edd95b3f3a8be5680f1e71996a461454a5cec3aeb1ef951e55b4546b9151bf32

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/09/2026, 21:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe
Size 92KB
Sample260920-1rlmrattf1
SHA256 edd95b3f3a8be5680f1e71996a461454a5cec3aeb1ef951e55b4546b9151bf32
MD5 27a3d6c6cb9a7e24b9c3902f8d4443eb
SHA1 30f7d75ebfc97a89db52082cce159416438513df
SHA512 49f3a0efa0d1fa7f1c30093c007c50b77e9311813d75246ea370defb67d6d81bb6963a479523913aba942b05e1272b3d9b4f6b5ee8ac09587eaa161d13faee79
SSDEEP 1536:E2Mk/l0y3DBLJogvWHFFYPZ1aR3dmNNOMAYMLmQWE8Z83YacIyP/69QAq0Gb8/ZC:tVl0y3DBLJbWH/YPZ1ktmNNnAY8mnKY5
TLSH
T19593E1CF9039CEC0F4CFA83D44207AA9BA74494B7BEC1340B9605BFA87D1A5465985FE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4468	urdvxc.exe

Executes dropped EXE 5 IoCs

pid	Process
1700	urdvxc.exe
5644	urdvxc.exe
792	urdvxc.exe
4636	urdvxc.exe
4468	urdvxc.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\urdvxc.exe	jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe
File created	C:\Windows\SysWOW64\urdvxc.exe	urdvxc.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\etberbbs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\hrbhlxhb.exe	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\license.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jlnjbnss.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\kznjrtew.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\browse_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\nkkzhhqr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\mosaic_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\stream_config_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\README.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\chllsvtv.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\srselhtw.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\error_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\revhnlhn.exe	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\hcjzqenb.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\jblhnrhj.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\lbjnrtrl.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlbvwvhv.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm_export.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\tsbknceh.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\rkrsbexs.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\index.html	urdvxc.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPP.HTM	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\nxqsxhql.exe	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\offset_window.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\vlm.html	urdvxc.exe
File opened for modification	C:\Program Files\Java\jre-1.8\Welcome.html	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\benkshkr.exe	urdvxc.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM	urdvxc.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\dialogs\batch_window.html	urdvxc.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	urdvxc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\ = "esllrtnxhnskwkhx"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D9E5B2A0-6DA4-8211-3F09-7196AABBE564}\ = "xxtstjnxtxjhhrrl"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "eltznzhsswlenbec"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\srselhtw.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}\ = "hnthvehszbeejcbj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5BFAF607-9DDA-565E-A528-64082B45FA4C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\kznjrtew.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\jlnjbnss.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4DA7BCA8-2512-8FCE-67B5-F36442F4E210}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\vlbvwvhv.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\ = "vrseebrbrtekehts"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\LocalServer32\ = "C:\\Windows\\SysWOW64\\urdvxc.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "zhnbrtjhkevjbhwc"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ED0AEEF6-92D0-A529-FE59-C8B8190FD846}\LocalServer32\ = "C:\\Program Files\\Microsoft Office\\root\\Stationery\\1033\\benkshkr.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}\ = "hrzxznlbrekjxbhw"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{7A1F8B4D-AC79-4B22-67EA-E30560A5BF1C}\LocalServer32\ = "C:\\Program Files\\VideoLAN\\VLC\\lua\\http\\bkbbtzlb.exe"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\ = "nwlljrrstnnzxslb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{59CFB313-1481-744D-7674-D6578ECA4E3F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}\ = "szbkjteelcrntlne"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\ = "kkttbnbvlbcltbsc"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6B3410C3-8941-1C9F-206A-90CB4E30359F}\ = "eblkwrqbrlchjwqr"	jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\ = "eewlrhbnhkjhhhss"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0AFCCDD1-9ADB-E8B9-54E0-5482D84EB3F9}\ = "kxjxehrheknrbkrb"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EB4470BE-3A35-A218-C7F6-4398C8694892}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{41DCF830-C3C8-4D7D-3D9E-68C01FB35CCF}\LocalServer32\ = "C:\\Program Files (x86)\\Adobe\\Acrobat Reader DC\\Reader\\WebResources\\Resource0\\ltsbrnkb.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "knwenkksbrenllxj"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}\ = "nzkjlnxlhkkwscrt"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{792FEA9F-0FD7-7236-E12E-D8391C9B1AFF}\ = "sssrwcjzetjhnvtn"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8308FF82-554C-D53A-FE36-8DDED83673EF}	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D72C442F-6EA9-BFAF-2703-0F262F8765FD}\LocalServer32\ = "C:\\Program Files\\Java\\jdk-1.8\\chllsvtv.exe"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{923FB8FF-546F-96D7-6E69-3DE0BF00820F}\ = "qkbzkbkssebtnrtk"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DF9248FF-34B1-9ACE-6663-FF027372D79F}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94006587-73B9-BF5C-50A6-0D5EF2953F77}\ = "chhkkbtjbkheweel"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{62B77361-C052-178D-5313-7AF2D2475E12}\ = "rebwlexsnwzlssrl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66E9A00C-64D1-4956-05AE-619DF5D22A84}\ = "wqtbtjbsklksekkl"	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5DA7E191-3518-8C5E-DAD0-E316016B7509}\ = "thlxnkktrntbljhh"	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AC84F518-2B78-BCFB-E876-EDAE640549C3}\LocalServer32	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{ACE2CA51-4DD7-EBAA-655B-E5BD3028568C}	urdvxc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B741C80D-FD34-9004-D0FB-6344BC08035A}\LocalServer32	urdvxc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FCF2880F-A498-1E33-807E-F68D30CCEE66}\ = "qtzjtlehjbnbketh"	urdvxc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1700	urdvxc.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6024 wrote to memory of 1700	6024	jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe	89
PID 6024 wrote to memory of 792	6024	jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe	92
PID 6024 wrote to memory of 4468	6024	jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe	94

