756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309

Analysis

max time kernel
157s
max time network
210s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 08:52 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
Size

66KB
MD5

09e094c42a038eec129dbfc6676a9700
SHA1

d2a170330298b1a1a3b2e409bcb3d456487d6692
SHA256

756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309
SHA512

d5c9f8369fd926ed8ff4ced59d94ab74bdae906785ecec98501ecebc962bb4d426acb3ccf678cafefb22d9a2e5e670df8d9000bb127df50b5bbcf5a3509bdb07
SSDEEP

1536:LClsM3gYGgG8rDMeVeb5h3dyl0jh6y+5hiF2:LOsM3gY1Nihg0b+5hI2

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 4 IoCs

pid	Process
4428	urdvxc.exe
4400	urdvxc.exe
1592	urdvxc.exe
3572	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
File opened for modification	C:\Windows\SysWOW64\urdvxc.exe	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 6 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\sekbhrbe.exe	urdvxc.exe
File opened for modification	C:\Program Files\ClearSet.mhtml	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\qrhljwvn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\Welcome.html	urdvxc.exe

Modifies registry class 28 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "xtzlsweljsrxnsrb"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\db\\qrhljwvn.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "qcrtwlnbntlclwch"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\ = "lnqkjwnjresksscc"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "xrtsesjntqtnwsek"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\ = "njvchzkzlkslwwql"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32\ = "C:\\Program Files\\Java\\jdk1.8.0_66\\jre\\sekbhrbe.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29CBFA7A-A515-D19D-5F99-6E62910D27E9}\LocalServer32	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29CBFA7A-A515-D19D-5F99-6E62910D27E9}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe"	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29CBFA7A-A515-D19D-5F99-6E62910D27E9}\ = "esjssnensrkhqnrj"	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{29CBFA7A-A515-D19D-5F99-6E62910D27E9}	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E88A8DA-6487-F103-FFE5-C2B0648486DC}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7774BDCB-BC2A-526E-C798-34FA771E21D1}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "hbtksbhtesqzwlnz"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4428	urdvxc.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 4428	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	82
PID 3624 wrote to memory of 4428	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	82
PID 3624 wrote to memory of 4428	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	82
PID 3624 wrote to memory of 4400	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	83
PID 3624 wrote to memory of 4400	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	83
PID 3624 wrote to memory of 4400	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	83
PID 3624 wrote to memory of 3572	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	85
PID 3624 wrote to memory of 3572	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	85
PID 3624 wrote to memory of 3572	3624	756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe	85

C:\Users\Admin\AppData\Local\Temp\756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
"C:\Users\Admin\AppData\Local\Temp\756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe"
1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:4428
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:4400
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309.exe
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:3572

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:1592

Network

No results found

93.184.221.240:80

46 B
40 B
1
1
93.184.220.29:80

322 B
7
104.80.225.205:443

322 B
7
93.184.221.240:80

322 B
7
93.184.221.240:80

322 B
7
93.184.221.240:80

322 B
7
52.152.110.14:443

260 B
5
69.42.143.206:139

urdvxc.exe

156 B
3
69.42.49.111:139

urdvxc.exe

156 B
3
69.42.149.226:139

urdvxc.exe

156 B
3
69.42.208.19:139

urdvxc.exe

156 B
3
69.42.138.22:139

urdvxc.exe

156 B
3
69.42.235.119:139

urdvxc.exe

156 B
3
69.42.150.41:139

urdvxc.exe

156 B
3
69.42.70.220:139

urdvxc.exe

156 B
3
69.42.70.98:139

urdvxc.exe

156 B
3
69.42.139.44:139

urdvxc.exe

156 B
3
69.42.88.206:139

urdvxc.exe

156 B
3
69.42.81.65:139

urdvxc.exe

156 B
3
69.42.20.159:139

urdvxc.exe

156 B
3
69.42.183.58:139

urdvxc.exe

156 B
3
69.42.158.143:139

urdvxc.exe

156 B
3
69.42.138.107:139

urdvxc.exe

156 B
3
69.42.20.101:139

urdvxc.exe

156 B
3
69.42.87.226:139

urdvxc.exe

156 B
3
69.42.189.141:139

urdvxc.exe

156 B
3
69.42.5.142:139

urdvxc.exe

156 B
3
69.42.24.246:139

urdvxc.exe

260 B
200 B
5
5
69.42.67.97:139

urdvxc.exe

156 B
3
69.42.0.253:139

urdvxc.exe

156 B
3
69.42.26.57:139

urdvxc.exe

260 B
200 B
5
5
69.42.231.237:139

urdvxc.exe

156 B
3
69.42.61.51:139

urdvxc.exe

156 B
3
69.42.48.134:139

urdvxc.exe

156 B
3
69.42.72.217:139

urdvxc.exe

156 B
3
69.42.148.127:139

urdvxc.exe

156 B
3
69.42.237.225:139

urdvxc.exe

260 B
200 B
5
5
69.42.144.220:139

urdvxc.exe

156 B
3
69.42.67.242:139

urdvxc.exe

156 B
3
69.42.143.206:445

urdvxc.exe

156 B
3
69.42.49.111:445

urdvxc.exe

156 B
3
69.42.155.24:139

urdvxc.exe

156 B
3
69.42.79.67:139

urdvxc.exe

156 B
3
69.42.149.226:445

urdvxc.exe

156 B
3
69.42.208.19:445

urdvxc.exe

156 B
3
69.42.154.199:139

urdvxc.exe

156 B
3
69.42.138.22:445

urdvxc.exe

156 B
3
69.42.145.148:139

urdvxc.exe

156 B
3
69.42.235.119:445

urdvxc.exe

156 B
3
69.42.150.41:445

urdvxc.exe

156 B
3
69.42.70.220:445

urdvxc.exe

156 B
3
69.42.4.171:139

urdvxc.exe

156 B
3
69.42.131.2:139

urdvxc.exe

156 B
3
69.42.70.98:445

urdvxc.exe

156 B
3
69.42.139.44:445

urdvxc.exe

156 B
3
69.42.56.20:139

urdvxc.exe

156 B
3
69.42.20.15:139

urdvxc.exe

156 B
3
69.42.88.206:445

urdvxc.exe

156 B
3
69.42.158.69:139

urdvxc.exe

260 B
200 B
5
5
69.42.81.65:445

urdvxc.exe

156 B
3
69.42.136.64:139

urdvxc.exe

156 B
3
69.42.48.153:139

urdvxc.exe

260 B
200 B
5
5
69.42.6.120:139

urdvxc.exe

156 B
3
69.42.23.93:139

urdvxc.exe

156 B
3
69.42.20.159:445

urdvxc.exe

156 B
3
69.42.183.58:445

urdvxc.exe

156 B
3
69.42.158.143:445

urdvxc.exe

156 B
3
69.42.138.107:445

urdvxc.exe

156 B
3
69.42.20.101:445

urdvxc.exe

156 B
3
69.42.143.188:139

urdvxc.exe

156 B
3
69.42.150.42:139

urdvxc.exe

156 B
3
69.42.139.95:139

urdvxc.exe

156 B
3
69.42.87.226:445

urdvxc.exe

156 B
3
69.42.239.197:139

urdvxc.exe

156 B
3
69.42.143.155:139

urdvxc.exe

156 B
3
69.42.189.141:445

urdvxc.exe

156 B
3
69.42.12.2:139

urdvxc.exe

260 B
200 B
5
5
69.42.5.142:445

urdvxc.exe

156 B
3
69.42.24.246:445

urdvxc.exe

260 B
200 B
5
5
69.42.67.97:445

urdvxc.exe

156 B
3
69.42.26.57:445

urdvxc.exe

260 B
200 B
5
5
69.42.0.253:445

urdvxc.exe

156 B
3
69.42.231.237:445

urdvxc.exe

156 B
3
69.42.61.51:445

urdvxc.exe

156 B
3
69.42.48.134:445

urdvxc.exe

156 B
3
69.42.72.217:445

urdvxc.exe

156 B
3
69.42.148.127:445

urdvxc.exe

156 B
3
69.42.237.225:445

urdvxc.exe

260 B
200 B
5
5
69.42.144.220:445

urdvxc.exe

156 B
3
69.42.67.242:445

urdvxc.exe

156 B
3
69.42.155.24:445

urdvxc.exe

156 B
3
69.42.79.67:445

urdvxc.exe

156 B
3
69.42.154.199:445

urdvxc.exe

156 B
3
69.42.145.148:445

urdvxc.exe

156 B
3
69.42.4.171:445

urdvxc.exe

156 B
3
69.42.131.2:445

urdvxc.exe

156 B
3
69.42.56.20:445

urdvxc.exe

156 B
3
69.42.20.15:445

urdvxc.exe

156 B
3
69.42.158.69:445

urdvxc.exe

260 B
200 B
5
5
69.42.136.64:445

urdvxc.exe

156 B
3
69.42.48.153:445

urdvxc.exe

260 B
160 B
5
4
69.42.6.120:445

urdvxc.exe

156 B
3
69.42.23.93:445

urdvxc.exe

156 B
3
69.42.143.188:445

urdvxc.exe

156 B
3
69.42.150.42:445

urdvxc.exe

156 B
3
69.42.139.95:445

urdvxc.exe

156 B
3
69.42.239.197:445

urdvxc.exe

156 B
3
69.42.143.155:445

urdvxc.exe

156 B
3
69.42.12.2:445

urdvxc.exe

260 B
200 B
5
5
69.42.139.148:139

urdvxc.exe

156 B
3
69.42.138.175:139

urdvxc.exe

156 B
3
69.42.61.149:139

urdvxc.exe

156 B
3
69.42.138.78:139

urdvxc.exe

156 B
3
69.42.224.55:139

urdvxc.exe

156 B
3
69.42.152.97:139

urdvxc.exe

156 B
3
69.42.154.140:139

urdvxc.exe

156 B
3
69.42.4.213:139

urdvxc.exe

156 B
3
69.42.56.231:139

urdvxc.exe

156 B
3
69.42.31.89:139

urdvxc.exe

260 B
200 B
5
5
69.42.155.30:139

urdvxc.exe

156 B
3
69.42.58.26:139

urdvxc.exe

156 B
3
69.42.236.173:139

urdvxc.exe

156 B
3
69.42.87.242:139

urdvxc.exe

156 B
3
69.42.56.210:139

urdvxc.exe

260 B
200 B
5
5
69.42.152.59:139

urdvxc.exe

156 B
3
69.42.152.64:139

urdvxc.exe

156 B
3
69.42.246.177:139

urdvxc.exe

156 B
3
69.42.154.53:139

urdvxc.exe

156 B
3
69.42.5.13:139

urdvxc.exe

156 B
3
69.42.49.194:139

urdvxc.exe

260 B
200 B
5
5
69.42.155.52:139

urdvxc.exe

156 B
3
69.42.139.148:445

urdvxc.exe

156 B
3
69.42.3.162:139

urdvxc.exe

156 B
3
69.42.138.175:445

urdvxc.exe

156 B
3
69.42.61.149:445

urdvxc.exe

156 B
3
69.42.138.78:445

urdvxc.exe

156 B
3
69.42.224.55:445

urdvxc.exe

156 B
3
69.42.185.237:139

urdvxc.exe

156 B
3
69.42.152.97:445

urdvxc.exe

156 B
3
69.42.18.13:139

urdvxc.exe

156 B
3
69.42.145.119:139

urdvxc.exe

156 B
3
69.42.72.139:139

urdvxc.exe

156 B
3
69.42.154.140:445

urdvxc.exe

156 B
3
69.42.50.41:139

urdvxc.exe

260 B
200 B
5
5
69.42.4.213:445

urdvxc.exe

156 B
3
69.42.56.231:445

urdvxc.exe

156 B
3
69.42.82.108:139

urdvxc.exe

156 B
3
69.42.31.89:445

urdvxc.exe

260 B
200 B
5
5
69.42.26.77:139

urdvxc.exe

260 B
200 B
5
5
69.42.155.30:445

urdvxc.exe

156 B
3
69.42.18.86:139

urdvxc.exe

156 B
3
69.42.204.166:139

urdvxc.exe

156 B
3
69.42.58.26:445

urdvxc.exe

156 B
3
69.42.58.117:139

urdvxc.exe

156 B
3
69.42.236.173:445

urdvxc.exe

156 B
3
69.42.87.242:445

urdvxc.exe

156 B
3
69.42.21.245:139

urdvxc.exe

156 B
3
69.42.56.210:445

urdvxc.exe

260 B
200 B
5
5
69.42.152.59:445

urdvxc.exe

156 B
3
69.42.137.140:139

urdvxc.exe

156 B
3
69.42.152.64:445

urdvxc.exe

156 B
3
69.42.16.17:139

urdvxc.exe

156 B
3
69.42.23.206:139

urdvxc.exe

156 B
3
69.42.246.177:445

urdvxc.exe

156 B
3
69.42.17.223:139

urdvxc.exe

156 B
3
69.42.3.241:139

urdvxc.exe

156 B
3
69.42.29.165:139

urdvxc.exe

260 B
200 B
5
5
69.42.16.29:139

urdvxc.exe

156 B
3
69.42.186.90:139

urdvxc.exe

156 B
3
69.42.154.53:445

urdvxc.exe

156 B
3
69.42.74.254:139

urdvxc.exe

156 B
3
69.42.5.13:445

urdvxc.exe

156 B
3
69.42.139.151:139

urdvxc.exe

156 B
3
69.42.23.22:139

urdvxc.exe

156 B
3
69.42.24.238:139

urdvxc.exe

260 B
200 B
5
5
69.42.204.11:139

urdvxc.exe

156 B
3
69.42.49.194:445

urdvxc.exe

260 B
200 B
5
5
69.42.155.52:445

urdvxc.exe

156 B
3
69.42.65.78:139

urdvxc.exe

156 B
3
69.42.3.162:445

urdvxc.exe

156 B
3
69.42.26.19:139

urdvxc.exe

260 B
200 B
5
5
69.42.185.237:445

urdvxc.exe

156 B
3
69.42.18.13:445

urdvxc.exe

156 B
3
69.42.64.113:139

urdvxc.exe

156 B
3
69.42.145.119:445

urdvxc.exe

156 B
3
69.42.16.134:139

urdvxc.exe

156 B
3
69.42.72.139:445

urdvxc.exe

156 B
3
69.42.50.41:445

urdvxc.exe

260 B
200 B
5
5
69.42.141.16:139

urdvxc.exe

156 B
3
69.42.65.71:139

urdvxc.exe

156 B
3
69.42.82.108:445

urdvxc.exe

156 B
3
69.42.0.187:139

urdvxc.exe

156 B
3
69.42.154.155:139

urdvxc.exe

156 B
3
69.42.149.234:139

urdvxc.exe

156 B
3
69.42.26.77:445

urdvxc.exe

260 B
200 B
5
5
69.42.77.19:139

urdvxc.exe

156 B
3
69.42.50.35:139

urdvxc.exe

156 B
3
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.17.18:139

urdvxc.exe

156 B
3
69.42.18.86:445

urdvxc.exe

156 B
3
69.42.204.166:445

urdvxc.exe

156 B
3
69.42.58.117:445

urdvxc.exe

156 B
3
69.42.176.5:139

urdvxc.exe

156 B
3
69.42.72.235:139

urdvxc.exe

156 B
3
69.42.88.27:139

urdvxc.exe

156 B
3
69.42.50.46:139

urdvxc.exe

156 B
3
69.42.21.245:445

urdvxc.exe

156 B
3
69.42.137.140:445

urdvxc.exe

156 B
3
69.42.23.206:445

urdvxc.exe

156 B
3
69.42.16.17:445

urdvxc.exe

156 B
3
69.42.17.223:445

urdvxc.exe

156 B
3
69.42.3.241:445

urdvxc.exe

156 B
3
69.42.29.165:445

urdvxc.exe

260 B
200 B
5
5
69.42.16.29:445

urdvxc.exe

156 B
3
69.42.186.90:445

urdvxc.exe

156 B
3
69.42.74.254:445

urdvxc.exe

156 B
3
69.42.139.151:445

urdvxc.exe

156 B
3
69.42.23.22:445

urdvxc.exe

156 B
3
69.42.24.238:445

urdvxc.exe

260 B
200 B
5
5
69.42.204.11:445

urdvxc.exe

156 B
3
69.42.65.78:445

urdvxc.exe

156 B
3
69.42.26.19:445

urdvxc.exe

260 B
200 B
5
5
69.42.64.113:445

urdvxc.exe

156 B
3
69.42.16.134:445

urdvxc.exe

156 B
3
69.42.141.16:445

urdvxc.exe

156 B
3
69.42.65.71:445

urdvxc.exe

156 B
3
69.42.0.187:445

urdvxc.exe

156 B
3
69.42.154.155:445

urdvxc.exe

156 B
3
69.42.149.234:445

urdvxc.exe

156 B
3
69.42.77.19:445

urdvxc.exe

156 B
3
69.42.50.35:445

urdvxc.exe

156 B
3
69.42.154.16:445

urdvxc.exe

144 B
52 B
3
1
69.42.17.18:445

urdvxc.exe

156 B
3
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.176.5:445

urdvxc.exe

156 B
3
69.42.72.235:445

urdvxc.exe

156 B
3
69.42.88.27:445

urdvxc.exe

156 B
3
69.42.50.46:445

urdvxc.exe

156 B
3
69.42.173.65:139

urdvxc.exe

156 B
3
69.42.24.21:139

urdvxc.exe

144 B
52 B
3
1
69.42.24.21:139

urdvxc.exe

714 B
358 B
7
5
69.42.152.72:139

urdvxc.exe

156 B
3
69.42.18.8:139

urdvxc.exe

156 B
3
69.42.16.66:139

urdvxc.exe

156 B
3
69.42.239.1:139

urdvxc.exe

260 B
200 B
5
5
69.42.24.46:139

urdvxc.exe

260 B
200 B
5
5
69.42.249.145:139

urdvxc.exe

156 B
3
69.42.148.16:139

urdvxc.exe

156 B
3
69.42.79.7:139

urdvxc.exe

156 B
3
69.42.173.60:139

urdvxc.exe

156 B
3
69.42.6.76:139

urdvxc.exe

156 B
3
69.42.232.252:139

urdvxc.exe

156 B
3
69.42.154.22:139

urdvxc.exe

260 B
200 B
5
5
69.42.58.156:139

urdvxc.exe

156 B
3
69.42.144.245:139

urdvxc.exe

156 B
3
69.42.7.105:139

urdvxc.exe

156 B
3
69.42.77.253:139

urdvxc.exe

156 B
3
69.42.79.4:139

urdvxc.exe

156 B
3
69.42.144.3:139

urdvxc.exe

156 B
3
69.42.154.16:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.136.23:139

urdvxc.exe

156 B
3
69.42.217.130:139

urdvxc.exe

156 B
3
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.93.246:139

urdvxc.exe

156 B
3
69.42.21.83:139

urdvxc.exe

156 B
3
69.42.49.199:139

urdvxc.exe

156 B
3
69.42.150.27:139

urdvxc.exe

156 B
3
69.42.61.80:139

urdvxc.exe

156 B
3
69.42.16.254:139

urdvxc.exe

156 B
3
69.42.16.236:139

urdvxc.exe

156 B
3
69.42.215.218:139

urdvxc.exe

260 B
200 B
5
5
69.42.22.4:139

urdvxc.exe

156 B
3
69.42.173.65:445

urdvxc.exe

156 B
3
69.42.154.162:139

urdvxc.exe

156 B
3
69.42.150.98:139

urdvxc.exe

156 B
3
69.42.24.21:139

urdvxc.exe

697 B
476 B
7
6
69.42.152.72:445

urdvxc.exe

156 B
3
69.42.18.8:445

urdvxc.exe

156 B
3
69.42.158.234:139

urdvxc.exe

156 B
3
69.42.90.10:139

urdvxc.exe

156 B
3
69.42.16.66:445

urdvxc.exe

156 B
3
69.42.155.71:139

urdvxc.exe

156 B
3
69.42.239.1:445

urdvxc.exe

260 B
160 B
5
4
69.42.24.46:445

urdvxc.exe

260 B
200 B
5
5
69.42.249.145:445

urdvxc.exe

156 B
3
69.42.148.16:445

urdvxc.exe

156 B
3
69.42.18.196:139

urdvxc.exe

156 B
3
69.42.79.7:445

urdvxc.exe

156 B
3
69.42.61.110:139

urdvxc.exe

156 B
3
69.42.149.150:139

urdvxc.exe

156 B
3
69.42.176.54:139

urdvxc.exe

156 B
3
69.42.20.45:139

urdvxc.exe

156 B
3
69.42.173.60:445

urdvxc.exe

156 B
3
69.42.22.125:139

urdvxc.exe

156 B
3
69.42.6.76:445

urdvxc.exe

156 B
3
69.42.158.34:139

urdvxc.exe

156 B
3
69.42.136.24:139

urdvxc.exe

156 B
3
69.42.232.252:445

urdvxc.exe

156 B
3
69.42.154.22:445

urdvxc.exe

260 B
200 B
5
5
69.42.65.217:139

urdvxc.exe

156 B
3
69.42.24.64:139

urdvxc.exe

260 B
200 B
5
5
69.42.224.202:139

urdvxc.exe

156 B
3
69.42.58.156:445

urdvxc.exe

156 B
3
69.42.144.245:445

urdvxc.exe

156 B
3
69.42.7.105:445

urdvxc.exe

156 B
3
69.42.141.105:139

urdvxc.exe

260 B
200 B
5
5
69.42.77.253:445

urdvxc.exe

156 B
3
69.42.79.4:445

urdvxc.exe

156 B
3
69.42.144.3:445

urdvxc.exe

156 B
3
69.42.155.206:139

urdvxc.exe

156 B
3
69.42.235.35:139

urdvxc.exe

156 B
3
69.42.155.33:139

urdvxc.exe

156 B
3
69.42.136.23:445

urdvxc.exe

156 B
3
69.42.217.130:445

urdvxc.exe

156 B
3
69.42.154.16:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.93.246:445

urdvxc.exe

156 B
3
69.42.21.83:445

urdvxc.exe

156 B
3
69.42.49.199:445

urdvxc.exe

156 B
3
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.150.27:445

urdvxc.exe

156 B
3
69.42.61.80:445

urdvxc.exe

156 B
3
69.42.16.254:445

urdvxc.exe

156 B
3
69.42.16.236:445

urdvxc.exe

156 B
3
69.42.215.218:445

urdvxc.exe

260 B
200 B
5
5
69.42.22.4:445

urdvxc.exe

156 B
3
69.42.154.162:445

urdvxc.exe

156 B
3
69.42.150.98:445

urdvxc.exe

156 B
3
69.42.158.234:445

urdvxc.exe

156 B
3
69.42.90.10:445

urdvxc.exe

156 B
3
69.42.155.71:445

urdvxc.exe

156 B
3
69.42.18.196:445

urdvxc.exe

156 B
3
69.42.61.110:445

urdvxc.exe

156 B
3
69.42.149.150:445

urdvxc.exe

156 B
3
69.42.176.54:445

urdvxc.exe

156 B
3
69.42.20.45:445

urdvxc.exe

156 B
3
69.42.22.125:445

urdvxc.exe

156 B
3
69.42.158.34:445

urdvxc.exe

156 B
3
69.42.136.24:445

urdvxc.exe

156 B
3
69.42.65.217:445

urdvxc.exe

156 B
3
69.42.24.64:445

urdvxc.exe

260 B
200 B
5
5
69.42.224.202:445

urdvxc.exe

156 B
3
69.42.141.105:445

urdvxc.exe

260 B
200 B
5
5
69.42.155.206:445

urdvxc.exe

156 B
3
69.42.235.35:445

urdvxc.exe

156 B
3
69.42.155.33:445

urdvxc.exe

156 B
3
69.42.22.137:139

urdvxc.exe

156 B
3
69.42.154.16:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.149.229:139

urdvxc.exe

260 B
200 B
5
5
69.42.188.241:139

urdvxc.exe

156 B
3
69.42.142.178:139

urdvxc.exe

156 B
3
69.42.185.217:139

urdvxc.exe

156 B
3
69.42.7.96:139

urdvxc.exe

156 B
3
69.42.139.19:139

urdvxc.exe

156 B
3
69.42.173.49:139

urdvxc.exe

156 B
3
69.42.153.91:139

urdvxc.exe

156 B
3
69.42.144.55:139

urdvxc.exe

156 B
3
69.42.51.17:139

urdvxc.exe

156 B
3
69.42.18.87:139

urdvxc.exe

156 B
3
69.42.66.219:139

urdvxc.exe

156 B
3
69.42.149.44:139

urdvxc.exe

156 B
3
69.42.190.221:139

urdvxc.exe

156 B
3
69.42.249.1:139

urdvxc.exe

260 B
200 B
5
5
69.42.157.73:139

urdvxc.exe

144 B
52 B
3
1
69.42.158.157:139

urdvxc.exe

156 B
3
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.237.193:139

urdvxc.exe

208 B
120 B
4
3
69.42.146.1:139

urdvxc.exe

156 B
3
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.2.75:139

urdvxc.exe

156 B
3
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.87.68:139

urdvxc.exe

156 B
3
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.204.135:139

urdvxc.exe

156 B
3
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.22.137:445

urdvxc.exe

156 B
3
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.56.217:139

urdvxc.exe

260 B
200 B
5
5
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.154.16:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.149.229:445

urdvxc.exe

260 B
200 B
5
5
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.141.104:139

urdvxc.exe

260 B
200 B
5
5
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.70.194:139

urdvxc.exe

156 B
3
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.188.241:445

urdvxc.exe

156 B
3
69.42.142.178:445

urdvxc.exe

156 B
3
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.185.217:445

urdvxc.exe

156 B
3
69.42.59.89:139

urdvxc.exe

260 B
200 B
5
5
69.42.2.121:139

urdvxc.exe

156 B
3
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.149.138:139

urdvxc.exe

156 B
3
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.7.96:445

urdvxc.exe

156 B
3
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.7.7:139

urdvxc.exe

156 B
3
69.42.157.73:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.139.19:445

urdvxc.exe

156 B
3
69.42.254.253:139

urdvxc.exe

156 B
3
69.42.173.49:445

urdvxc.exe

156 B
3
69.42.157.73:139

urdvxc.exe

306 B
97 B
5
2
69.42.49.253:139

urdvxc.exe

156 B
3
69.42.153.91:445

urdvxc.exe

156 B
3
69.42.144.55:445

urdvxc.exe

156 B
3
69.42.149.132:139

urdvxc.exe

156 B
3
69.42.157.73:445

smb

urdvxc.exe

264 B
92 B
3
2
69.42.144.132:139

urdvxc.exe

156 B
3
69.42.51.17:445

urdvxc.exe

156 B
3
69.42.18.87:445

urdvxc.exe

156 B
3
69.42.20.12:139

urdvxc.exe

156 B
3
69.42.66.219:445

urdvxc.exe

156 B
3
69.42.149.44:445

urdvxc.exe

156 B
3
69.42.51.61:139

urdvxc.exe

156 B
3
69.42.152.37:139

urdvxc.exe

156 B
3
69.42.191.137:139

urdvxc.exe

156 B
3
69.42.190.221:445

urdvxc.exe

156 B
3
69.42.249.1:445

urdvxc.exe

260 B
200 B
5
5
69.42.218.102:139

urdvxc.exe

260 B
200 B
5
5
69.42.157.69:139

urdvxc.exe

260 B
200 B
5
5
69.42.87.235:139

urdvxc.exe

156 B
3
69.42.51.10:139

urdvxc.exe

156 B
3
69.42.149.34:139

urdvxc.exe

260 B
200 B
5
5
69.42.158.157:445

urdvxc.exe

156 B
3
69.42.237.193:445

urdvxc.exe

260 B
200 B
5
5
69.42.146.1:445

urdvxc.exe

156 B
3
69.42.2.75:445

urdvxc.exe

156 B
3
69.42.87.68:445

urdvxc.exe

156 B
3
69.42.19.151:139

urdvxc.exe

156 B
3
69.42.144.16:139

urdvxc.exe

156 B
3
69.42.204.135:445

urdvxc.exe

156 B
3
69.42.141.18:139

urdvxc.exe

156 B
3
69.42.4.152:139

urdvxc.exe

156 B
3
69.42.110.202:139

urdvxc.exe

156 B
3
69.42.56.217:445

urdvxc.exe

260 B
200 B
5
5
69.42.141.104:445

urdvxc.exe

260 B
200 B
5
5
69.42.154.16:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.70.194:445

urdvxc.exe

156 B
3
69.42.72.28:139

urdvxc.exe

156 B
3
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.20.191:139

urdvxc.exe

156 B
3
69.42.59.89:445

urdvxc.exe

260 B
200 B
5
5
69.42.2.121:445

urdvxc.exe

156 B
3
69.42.149.138:445

urdvxc.exe

156 B
3
69.42.16.218:139

urdvxc.exe

156 B
3
69.42.136.66:139

urdvxc.exe

156 B
3
69.42.7.7:445

urdvxc.exe

156 B
3
69.42.254.253:445

urdvxc.exe

156 B
3
69.42.22.39:139

urdvxc.exe

156 B
3
69.42.158.187:139

urdvxc.exe

156 B
3
69.42.49.253:445

urdvxc.exe

156 B
3
69.42.149.132:445

urdvxc.exe

156 B
3
69.42.144.132:445

urdvxc.exe

156 B
3
69.42.143.237:139

urdvxc.exe

156 B
3
69.42.20.12:445

urdvxc.exe

156 B
3
69.42.137.3:139

urdvxc.exe

156 B
3
69.42.81.41:139

urdvxc.exe

156 B
3
69.42.4.201:139

urdvxc.exe

156 B
3
69.42.51.61:445

urdvxc.exe

156 B
3
69.42.152.37:445

urdvxc.exe

156 B
3
69.42.191.137:445

urdvxc.exe

156 B
3
69.42.218.102:445

urdvxc.exe

260 B
200 B
5
5
69.42.23.236:139

urdvxc.exe

260 B
200 B
5
5
69.42.157.69:445

urdvxc.exe

260 B
200 B
5
5
69.42.87.235:445

urdvxc.exe

156 B
3
69.42.51.10:445

urdvxc.exe

156 B
3
69.42.149.34:445

urdvxc.exe

260 B
200 B
5
5
69.42.48.100:139

urdvxc.exe

156 B
3
69.42.17.57:139

urdvxc.exe

156 B
3
69.42.0.87:139

urdvxc.exe

156 B
3
69.42.19.151:445

urdvxc.exe

156 B
3
69.42.144.16:445

urdvxc.exe

156 B
3
69.42.141.18:445

urdvxc.exe

156 B
3
69.42.4.152:445

urdvxc.exe

156 B
3
69.42.110.202:445

urdvxc.exe

156 B
3
69.42.49.97:139

urdvxc.exe

156 B
3
69.42.157.73:9988

urdvxc.exe

260 B
200 B
5
5
69.42.72.28:445

urdvxc.exe

156 B
3
69.42.70.244:139

urdvxc.exe

156 B
3
69.42.150.114:139

urdvxc.exe

156 B
3
69.42.143.252:139

urdvxc.exe

156 B
3
69.42.154.16:445

smb

urdvxc.exe

310 B
92 B
3
2
69.42.158.133:139

urdvxc.exe

156 B
3
69.42.110.40:139

urdvxc.exe

156 B
3
69.42.215.219:139

urdvxc.exe

260 B
200 B
5
5
69.42.217.131:139

urdvxc.exe

156 B
3
69.42.18.84:139

urdvxc.exe

156 B
3
69.42.17.190:139

urdvxc.exe

156 B
3
69.42.154.16:139

urdvxc.exe

156 B
3
69.42.20.191:445

urdvxc.exe

156 B
3
69.42.27.73:139

urdvxc.exe

260 B
200 B
5
5
69.42.23.55:139

urdvxc.exe

156 B
3
69.42.16.218:445

urdvxc.exe

156 B
3
69.42.149.170:139

urdvxc.exe

156 B
3
69.42.71.33:139

urdvxc.exe

156 B
3
69.42.136.66:445

urdvxc.exe

156 B
3
69.42.68.17:139

urdvxc.exe

156 B
3

No results found

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\urdvxc.exe

Filesize
66KB

MD5
09e094c42a038eec129dbfc6676a9700

SHA1
d2a170330298b1a1a3b2e409bcb3d456487d6692

SHA256
756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309

SHA512
d5c9f8369fd926ed8ff4ced59d94ab74bdae906785ecec98501ecebc962bb4d426acb3ccf678cafefb22d9a2e5e670df8d9000bb127df50b5bbcf5a3509bdb07

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
66KB

MD5
09e094c42a038eec129dbfc6676a9700

SHA1
d2a170330298b1a1a3b2e409bcb3d456487d6692

SHA256
756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309

SHA512
d5c9f8369fd926ed8ff4ced59d94ab74bdae906785ecec98501ecebc962bb4d426acb3ccf678cafefb22d9a2e5e670df8d9000bb127df50b5bbcf5a3509bdb07

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
66KB

MD5
09e094c42a038eec129dbfc6676a9700

SHA1
d2a170330298b1a1a3b2e409bcb3d456487d6692

SHA256
756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309

SHA512
d5c9f8369fd926ed8ff4ced59d94ab74bdae906785ecec98501ecebc962bb4d426acb3ccf678cafefb22d9a2e5e670df8d9000bb127df50b5bbcf5a3509bdb07

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
66KB

MD5
09e094c42a038eec129dbfc6676a9700

SHA1
d2a170330298b1a1a3b2e409bcb3d456487d6692

SHA256
756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309

SHA512
d5c9f8369fd926ed8ff4ced59d94ab74bdae906785ecec98501ecebc962bb4d426acb3ccf678cafefb22d9a2e5e670df8d9000bb127df50b5bbcf5a3509bdb07

Download Submit
C:\Windows\SysWOW64\urdvxc.exe

Filesize
66KB

MD5
09e094c42a038eec129dbfc6676a9700

SHA1
d2a170330298b1a1a3b2e409bcb3d456487d6692

SHA256
756410912ae27fa2cb3f93b26fdf34908e38a07fe47098e997bbb3b089af6309

SHA512
d5c9f8369fd926ed8ff4ced59d94ab74bdae906785ecec98501ecebc962bb4d426acb3ccf678cafefb22d9a2e5e670df8d9000bb127df50b5bbcf5a3509bdb07

Download Submit
memory/1592-146-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/1592-147-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/3572-145-0x00000000001D0000-0x00000000001EF000-memory.dmp

Filesize
124KB

Download
memory/3624-132-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3624-133-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download
memory/4400-142-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/4428-137-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4428-138-0x00000000001E0000-0x00000000001FF000-memory.dmp

Filesize
124KB

Download