2c10a3f7ca3ec0a5d191e0d
SHA512 5810db42ea031681e50a72e4fcc6840830be042b46314d78c94f098206e2a953cfc31ac9dbe6245be592ed4daa069b39e7f2b562d25c298bb1685c50fe84721b
SSDEEP 1536:YlL1x/sMTmAuy8A5+TTHcTnT4OMTZjHL8MxzOH:YlTtTmK8AM3oTlGjYMZm
TLSH
T1D543BFCDA3608DD3E9E72A7C5219E2B7F22302A5B9FC643411FB13C4F5D4A28967C469
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

tsbknceh.exe

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe
Size 56KB
SHA256 97b2d06260a53bb4788df9e90f3e6906dbf17fc2c96acb2c1d4491087a0e903c
MD5 0901dcd10ad1a895efebda17a9895225
SHA1 cd28cd3ac98c3bc41330a6a1baf64ace96724289
SHA512 6c4eddae0a797ec757ae63c84d3519cc3cc1119b0c14dfc1de386a7a2dc64470285530e018a3054910cd2d264764ec1b73fa4145d41db91217b471c0926bb51d
SSDEEP 1536:+vhG8sw2HXveH+2okqDRMUdwNRXcC9ndra2jidZs3G4JMD:+voABoDRMGwHJdra2jiwGcMD
TLSH
T12C43BEDE96D8C8C6F9F3A83C10C1EEBAF6701055BAD914493C739AFCE590BC0625C85A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 654B
SHA256 1b4e77b0dd333f929e44ece12cbc6a9577d74c535e0f3b388a3d6310e0dc35d6
MD5 fa90abca7ff039f55a339c78add0f6e9
SHA1 1087192172f92024411d6862c1d1bc87563b1d95
SHA512 e6f115d4495db24ee745fc8b07744efde6240e1025826e9845dd2b68e37abd46abdca1754adbb15c0f48de68ebddeb09906627078453ad93badea3a8c2f95e4d
TLSH
T1BBF0FE6ADA40DD09D1720EF130765E143516045A47A797B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 4c7f3d717029e763c93f26c98ea991352cf93156083863a9b8aa27f90758df57
MD5 215b8985fb125650e00bfbc34cb257b5
SHA1 a54f146fbbb0f5913b3813ef6b27258304bd5456
SHA512 a6d4365b4afe1346c7d300c1fc5f254412569fc16976f06792306c0ab906f0fcf498b4c8f53a28a6bb453818cf7ae0de848f2364a8be69c0b6860d61513cf451
TLSH
T17FF0E1BFA111DD0DE5B30BF46476AF801A6A001E07928BB138D18CD3DA8D47D9E453C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 622B
SHA256 2518e06f579b46b84ca95a566c2ecf86d42f33629b5d13b2c11fde24cb21302a
MD5 2e734bfff06dd1c1a363c491c2c8e1de
SHA1 47b68f5addc19f94dbd22cb4e0fd6568fea6e0fd
SHA512 3005e09a4b96863c6f69249b30db6deabdb55bf178fe108c21d9c7942bcac4d422dd90094cf1a61a2833bd9e85ca8d5a276cc06c0a3be0bf1c44f7a0014142d0
TLSH
T150F0DD6BC242DC0BA0330AFD11726F20096628124BE6979636E19803EA8D92C5E867C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 630B
SHA256 bec473f62771b38d0ef5254c6d76ba3455eca352ef288dcff310a9086c718578
MD5 67984ec916e6eb54f25b0400c8d99770
SHA1 9f385134c028bed7c9a4f37a36fdb294fd6d5b25
SHA512 1184f5d3f3e8f34bcbbae25c497369136b86630b89f7310cef24d53ee1d71c9a251c8c3dcfec9d808f279b0bd774802be392a6d7c3b9c3f0fe1e06a076e1f213
TLSH