C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6024
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /installservice
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1700
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /start
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:792
- C:\Windows\SysWOW64\urdvxc.exe
  C:\Windows\system32\urdvxc.exe /uninstallservice patch:C:\Users\Admin\AppData\Local\Temp\jaffacakes118__27a3d6c6cb9a7e24b9c3902f8d4443eb.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Modifies registry class
  PID:4468

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:5644

C:\Windows\SysWOW64\urdvxc.exe
"C:\Windows\SysWOW64\urdvxc.exe" /service
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

index.html

Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\index.html
Size 3KB
SHA256 1fad914a09ee8504c1aaf00632a459477ab8198b9d74f7baa6e5b55a5b1ec92d
MD5 0871658899dc70f5b15226e98ee78a99
SHA1 3ef0549c75de67e46a2c6f8f8e96f5ec782bab98
SHA512 10eae82675fc1ecf29a106c06b7542eb8ba8c63b090adc8162e96849dce6efc762c9c457f5f6e6e5383f886164e0255e295c65ce5f59fcbb44b79a404fca4eef
TLSH
T18A71662A1D169C39723292B4F1129248C751C55BE79BCB7070EC016F2BE0BDC49976BE
MD5 SHA1 SHA512 TLSH

Submit Download

README.html

Path C:\Program Files\Java\jdk-1.8\README.html
Size 263B
SHA256 f37026c18146ffd616868fc2b6b18bd1d4d35d701a99d1eb1e3b0974c01079b1
MD5 8e0789ff750b413c70a9b109432cf0ba
SHA1 84c429f3b741a44bced2a137ee62254348e89da6
SHA512 36b4cd6cb7854ed594ab3e1918731e2ad76fc3dab376f691518a2fb19fc8d1edd6f512846fbb171123dac0f661444a84c112dad014477fb7f6420dc03700a899
TLSH
T1FED095DE100EF4560CB0F611ACD0B6FD6573215800D5444C5141CD73C05C80EEC1F794
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jdk-1.8\jre\Welcome.html
Size 1KB
SHA256 6ffa2002e97816536eb55bef0ba11402fda791a3c4e7fa42f15f64967cdf1e9e
MD5 2fe21944034eb6b2b24f4bed8b1bee2c
SHA1 b53bb2babe0c2fe682a2e1c05d79dcf4fedf15a1
SHA512 4ac42b5d64d2f98e652a269a78bc012caf340fe43e7ef97fae58a1437b7360b05b949637c061d1ce818a2ca789c6db09d9c432efbe5dd8f7ee938f81976725eb
TLSH
T19511E2EBE9E4DB12B76051E351E469D47AA542F50D63C84939118202D080D35C30FBED
MD5 SHA1 SHA512 TLSH

Submit Download

Welcome.html

Path C:\Program Files\Java\jre-1.8\Welcome.html
Size 1KB
SHA256 a22037d6fa3155c7d8802069959c3e79cb6e5c789156528a814af3310f4ac7d2
MD5 95f69e6e9f61b657cd77e222058b38e1
SHA1 985529656adf9f5ccaad017b0e6c58dae052e3f3
SHA512 561a82cf12ec7898334647734cd8c32f1a79ca7627116f1ba7fd7954e7e3099b89dfd1a73829660e714bb926513b811fbf08d356cb1342572b55d7689bd1b35a
TLSH
T12611E2EBE9F4DA12776051E312E469D47BB541E51D63C8993A1192029080D36C30FBEE
MD5 SHA1 SHA512 TLSH

Submit Download

PersonaSpy.html

Path C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.html
Size 1KB
SHA256 fcd66e8e56164804b031e01cf09f3da3338eb9d92b9bf4eb23097ce32018b9a9
MD5 75887f366667b2254dfd35014d4eb318
SHA1 03127bc21514e315f8c370a9ac5dbd1cd9e766e7
SHA512 953e558d01d43f252870db5ecce7e347f69b3e553ecfadb106be203745492636d95dbcfc7446d31b138691e5e833b8f1a77d08995b7fb8ade5ae44af7fe48979
TLSH
T1F631F0049ED9940942B79165ACB0DB0EDC16C38BC389DF4A72EE0AD32FF654CDD9B520
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENCY.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\CURRENCY.HTM
Size 654B
SHA256 7818952f8aa96c43f88ad259aa4e15b2c52cb6882db7500b0f4e7684813e9dba
MD5 e36401728da122168b31be52c42a29ce
SHA1 fa0bb803ef7c6ecf2e330fd1bdd2050b4c9e633f
SHA512 9a147e40889f48a9f3ec9a3edf24e2955afafb68427262ac3fc51ad92faed1878c56fd2bd2f53ca87eceea609a9bc7e3e4099d2c61da63fd0f3804ece7801198
TLSH
T1FFF0FE6ADA40DD09D1720EF130765E143516045A47A797B23981D843E6CD5BCAF427C4
MD5 SHA1 SHA512 TLSH

Submit Download

DADSHIRT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\DADSHIRT.HTM
Size 598B
SHA256 eff4d5b669ba7be5a401f92b2915b25763b217695d98a9dcfa7c7f466858b9a9
MD5 d870476af236b9571654b680d5517ca0
SHA1 e6b377c7e82ab1f0c73cb1d9246a6d7cf911ad21
SHA512 6aa80c4de42db5f853a8bef0c26c466543a83f3fb7a945f0c18c469cfaef60919e9f40d51bd3835e51ed28cd10b00f80bb9cbb3720ca63393968a49dac00686c
TLSH
T1AAF0E1BFA211DD0DE5B30BF464766F801A6A041B07A28BB138D18CD3DA8D47C9E053C8
MD5 SHA1 SHA512 TLSH

Submit Download

JUDGESCH.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUDGESCH.HTM
Size 622B
SHA256 02de1bc742e89d50636e9affdb6be9b197cd6deb89ea6eadde8931d58f81945d
MD5 1debcd83130232a035a97dc293cfb31a
SHA1 4165ccff74a27adff5f9b3a805c64130b0633f54
SHA512 26c9ae9fb9a3263d68d61f474d250767c722236d1b169e80923954981353997e91a1f10e19fd2c297620be1debd1613c6f19423b70577622223151815b41c25f
TLSH
T17FF0026FC342DC0B90320BFD11736F20096624124BE6979636E19C43E9CE93C5E8A7C4
MD5 SHA1 SHA512 TLSH

Submit Download

JUNGLE.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\JUNGLE.HTM
Size 617B
SHA256 8d2657545730326624bb04354e1f284ae77f30d50e3fe50cf8e43ee514adcbae
MD5 689cc267bf8e3cbdb9021e58dd6344d5
SHA1 1a5cd72ba201cd2f8200b4defe124f8ba17bddd0
SHA512 4d3bf0973ba0f20e2a79877f5b86c1f50a1418c168ae313eba096a5175062c0a67e79dda0a76928b1a0ffa4c87d8f04f7770a91df4d48752fd4aa8396a90f91c
TLSH
T1DAF0A266D146EC0BA0F68AF474F15B640633001907E75B633580C997EACC4E89F453C4
MD5 SHA1 SHA512 TLSH

Submit Download

NOTEBOOK.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\NOTEBOOK.HTM
Size 606B
SHA256 890ce18ae07cff2598fb5c791d9e2f757b64c1f50e31369bc3607b5c91c035bb
MD5 94a91bbdaf9578921c8e7daa11e06d7d
SHA1 8757d960c7f3430437db84e10eb1ec184826f09f
SHA512 b24133c68d72a2006d681eed0de5ae7d1f9abe8f5ebe9ce0715e77e3bd79fde34f7a6919e94cd89e24d9c5ad4058da0f09935497ab951e2a07173f7668622c1c
TLSH
T1C4F0027F6745DF0ED27357F021631B441916046703A597B235D2C883D18C1AC1E413C8
MD5 SHA1 SHA512 TLSH

Submit Download

OFFISUPP.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\OFFISUPP.HTM
Size 582B
SHA256 a1323202003236506edb33c6c90c3d8a2fdeb3819a2d091c99df3395f7425353
MD5 63ae11a52b08339bd4ab366d280a9d4e
SHA1 8a8588dbe4e322578fc15bffc6056845c81f35b3
SHA512 8c364ef9bf7d7f71fcf14dee98660d3987f76226acd168fb9da44623e1157de8c3859b03ab83f9476ede30e2505be6b5cf9943fc9d1ef10dfa3844b9fe3bed3b
TLSH
T104F0A29B9201DD0B92B24BF531B25F641A66043603A62BB235D08C8395CD46D6E4B7C5
MD5 SHA1 SHA512 TLSH

Submit Download

PAWPRINT.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PAWPRINT.HTM
Size 582B
SHA256 10f88c34977f0a3af778684bf10445511d39fe64eb513bc6cc5f2d0d21f1380b
MD5 c04448aac05eb2916de4e48ae56c6db5
SHA1 976875e2d5f45713757b9b1c7cf7a399f45d5600
SHA512 0efc53652f09f46f7498b5316c6a0bf7be91e582916052ba928a8e02db3fd080a1cec8bf87087e2cc659d9309876cf6fb5fd0e06c6a6fde332eeebad1312fa23
TLSH
T1C2F0E1EB6301DE0EE5B34BB03536AB8825D6027A07E64B273D518AA3DA8C43C5E417C8
MD5 SHA1 SHA512 TLSH

Submit Download

PINELUMB.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\PINELUMB.HTM
Size 595B
SHA256 f6ad38743c7579b5f63312e6b5b4284ec3e876bea17accec17e6dbf9a56c5a73
MD5 07da346e41a53e102e3ad93ba7aeeedc
SHA1 e30705da6b3132cc99813d4c9d281f2726cd850a
SHA512 7d0569ba450c00ebc6c647bc398ed33d6b84b8a17ad6cbab6bcabf52b26d300a659f313d35645dace380d08230784e38bb21c6467606e7a1855df32b69dc014d
TLSH
T1A9F0AC5E8201DC8EE4A64BF060734F641A22049A47DB4B9631D18853A9CD1A82E493C4
MD5 SHA1 SHA512 TLSH

Submit Download

SEAMARBL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\SEAMARBL.HTM
Size 615B
SHA256 b0841e31ea62bf73b2e7f7f85b40e249dbd65e576ca037a422b5adc631ea09bd
MD5 40b26ca8db84c184c7f0ca12dbe6a290
SHA1 dd3f461a696ce4277eab6ec90508220fd04e7b7f
SHA512 99bc909c88743e664842b883bb1c645ca02a1e98fd25bbeab7bd84b13ffea1340a5135cfff85015cee6ba8ccebe00f108eb6d20d3f36a47f824570d94d056ea9
TLSH
T173F002FB9302DC0FE0759BB4A0B25F04193140164BD74766399098C3F5CC07C4E493C0
MD5 SHA1 SHA512 TLSH

Submit Download

TECHTOOL.HTM

Path C:\Program Files\Microsoft Office\root\Stationery\1033\TECHTOOL.HTM
Size 590B
SHA256 ad881a23b984e0eb32406991ac15953b44bde13f0405c9bb491e3b3eb1f9d031
MD5 28650ce84ff869563a02831d8ec153de
SHA1 7255365a1713cb2b8c03debd2feef6a1f9db9001
SHA512 7d17c4362e38fcfdafee1ff0ea87bd8e8593fab70e5fb91c22065fda98c2f63a5e2c57d9643fd68c2692afc5754bcff893f6e9b5885ae874aa835fb4db041a37
TLSH
T105F0ACBEF901DE0AE6B347F920A21B402A1E101E139243B639D0C893D68EDEC5A867C5
MD5 SHA1 SHA512 TLSH

Submit Download

MCABOUT.HTM

Path C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\MCABOUT.HTM
Size 11KB
SHA256 1102b8a9933b2191f1b80bd9bc478f301536216332ddf2986d3ffc792474be3d
MD5 4c7125f69cf2046a45daeac49cb0019f
SHA1 b4b17fbe1091003ed480f40654f22c89c763f01b
SHA512 ef255433949b3cd61a4694d2b23bd2a5d6b4a8a8e082fef068ad0c77abc4ba3fb833c1e31bdb9134613d237d7c033fa2647cfe73f06d3ad8de72128a8f323d62
SSDEEP 192:CSSAqeJcMBsLyituGC9GrGVhTx4oD+elxq:KAqVLhXrGVhTGelxq
TLSH
T13E320E3B55C4F62281360160E3116F61DF96907F43D31692709FDACB3FBA8A8D3A3696
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile.html
Size 5KB
SHA256 27618eb9928e7c9a842dcc92fea0ad8793f294a6403ca8fce957a7941d84d7c3
MD5 40e2c42702c9ef557e198fd9507cc045
SHA1 e97d0eb179aa6e7af2d60ad5196ae6295b33e22a
SHA512 b107c708bdbf535a6c89fb9cd2c05d597bb0497630e45b637054d61735cd38c3ba1186bc3f192bb7abe1453d5c92e91585d168aeaea6d96056fc96c72c13c22c
SSDEEP 48:zS6Zi+Ey9+k0y4Hfyt1YPZC44URKNXIpQq2widzUiOzOHKjVqo4rrhkKfJtdBtlx:6kEfytgP8qmrtfPFLhXv/j/wL/RU
TLSH
T1D8B13585B489AB360311064251B76B8EF06FCF0EF344B44EB2FC41BB57D6DAC84665A9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mobile_browse.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_browse.html
Size 2KB
SHA256 be2444da786629081d966e76943b2ff1aa4e38e21b8410acde01230bac9271cc
MD5 6d265215b6a355657486b9b94b0966c7
SHA1 651049e5ac516ccd57213914b2b0241767d3e86f
SHA512 4e2d22fe68c251295a0e0d2787d5f0ac0dc06114cec6306163f48da0f7985abd3607df1107cd0765673a31209d5967c9c73354ef19ac0bd25b9fd6b6694ee8b8
TLSH
T12C517309BC09DE2D452008C2A172A3ADD02BDE0CF394F89E51AD417F6367BEC486B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_equalizer.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_equalizer.html
Size 2KB
SHA256 63e8750443d77a276ba8aa9b245e01ca0eef643e33066f7f81786efaf3c14229
MD5 947b8ef49297d32c0328c3b47e45d6b1
SHA1 ab23c05406f23bc6314f06b478bb9719fd8a9826
SHA512 3d9213192eb22b0c023c78a6f8232e9d13d3c2b666a713c67ccfb62bbdcb705229a103897f43f1b8a8e9a502d88f728e6c704e6211d57d283988a3204786efaa
TLSH
T13E517749F80CEE39012044826071E39DD02FDB3EF354F8AEB1BC467F6296AE448275C8
MD5 SHA1 SHA512 TLSH

Submit Download

mobile_view.html

Path C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html
Size 2KB
SHA256 9be8e0ca62d4afbfd147a85d5f090e587fb635a7265d90fcdd2d8a64210b49e1
MD5 701700a6d0f8f1585171955aaa6f1c73
SHA1 213014d0825b7ffe8e1ed0ba183b295dbd231034
SHA512 f4a413aa68d18c142586c727ca055b89526db138f4456a96caa7bcfc4101b7549c4e5b7ed706312ffcfc4341fa655e543a64a960d2d51ad31480ff47ff7b8a9b
TLSH
T132513349BC05DE69452004C29573E35CD16BDA1CF398F89EE19C517F63A9FE848371C8
MD5 SHA1 SHA512 TLSH

Submit Download

urdvxc.exe

Path C:\Windows\SysWOW64\urdvxc.exe
Size 92KB
SHA256 edd95b3f3a8be5680f1e71996a461454a5cec3aeb1ef951e55b4546b9151bf32
MD5 27a3d6c6cb9a7e24b9c3902f8d4443eb
SHA1 30f7d75ebfc97a89db52082cce159416438513df
SHA512 49f3a0efa0d1fa7f1c30093c007c50b77e9311813d75246ea370defb67d6d81bb6963a479523913aba942b05e1272b3d9b4f6b5ee8ac09587eaa161d13faee79
SSDEEP 1536:E2Mk/l0y3DBLJogvWHFFYPZ1aR3dmNNOMAYMLmQWE8Z83YacIyP/69QAq0Gb8/ZC:tVl0y3DBLJbWH/YPZ1ktmNNnAY8mnKY5
TLSH
T19593E1CF9039CEC0F4CFA83D44207AA9BA74494B7BEC1340B9605BFA87D1A5465985FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/792-21-0x00000000007A0000-0x00000000007BF000-memory.dmp

Download

memory/1700-5-0x00000000005C0000-0x00000000005DF000-memory.dmp

Download

memory/1700-4-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/1700-3-0x00000000005C0000-0x00000000005DF000-memory.dmp

Download

memory/4468-79-0x00000000005B0000-0x00000000005CF000-memory.dmp

Download

memory/4636-43-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-46-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-75-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-82-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-24-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-37-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-60-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-42-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-41-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-81-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-74-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-893-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-47-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-72-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-49-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-69-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-52-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-68-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-65-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-53-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-56-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-64-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-61-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/4636-57-0x0000000000690000-0x00000000006AF000-memory.dmp

Download

memory/5644-55-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-76-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-58-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-62-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-7-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-63-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-66-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-54-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-51-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-67-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-70-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-50-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-48-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-73-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-71-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-45-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-44-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-80-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-36-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-83-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-84-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-35-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-8-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-59-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-34-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-401-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-33-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-32-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-31-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-30-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-29-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-28-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-27-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-26-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-25-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-23-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-20-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-18-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-17-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-16-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-15-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-14-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-13-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/5644-12-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6024-78-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

memory/6024-0-0x0000000000400000-0x0000000000431000-memory.dmp

Download

memory/6024-1-0x0000000000790000-0x00000000007AF000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads