xmrig | 1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6

Analysis

max time kernel
149s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
Size 286KB
Sample260708-eme4hsat8x
SHA256 1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6
MD5 a05389640c9d49b208eac7308baf0631
SHA1 a08786260b150c96d04ba5ed5ade2fc148d40173
SHA512 4cf00413df395c86f6235a683c644514c1b9f860afdb2c3b39691e2ff779104fdfaebbcbfba6782b6fdaeeecd8d0727230559695229df0a53fa054e91e01d6bf
SSDEEP 6144:dh2cD2G4rW3XdlQlPAHPOsnowtP2qO4TmhOqx:ZD2FcXdlQlPAHRn1PrRyF
TLSH
T119547D15F7A914FAE977857CC9424502EAB27C1647B0E6DF03A00B972F27AE09E3E711
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/memory/1288-0-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-1-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-15-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-19-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-17-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-11-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-13-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-3-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-9-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-7-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/1288-5-0x00000000004E0000-0x0000000000DB1000-memory.dmp	xmrig
behavioral2/memory/5060-32-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-31-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-51-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-48-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-46-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-40-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-38-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-36-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-44-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-42-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5060-34-0x00000000008E0000-0x00000000011B1000-memory.dmp	xmrig
behavioral2/memory/5384-62-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-70-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-67-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-81-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-79-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-74-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-65-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-77-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-76-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-63-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5384-71-0x0000000000A00000-0x00000000012D1000-memory.dmp	xmrig
behavioral2/memory/5684-98-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-96-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-93-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-94-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-100-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-112-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-110-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-104-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-108-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-106-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/5684-102-0x00000000006F0000-0x0000000000FC1000-memory.dmp	xmrig
behavioral2/memory/1972-125-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-132-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-143-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-139-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-137-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-133-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-141-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-135-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-127-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-129-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1972-124-0x0000000000600000-0x0000000000ED1000-memory.dmp	xmrig
behavioral2/memory/1924-186-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-195-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-199-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-201-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-197-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-193-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-191-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-189-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig
behavioral2/memory/1924-187-0x0000000000800000-0x00000000010D1000-memory.dmp	xmrig

Suspicious use of SetThreadContext 16 IoCs

description	pid	Process	procid_target
PID 3356 set thread context of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 set thread context of 5060	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	90
PID 3356 set thread context of 5384	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	91
PID 3356 set thread context of 5684	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	93
PID 3356 set thread context of 1972	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	94
PID 3356 set thread context of 5304	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	95
PID 3356 set thread context of 1924	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	96
PID 3356 set thread context of 6132	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	97
PID 3356 set thread context of 5092	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	98
PID 3356 set thread context of 4728	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	99
PID 3356 set thread context of 1628	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	100
PID 3356 set thread context of 4144	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	101
PID 3356 set thread context of 5184	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	102
PID 3356 set thread context of 3780	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	103
PID 3356 set thread context of 1308	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	104
PID 3356 set thread context of 5520	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	105

Suspicious behavior: EnumeratesProcesses 32 IoCs

pid	Process
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89
PID 3356 wrote to memory of 1288	3356	1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe	89

C:\Users\Admin\AppData\Local\Temp\1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe
"C:\Users\Admin\AppData\Local\Temp\1f1963b8ccabbb9aaae9ce93b78d91f4f01faf0a21aed8e71b2adece16f8d5e6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3356
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:1288
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:5060
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:5384
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:5684
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:1972
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:5304
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:1924
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:6132
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:5092
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:4728
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:1628
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:4144
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:5184
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:3780
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:1308
- C:\Windows\explorer.exe
  "C:\Windows\explorer.exe" --url=florinn.dev:3333 --algo=rx/0 --threads=2
  2⤵
  PID:5520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1288-0-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-1-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-15-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-19-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-17-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-11-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-13-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-3-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-9-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-7-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1288-5-0x00000000004E0000-0x0000000000DB1000-memory.dmp

Download

memory/1924-193-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-186-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-191-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-189-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-197-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-187-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-201-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-199-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1924-195-0x0000000000800000-0x00000000010D1000-memory.dmp

Download

memory/1972-125-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-124-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-129-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-127-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-135-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-141-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-133-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-137-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-139-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-143-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/1972-132-0x0000000000600000-0x0000000000ED1000-memory.dmp

Download

memory/5060-40-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-34-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-32-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-31-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-51-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-48-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-46-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-38-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-36-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-44-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5060-42-0x00000000008E0000-0x00000000011B1000-memory.dmp

Download

memory/5384-74-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-62-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-63-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-76-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-77-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-65-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-71-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-79-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-81-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-67-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5384-70-0x0000000000A00000-0x00000000012D1000-memory.dmp

Download

memory/5684-102-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-106-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-108-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-104-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-110-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-112-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-100-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-94-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-93-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-96-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download

memory/5684-98-0x00000000006F0000-0x0000000000FC1000-memory.dmp

Download