T170F0A266D14AEC0BA1F68AF474F15FA40A3300190BE75B633580C997EACC4F89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 aa46b4f2652fbd334dd81c448a7fb7a77e396f2a59e101eff267467838cd9ad4
MD5 d687c0daa98fb23dedd95618b1f573ef
SHA1 819c90fc73595cb0c50422446a03fcf56982fb88
SHA512 bd5c03349933e8f50a87a028e7753650b19c52b7ba04f85c99d1287799efc5a3a22ef2073d81ab1786b2eae04ecc014957bb53ab08ee8dee8fadf6a86ce9dc8f
TLSH
T179F0027F6705DE0ED27357F010231B441916046703A593B235D2C883D18C1AD5E013C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 c5df27079e7abcfc4ebf272c5cbf3082363b7ac7d86816509eb2746a1b2e3cc0
MD5 e17a9424797aae5053fb62392bbc67ce
SHA1 f1f21d5611f3958eddfd00171845edb56dd3272b
SHA512 b2d937d5ca999f46370336e28b45186a979682d9df3d4a86b57510be5e32f7321417375eb908b4e46c7cc4de6bac8fb554333e54f59a40c631b79075cde54af0
TLSH
T13DF0A2AB5241CD0B92B20BF531B25F641A66043603B62BB235D0888395CD06D6A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 590B
SHA256 9691fc91b91f01bf3c4ee809236574acaf27908842029182d2690eb3bf47af79
MD5 d16666676661902343a9e6cfff43f71e
SHA1 d0ee65d95ff3a00ceb96db70366e87b33d5df435
SHA512 94a3ee2aab96d24a352b2341b4f8263c22dd5d4ab716ca821c23ad758a027c7cfda655e7845faeaaecb4faff22c30feeb85a9723a236bd864dd7c0db7654fa96
TLSH
T101F0E7EB6301DE0E95F34FF03535AB4825D6067A0BD647273D518993DA8C53C5D41BC4
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 606B
SHA256 a2a1f85e9a7c60bcd73f6c74d27ac8ce173f607d88b843520581fcce1d129c2b
MD5 00c1dffd0fcb9da430be59ba1efc341c
SHA1 3c0211a5f527c6ff556d1e30fd7b88b7ccd4a4b9
SHA512 eb762334d0bb8a244cf23f14374d9a19ea899424feb9b1ac4dad7a4d7b5df8ce8a4c26598bcf4119a93677d0ebe5e50eb1979b1238728558382fc0bd7aab3e21
TLSH
T169F0AC9F9202DC8EE8A64BF060734F641A22049A43EB4B9635D08C53EADD1A86E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 cc569c683b932c9ddafe3d7013a30d09704431446cebb76a613ff7c9881c3353
MD5 370111caac6f5816b44d3df3b208359f
SHA1 48311271b85f8c2b7118686a6898c200a7d518dd
SHA512 cbd42d8691c412334739549d20ddae88885d2e08bcff734bbdf4914f8a996a5e3ce1f4cf54bcb4acf0d2a2d1d64ec2d64781d7c3be9c59e45ef7690f239f114b
TLSH
T168F00CFBA302DC0FE0769BB4A0B29F08193144164BE78B663AA098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 360b89ab91c59fda43e8ff3d9e9197accf51209f29e87a1cca7b453934c52531
MD5 102ce101632e5b1710c6d75f5f47d0c0
SHA1 32949f76ea433b09fd85e7c1f2e8e57c617c61d5
SHA512 e348b02fca8eae2761968dbf503b944ff0d44d4b488a89014f383907ab1c5f0df09d4668e424f00cf30245d9a17fef695305db362fdba0ca3bab60de7c8390c1
TLSH
T196F0ACBEF901DE0AE6B347F920A21F402A1E101E135247F639D0C893D68EDAC5A467C5
MD5 SHA1 SHA512 TLSH

Submit Download

rvhrjtnt.exe

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\rvhrjtnt.exe
Size 56KB
SHA256 e8867de7bcc7fbdd6b0046a1aaaee390dd1756e52bd63e2eb12fabe7c517b5d1
MD5 a9d70daeb2c1e69d788fbdcfe3e575cc
SHA1 b6950422685208c9b35df8d3c394e859adb37864
SHA512 13ba6473f79400a65d4076ac681414c27eeebd489c568af4f358f13841ec2df584aa4f4f49d95b075485cb9e78b1b2767e511235fcc7a3eb866f3a897bf14e63
SSDEEP 768:XKLohcnYqy28fJiEQRHDSV01++VTo9C+e9RQM8YwLqqdZ8l1D+TeNyrYBzbtFybY:XKL4O82HD3hPNcIwdUWTeHbtgbQUpcqq
TLSH
T1BF43BEDED52BF9D1F9CF9F38004B60E6F1A0B86871ED18A21C6049FEB0D265126CD26D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bkbbtzlb.exe

Path C:\Program Files\VideoLAN\VLC\lua\http\bkbbtzlb.exe
Size 56KB
SHA256 2f5427ed3f157847891402e3f69464d62cd9cc39c21934e9e0e7ecdd6a5b5e2a
MD5 56bcbe8a5804ee76e44b0bc0b5ec4133
SHA1 389ee9ded5a9682786ae9dd65a6a88fc732209d2
SHA512 ef02821505dc53b2d19a0a89faf1a313a2aad9f137b9cf24860b8a3fb65d411cbef462ce6857257619b9bb9922071176099ea1ddbac25e7c2bc0295e3e490ce0
SSDEEP 1536:iJMDSkM+4XLeubs0NEDjPbmVC6s/s0Og9WeYRkDZGhe93:8M217pqjDl6KsCTd3
TLSH
T16843BFEFD42DC8C1FC77297D210C39BAB861C2617AE6D8942DB11FDDE0D52A429D802E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 e4f050fc09989370129abccc9330bf2fb7f8b81e52893e1660e5bf4c75b80c29
MD5 6ad2464e37d360f3368122a5498823f4
SHA1 47019af6a1df5ee0ef8d08666631ac971571302b
SHA512 3c714952f75a5e93bbe89e84633debfaaddeddcb5434a4bbcad07838bd13883cdf8d44ef23402fe37eef95019b76028281121785eb23bb0bc76f39e8c9838755
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtlL:6kEfytgP8qmrtfPFLhXv/j/wL/R8
TLSH
T10FB14685B489AB360311064251B77B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 49aa2db02258106b31944c25dc6229f72d98b420fd726f0e1ca6e0f1a3818b42
MD5 1c4a81f736c9cb955bb2d76836b5f3cc
SHA1 6bd0b12c534af83f7ef37c0bd2365ce2c4737a44
SHA512 a602850d90bb3421f59a5c444eef97a5fd1c38fbd40f9dabd14a2b81bb031f2dd5e9ab204fe44d3973727e2c840cc7e991d4d1d45f70777bec4543193f9d2a89
TLSH
T17E516209BC09DE29452008C2A172A3ADE02BDE0CF394F89E51AD417F6366BE8486B5C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 7955de766a6a7353c2d2636fd0f4329f58c3bf1022752c9f7b0f9e29a184ead6
MD5 574e755a9bfe748ae56e1cd703d0b0d1
SHA1 8be5f3ec7629361afe881916ed1708ebe9edc581
SHA512 e5de6b51814733defe5e5a72e6779fb1539748af2e5375ebc82073b973c8d913696eec347c7e5f80adac284462b89b760157b362407c3d798043cfd27b82787f
TLSH
T1DF517745F84CEE39012044826071E39DD02FDB3EF354F8AEB1BC467F629AAE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 bd762b63c95377623c06b19530e7af9c2dd82fabdc363cebcd9f188b0b5e4abb
MD5 ac8078adf118e10f4b7cdab2cf59d85c
SHA1 08f5b09fc6a45447ae9f8c8e20ac506b8b24f7bc
SHA512 0fc6a34c1ed39ccbd83833f88c52c6ecb0273df8ac3220878d738b7c149c04761921ee91cfdef85ac6a52e6d105e16bccc9bdcfbe71b86fc28191666c8b63894
TLSH
T1CF513349BC05DE29452004C29572E35DD16BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 56KB
SHA256 7a663fee18d3d11486a98d97e1a37d7c61e6fd5a2b7fd65884310de289eaede2
MD5 aa9b60466f44aa893a22032df2856f40
SHA1 00c7f8476be5027ed023939c29719334274ae211
SHA512 09e79aace85449c31caea47d09fd5bbdf429c4b005880bca5e50550e2777d11bd47b44e343876021238e88637494e36700f90321f7e0a083d1f268d115fc94bb
SSDEEP 1536:ldL3hJK0K2ngXIDVlbHi0v9xJ5s098j8fMItb:ldLRJK0DBDVw0v9xs09a+b
TLSH
T13F43BFEF9164BED1F4F7283C0774E8AAE55C4E6075EC102629384FFFE182552069C6E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/420-77-0x0000000000780000-0x000000000079F000-memory.dmp

Download

memory/932-3-0x0000000000670000-0x000000000068F000-memory.dmp

Download

memory/932-2-0x0000000000670000-0x000000000068F000-memory.dmp

Download

memory/2496-57-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-36-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-67-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-38-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-16-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-39-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-42-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-30-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-34-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-43-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-45-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-887-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-47-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-80-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-49-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-66-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-52-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-35-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-53-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-79-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-75-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-56-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-64-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-61-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-72-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-60-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/2496-70-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/3824-14-0x0000000000580000-0x000000000059F000-memory.dmp

Download

memory/4332-74-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/4332-0-0x0000000000590000-0x00000000005AF000-memory.dmp

Download

memory/6008-51-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-29-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-68-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-63-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-69-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-62-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-59-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-58-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-71-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-76-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-55-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-54-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-78-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-50-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-48-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-81-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-82-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-637-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-46-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-44-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-41-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-65-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-28-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-27-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-26-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-25-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-24-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-23-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-22-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-21-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-20-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-19-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-18-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-17-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-13-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-40-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-37-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-12-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-11-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-6-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

memory/6008-5-0x00000000005A0000-0x00000000005BF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads