xmrig | 9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/09/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Photo.scr
Size 5.9MB
Sample260922-pgwt7avfle
SHA256 9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9
MD5 5616a3471565d34d779b5b3d0520bb70
SHA1 42df726156bee4a54ea328bd72a659602ab7d03e
SHA512 21f70509a14eaf5dd63b533df612b64b07ff0e991d3a4ba3c17c9618bc952bccb61e189c04ca234fb374d2c75779aff108fd9bc7c44857e4034887b861058c1e
SSDEEP 98304:RLbSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD823FUuzmH:tBfTCiUs0VSLOJgyBGUA8Ch8
TLSH
T151563345F4809837F139153629F980F2B07DBC7297244BDBA35E2AA56E317D83239A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence privilege_escalation pyinstaller upx

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
discovery

Network Service Discovery
T1046

XMRig Miner payload 13 IoCs

miner

resource	yara_rule
behavioral1/memory/1076-516-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-531-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-546-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-561-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-576-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-592-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-607-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-622-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-637-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-652-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-667-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-683-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig
behavioral1/memory/1076-698-0x0000000000400000-0x00000000009B6000-memory.dmp	xmrig

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
1936	netsh.exe

ACProtect 1.3x - 1.4x DLL software 22 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000243d2-32.dat	acprotect
behavioral1/files/0x00070000000243c2-35.dat	acprotect
behavioral1/files/0x00070000000243c4-38.dat	acprotect
behavioral1/files/0x00070000000243c6-42.dat	acprotect
behavioral1/files/0x00070000000243c7-44.dat	acprotect
behavioral1/files/0x00070000000243c5-47.dat	acprotect
behavioral1/files/0x00070000000243d0-52.dat	acprotect
behavioral1/files/0x00070000000243ce-55.dat	acprotect
behavioral1/files/0x00070000000243da-58.dat	acprotect
behavioral1/files/0x00070000000243d3-61.dat	acprotect
behavioral1/files/0x00070000000243d8-68.dat	acprotect
behavioral1/files/0x00070000000243d5-71.dat	acprotect
behavioral1/files/0x00070000000243d7-63.dat	acprotect
behavioral1/files/0x0007000000024444-312.dat	acprotect
behavioral1/files/0x0007000000024440-309.dat	acprotect
behavioral1/files/0x000700000002443d-306.dat	acprotect
behavioral1/files/0x000700000002443b-304.dat	acprotect
behavioral1/files/0x0007000000024438-301.dat	acprotect
behavioral1/files/0x0007000000024436-299.dat	acprotect
behavioral1/files/0x0007000000024434-297.dat	acprotect
behavioral1/files/0x0007000000024433-296.dat	acprotect
behavioral1/files/0x0007000000024430-293.dat	acprotect

Executes dropped EXE 11 IoCs

pid	Process
4704	HelpPane.exe
3192	HelpPane.exe
2252	HelpPane.exe
4432	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4548	HelpPane.exe
3820	HelpPane.exe
332	HelpPane.exe
4436	HelpPane.exe
1076	xmrig.exe

Loads dropped DLL 64 IoCs

pid	Process
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3280	Photo.scr
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
3192	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4700	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4700	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4648	HelpPane.exe
4700	HelpPane.exe
4700	HelpPane.exe
4700	HelpPane.exe
4700	HelpPane.exe
4700	HelpPane.exe
3820	HelpPane.exe
3820	HelpPane.exe
3820	HelpPane.exe
3820	HelpPane.exe
3820	HelpPane.exe
3820	HelpPane.exe

UPX packed file 64 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x00070000000243d2-32.dat	upx
behavioral1/memory/3280-34-0x0000000075870000-0x0000000075B20000-memory.dmp	upx
behavioral1/files/0x00070000000243c2-35.dat	upx
behavioral1/files/0x00070000000243c4-38.dat	upx
behavioral1/memory/3280-40-0x00000000757A0000-0x00000000757BD000-memory.dmp	upx
behavioral1/files/0x00070000000243c6-42.dat	upx
behavioral1/memory/3280-45-0x0000000075780000-0x0000000075791000-memory.dmp	upx
behavioral1/memory/3280-46-0x0000000075610000-0x0000000075779000-memory.dmp	upx
behavioral1/files/0x00070000000243c7-44.dat	upx
behavioral1/memory/3280-37-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/files/0x00070000000243c5-47.dat	upx
behavioral1/memory/3280-49-0x0000000075500000-0x0000000075607000-memory.dmp	upx
behavioral1/files/0x00070000000243d0-52.dat	upx
behavioral1/memory/3280-53-0x0000000000900000-0x0000000000914000-memory.dmp	upx
behavioral1/files/0x00070000000243ce-55.dat	upx
behavioral1/memory/3280-57-0x0000000000920000-0x000000000092A000-memory.dmp	upx
behavioral1/files/0x00070000000243da-58.dat	upx
behavioral1/files/0x00070000000243d3-61.dat	upx
behavioral1/memory/3280-67-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral1/memory/3280-66-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
behavioral1/files/0x00070000000243d8-68.dat	upx
behavioral1/files/0x00070000000243d5-71.dat	upx
behavioral1/memory/3280-76-0x0000000075610000-0x0000000075779000-memory.dmp	upx
behavioral1/memory/3280-75-0x0000000075780000-0x0000000075791000-memory.dmp	upx
behavioral1/memory/3280-74-0x000000001E7D0000-0x000000001E7DE000-memory.dmp	upx
behavioral1/memory/3280-73-0x000000001E9B0000-0x000000001E9BD000-memory.dmp	upx
behavioral1/memory/3280-72-0x00000000757A0000-0x00000000757BD000-memory.dmp	upx
behavioral1/memory/3280-65-0x000000001ECB0000-0x000000001ECC1000-memory.dmp	upx
behavioral1/memory/3280-64-0x0000000075870000-0x0000000075B20000-memory.dmp	upx
behavioral1/files/0x00070000000243d7-63.dat	upx
behavioral1/memory/3280-117-0x0000000075500000-0x0000000075607000-memory.dmp	upx
behavioral1/memory/3192-118-0x0000000075060000-0x0000000075310000-memory.dmp	upx
behavioral1/memory/3192-125-0x0000000075040000-0x000000007505D000-memory.dmp	upx
behavioral1/memory/3192-124-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/3280-122-0x0000000000900000-0x0000000000914000-memory.dmp	upx
behavioral1/memory/3192-132-0x0000000074EB0000-0x0000000075019000-memory.dmp	upx
behavioral1/memory/3192-131-0x0000000075020000-0x0000000075031000-memory.dmp	upx
behavioral1/memory/3280-129-0x0000000000920000-0x000000000092A000-memory.dmp	upx
behavioral1/memory/3192-136-0x0000000074DA0000-0x0000000074EA7000-memory.dmp	upx
behavioral1/memory/3280-135-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
behavioral1/memory/3280-140-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral1/memory/3192-141-0x0000000000810000-0x0000000000824000-memory.dmp	upx
behavioral1/memory/3192-155-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral1/memory/3192-154-0x000000001ECB0000-0x000000001ECC1000-memory.dmp	upx
behavioral1/memory/3192-153-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
behavioral1/memory/3192-152-0x0000000075060000-0x0000000075310000-memory.dmp	upx
behavioral1/memory/3192-146-0x0000000000830000-0x000000000083A000-memory.dmp	upx
behavioral1/memory/3192-163-0x000000001E7D0000-0x000000001E7DE000-memory.dmp	upx
behavioral1/memory/3192-162-0x0000000075020000-0x0000000075031000-memory.dmp	upx
behavioral1/memory/3192-161-0x0000000075040000-0x000000007505D000-memory.dmp	upx
behavioral1/memory/3192-159-0x000000001E9B0000-0x000000001E9BD000-memory.dmp	upx
behavioral1/memory/3192-181-0x0000000075020000-0x0000000075031000-memory.dmp	upx
behavioral1/memory/3192-188-0x000000001E7D0000-0x000000001E7DE000-memory.dmp	upx
behavioral1/memory/3192-187-0x000000001E9B0000-0x000000001E9BD000-memory.dmp	upx
behavioral1/memory/3192-186-0x000000001E8C0000-0x000000001E8E1000-memory.dmp	upx
behavioral1/memory/3192-185-0x000000001E7A0000-0x000000001E7C7000-memory.dmp	upx
behavioral1/memory/3192-184-0x0000000000830000-0x000000000083A000-memory.dmp	upx
behavioral1/memory/3192-183-0x0000000000810000-0x0000000000824000-memory.dmp	upx
behavioral1/memory/3192-182-0x0000000074DA0000-0x0000000074EA7000-memory.dmp	upx
behavioral1/memory/3192-180-0x0000000074EB0000-0x0000000075019000-memory.dmp	upx
behavioral1/memory/3192-179-0x0000000010000000-0x000000001000E000-memory.dmp	upx
behavioral1/memory/3192-178-0x0000000075040000-0x000000007505D000-memory.dmp	upx
behavioral1/memory/3192-177-0x000000001ECB0000-0x000000001ECC1000-memory.dmp	upx
behavioral1/memory/3192-164-0x0000000075060000-0x0000000075310000-memory.dmp	upx

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
behavioral1/files/0x00080000000243bf-80.dat	pyinstaller

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

Executes a command shell one-liner 1 TTPs 8 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3784	cmd.exe
3816	cmd.exe
1116	cmd.exe
3608	cmd.exe
2776	cmd.exe
2112	cmd.exe
1668	cmd.exe
4092	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 23 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xmrig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photo.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Photo.scr
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpPane.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
952	taskkill.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4436	HelpPane.exe
4436	HelpPane.exe
4436	HelpPane.exe
4436	HelpPane.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3280	Photo.scr
Token: SeDebugPrivilege	3192	HelpPane.exe
Token: SeDebugPrivilege	4648	HelpPane.exe
Token: SeDebugPrivilege	4700	HelpPane.exe
Token: SeDebugPrivilege	3820	HelpPane.exe
Token: SeDebugPrivilege	952	taskkill.exe
Token: SeLockMemoryPrivilege	1076	xmrig.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1944 wrote to memory of 3280	1944	Photo.scr	84
PID 3280 wrote to memory of 1116	3280	Photo.scr	87
PID 3280 wrote to memory of 3608	3280	Photo.scr	90
PID 3608 wrote to memory of 4704	3608	cmd.exe	92
PID 4704 wrote to memory of 3192	4704	HelpPane.exe	93
PID 3280 wrote to memory of 2776	3280	Photo.scr	95
PID 2776 wrote to memory of 4432	2776	cmd.exe	98
PID 2252 wrote to memory of 4648	2252	HelpPane.exe	99
PID 4432 wrote to memory of 4700	4432	HelpPane.exe	100
PID 4648 wrote to memory of 3816	4648	HelpPane.exe	101
PID 4648 wrote to memory of 3784	4648	HelpPane.exe	103
PID 3784 wrote to memory of 4548	3784	cmd.exe	105
PID 4548 wrote to memory of 3820	4548	HelpPane.exe	106
PID 332 wrote to memory of 4436	332	HelpPane.exe	108
PID 4436 wrote to memory of 4092	4436	HelpPane.exe	109
PID 4092 wrote to memory of 952	4092	cmd.exe	111
PID 4436 wrote to memory of 1668	4436	HelpPane.exe	113
PID 4436 wrote to memory of 2112	4436	HelpPane.exe	115
PID 4436 wrote to memory of 1076	4436	HelpPane.exe	119
PID 4436 wrote to memory of 1936	4436	HelpPane.exe	121

C:\Users\Admin\AppData\Local\Temp\Photo.scr
"C:\Users\Admin\AppData\Local\Temp\Photo.scr" /S
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1944
- C:\Users\Admin\AppData\Local\Temp\Photo.scr
  "C:\Users\Admin\AppData\Local\Temp\Photo.scr" /S
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3280
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy /y C:\Users\Admin\AppData\Local\Temp\Photo.scr C:\Users\Admin\HelpPane.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1116
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\HelpPane.exe --startup auto install
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3608
  - - C:\Users\Admin\HelpPane.exe
      C:\Users\Admin\HelpPane.exe --startup auto install
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4704
    - - C:\Users\Admin\HelpPane.exe
        
        C:\Users\Admin\HelpPane.exe --startup auto install
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\HelpPane.exe start
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2776
  - - C:\Users\Admin\HelpPane.exe
      C:\Users\Admin\HelpPane.exe start
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4432
    - - C:\Users\Admin\HelpPane.exe
        
        C:\Users\Admin\HelpPane.exe start
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4700

C:\Users\Admin\HelpPane.exe
"C:\Users\Admin\HelpPane.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2252
- C:\Users\Admin\HelpPane.exe
  "C:\Users\Admin\HelpPane.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4648
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy /y C:\Users\Admin\HelpPane.exe C:\Users\Admin\HelpPane.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3816
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c C:\Users\Admin\HelpPane.exe start
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3784
  - - C:\Users\Admin\HelpPane.exe
      C:\Users\Admin\HelpPane.exe start
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4548
    - - C:\Users\Admin\HelpPane.exe
        
        C:\Users\Admin\HelpPane.exe start
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3820

C:\Users\Admin\HelpPane.exe
"C:\Users\Admin\HelpPane.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:332
- C:\Users\Admin\HelpPane.exe
  "C:\Users\Admin\HelpPane.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c taskkill /pid 880 /f
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /pid 880 /f
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI3322\\xmrig.exe C:\Windows\TEMP\xmrig.exe
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1668
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI3322\\config.json C:\Windows\TEMP\config.json
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2112
- - C:\Windows\TEMP\xmrig.exe
    C:\Windows\TEMP\xmrig.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:1076
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram C:\Users\Admin\HelpPane.exe "MyApp" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:1936

C:\Windows\System32\WUDFHost.exe
"C:\Windows\System32\WUDFHost.exe" -HostGUID:{193a1820-d9ac-4997-8c55-be817523f6aa} -IoEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-7109ed55-8dee-4ced-a178-bfd26c0a6d9e -SystemEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-224bb59a-36a1-41e4-95cb-1c0c07704072 -IoCancelEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-05aef635-a9a5-4851-8b8c-db3321abfc94 -NonStateChangingEventPortName:\UMDFCommunicationPorts\WUDF\HostProcess-3c614479-e063-46bd-9194-ca556c2a215e -LifetimeId:0a96066f-a06f-4bef-ae3f-060d488deefb -DeviceGroupId:WudfDefaultDevicePool -HostArg:0
1⤵
PID:3944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Credential Access

Discovery

Network Service Discovery

T1046

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\_socket.pyd
Size 21KB
SHA256 be10254b111713bef20a13d561de61ca3c74a34c64ddc5b10825c64ab2c46734
MD5 be47363992c7dd90019276d35fa8da76
SHA1 ccf7ebbe829da08efd95a53d4ba0c0d4938f6169
SHA512 573f9111535a9a136fcaaa5c1a16c347f7327626768d849513d69c9848406b1002dcc5b8c17a291ef2e6519587533ca806018ee471a39d330f032a9e7e635ea7
SSDEEP 384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
TLSH
T110A2C165E3366B58C9AE00B1107EBA134B30988E54E4DBA59EEC71BFCC14F09996C3E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\_ssl.pyd
Size 487KB
SHA256 c236271b92a0f1d3304337f2e2444107f34d8e26272981f48c47db347133566c
MD5 68c3ad86e0a8833c29ad1be10d3c025d
SHA1 04488362814b2f3ae07c4e8df8e45868d48b447f
SHA512 bb2819d913033cc26dcd1e5cbf015dacdbf747d29c72bfd41bfe0d74bb77e51a61cf9be4b67b6348938837125f1d0f80af0ac33531e00cea1585535952a22785
SSDEEP 12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
TLSH
T13AB42385C66350EBD2BC30BB3FE979E4E162A5522213079FDAE9CD37570670C39A045B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ftpcrack.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\ftpcrack.exe.manifest
Size 1KB
SHA256 78b1160f6adab34d144ad19a0f4b83f83453f1e18460bbdfbe17ad354b62af7d
MD5 b5dea49b86c5bb5d9cd8d64a09f70065
SHA1 487ef676ebd244ebc3cf197f70da7a5e393fb96e
SHA512 1b5914f4c52f47a33c57f5f6428482e6766099bf43d4e8616ce4aabc4a917c24b2e0c98c841f0d7e7b8a202f40ff960885535539bf70cc7c7ed8687c7ece010c
TLSH
T1CB21BE01C4C4E922A73200D33795BD49DE4DA7AB088C4A9EB49DBB2F9F27AD58343165
MD5 SHA1 SHA512 TLSH

Submit Download

netifaces.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\netifaces.pyd
Size 11KB
SHA256 1a6c57ac8031582477b1d3463a65b6eb006eea704e27c8c4b812b99ea910428d
MD5 c7807680a69196c3ee66c4cfb3e271ac
SHA1 d3ea74c9e3b810c6a1ee4296b97e20f2f45c9461
SHA512 a5d893132ad889e98b434da7fd5ca377afb1800fd8d3230cced5e9fde576fcec943dd22fa48810ba6d93c510ebaa8ac5a94ec1b9d639fd6c533c5bbd4737cf15
SSDEEP 192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
TLSH
T147327D16C7AA5BDDC47D01334DAE35691890E11CB9DFCBEA9A88323B9C41F601E28796
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

psutil._psutil_windows.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\psutil._psutil_windows.pyd
Size 25KB
SHA256 2e4ad3d08118da77c928c4614bfecb34397cfaf53f5d46d7c7e5f1da3172c1f1
MD5 2fc800fcc46a597921c2ed447aeb09ac
SHA1 72004227e5c60c8460f835a170798aa22861b79e
SHA512 a17022b364615b45a1873aea0de922a2988e4d75a8f4e63ecb9ca7dd46263e684b1f28b82bd77b046bbe2ad03ce65c5dacf98eaccae861a30f137e0118a87225
SSDEEP 384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
TLSH
T16AB2CFEBF2618A74E77C817761AFB00E09A0A15CC2D54B57EBDC327B85A0B203D6C261
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\python27.dll
Size 877KB
SHA256 fbad053d962bac96865ac3372958d697711800fdc46f36c87011bb5e89026614
MD5 8c44826a640b3cf0b32b0258c65fee07
SHA1 e3f9fe6366d0876bfa8b903b20d2acf06416f1bc
SHA512 884e2c01c088b9ae86d4605fed1cf8e9b17f99cf887efc5644f4a91959ecd89148cca3e9fdaa6ab9e8c4dfd2d61dbdfd442a95b13dab7e5cd027b4782d473355
SSDEEP 24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
TLSH
T1871523287C5EE992E88F2BFB42975D119512763048B48FE5FFE443DA181B6300727B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\pywintypes27.dll
Size 52KB
SHA256 82c2926cb03a04392fa479801d505e2a387446bca978ff930177121db2fdb461
MD5 07b436bfa1c7b4ffc21fb39358158060
SHA1 7f5a47cdab9a7d93bbbd204cedffca61d3f80c84
SHA512 13ebcb83f478c859ca808003933769b84290e108648b69f33043653263c5b4bd37ed5ca8d521b46a1d9122eb232f7e5d05a25e16f250d5573cf85cd5cdefb2ef
SSDEEP 1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
TLSH
T1CA332840A98BCC5BDE0BE3371CC9256190E6A3148794F7E1B5DBC1A3E5B636B6C1A01B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

servicemanager.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\servicemanager.pyd
Size 16KB
SHA256 60da4b4e628b7dc1115615128ac554aeb29b50a61629ad5aeeb5cc9d2bd86202
MD5 6a95bcf45e4be23cc2634ef5bad17660
SHA1 7d13b791588cb800c2add75ff8e74c3c493a8143
SHA512 d3c80b025647444f42d42e82cad50c4383728f7f8c9e16aa9d87450ca864b0b97b5f8f47e80328a4a2b67ce7d06c9a8f1dae8c5b3c798de1b2a50164161e69c8
SSDEEP 384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
TLSH
T19572AF27E3DB45AAE0F7623C0C7B6B1601347509B5B5A6D86AF4203AC4A1F045B78793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19442\win32api.pyd
Size 34KB
SHA256 87ceeb1b7586db730f48988a07018f9c8af57934ff7f173a869542207f46b0f1
MD5 42c475231f4835bb1a5f94b0d3da4520
SHA1 fcfae296dd10c92d973a57d61bbf5c0f4a15ed6b
SHA512 d1a699b8497e8843f990f6f719a904a7751fe2a9404cb195be2d94341728a7372cd93d379b576e6031980e1da53f2336805c6bf59e799b63565cd63d4931c02a
SSDEEP 768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
TLSH
T1DBF2D04BFACA472ACE248A35476FBB5525043130A375E7BD628032790C40F382F39BA9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Crypto.Cipher._AES.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19~1\Crypto.Cipher._AES.pyd
Size 16KB
SHA256 c1a900615c9500c46b9602c30c53f299290b03632208ef1152af8830ab73ad17
MD5 371397e80a55d432da47311b8ef25317
SHA1 71617777d6a2500d6464d7b394c8be5f1e4e119e
SHA512 3139e2848acf02cc8475449f213873d2c2b7196f6a55c70d2d8f8b487020387740364e5ca0aa584624d1b9b01b965146a2f0e15eef34830c7c0ecbb8637dae03
SSDEEP 384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
TLSH
T17A72AEB2A2B68F05C52F51B724AEA9150D31FE4CB6D053D963A8303388C2FD0685DAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19~1\_ctypes.pyd
Size 37KB
SHA256 6456fea123e04bcec8a8eed26160e1df5482e69d187d3e1a0c428995472ac134
MD5 6cb8b560efbc381651d2045f1571d7c8
SHA1 15283a7a467adb7b6d7a7182f660dd783f90e483
SHA512 ca2958095e8e08b5ef05ec9de15b7d1eb180923a40b90356db56a124101c96d8e745001948b89dbe9d6b9ce3c2029f7e9eaf20c73fa1d410a821d6605830bfc0
SSDEEP 768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
TLSH
T1A303F133A5739690C060C1B63F7F3A6E9594A634C9D243AF7C69343BC954600AD35B96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19~1\_hashlib.pyd
Size 343KB
SHA256 7863e1bedfe1ffc720b67b2eb7b3491db9d2b8e56b5574e6a40ff90336b8dafa
MD5 ee134421fbabeb565e4f3ca721331c2e
SHA1 4b03bdd142c6a7bb6f74abe968c5b76b63e06059
SHA512 d27ff65b6a8bf2e5e70d2865e72eee6930e76c2a3990428c54fc998743d3c540c5c984b5d1429e8ffbe3d160ae1f6782cd6d3ca40822f81d2052ba168595d1fa
SSDEEP 6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
TLSH
T155742307DFD3711AC02B01366843781A751AE9E3E8BB29D562D72851F4B2FDB06422FA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32event.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19~1\win32event.pyd
Size 11KB
SHA256 26e6d883e9e61bf872425526a9b8c7bb229c3b9d2f82bb3c0bf500660dbe1995
MD5 796306be7a1abcffb8853ee9ceb5beae
SHA1 93762cf53958a3a99b674986fcf3c53c489133ed
SHA512 5919a837fa1fcaea91b14d02da306928d5e523e4591dca290422c9eb9be15f2ee626a8379f5c953f2b08e7a6b2cd67618652b9efa9ace8abd47a8bd7cd8c2f64
SSDEEP 192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
TLSH
T18F328C52D2AACB9BD0FFC17C0DAF74161020BA0DD354C76C69E8353B6C26FA49D34662
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32service.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI19~1\win32service.pyd
Size 18KB
SHA256 e52b5532a6764aaae67db557412b3f77ebdc8a14a72771a1c6414a83bb3fc15c
MD5 f23a62491bd945c050e3e1d13909e9e7
SHA1 b8dac4e00163533157a17e3b56d05e049a2375a2
SHA512 52200cf9687752db43bbae703192c841694d5bd976fa56c0f25e0478cfb97681bc77677c1a8907167612ddf9fe6a561945fbeb0180022670af97bf41b5b11766
SSDEEP 384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
TLSH
T16B82AF57E7FC87C8E66F81390D7F334A1B24D91CA58656AB3EDC12678C10F542C682E2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyconfig.h

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\Include\pyconfig.h
Size 20KB
SHA256 8b130d901e0f83b55699d565f103f2f8f1b3a51712ebb4b9646ea517cc1f04d6
MD5 bc185de8b2437963368a85fdd9852951
SHA1 1459f1428214fcca7f203fb3a3aff28e16eb9c1b
SHA512 918469d9a59fe059f3c7c93f34c8d2d07cb8a9bf5e953a1527922ed5c65ff4a2df50bbc78ed9ce146bf3a1fb6f1763f061262fa4a937beeee1feb8a99e31339e
SSDEEP 384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
TLSH
T1F4A242278DEE22E14073C0E2A25D7A5FD60BCEFB924164E8601C9D1C7E2551296FD7EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.VC90.CRT.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\Microsoft.VC90.CRT.manifest
Size 1KB
SHA256 0d060ed7c25159b7b75f16d449963bfd639c15b3c5280bc7897403268c2b9f35
MD5 bfb93876892cca8e2ad0021585c34c8b
SHA1 0dde1b225c98825a09d8ff85f462571c9c862e35
SHA512 fe70540b3b3fa88b32dfb2ff7406a3a9819e7862b850d871b932996bbeffdbc70d7192d6e3196a8583b2db756ca9cc278505afbe585ba30eb1222d4f8be15b7b
TLSH
T19A116550C0D89816A33102D73722DD49DC06D7FB0C8C8BAD709E7B2F1713954C2A31A4
MD5 SHA1 SHA512 TLSH

Submit Download

_win32sysloader.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\_win32sysloader.pyd
Size 8KB
SHA256 dbb0f9c499a710bbc8bcde4ecc3577a6c9548262d6ce4434ed5a0708cbc787dd
MD5 b4a567d80ccc08fb1c7fbb765847afda
SHA1 b7ff2c68ba2887aaf5d029f41922e626c72b716d
SHA512 ddfec25304babe2df55958f512f61afd9af88dda499fe87931d17a9eebf048449885a06a24bddbc8604e11f07ced3c2ece7f89c28290cab5d1bf3816d22128db
SSDEEP 192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
TLSH
T1B7F1D80A6B3ED49BDDFE2EBC18666B1A162D3D2257A9617F53F40EC80EC128050B4773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

back.jpg

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\back.jpg
Size 46KB
SHA256 1de815d23e82a3a94c42f5e5ac1c5dfc690a585ca495c57d2e4a283ab4008208
MD5 c84452f6f4d46ddec4f8852fa0b1afd0
SHA1 cc06c71abcefc9b31e3c5ed043427b74a4ad778a
SHA512 4bb933bb5ded0eb71ebc8acbc9ff43a2c2ef0dec87bc85a5e4158a16230c9c1568bf0d555b6e507d2a18ade52298ef71df7b9b8bde0d159609e3ffae6cca4e37
SSDEEP 768:RDQeAoYo0BrGohy0ZarKZcgRl8+kRGdlS7q3sqqELsLizIdI9e2E:VQJw0BKnuntlkRGAB0ceO
TLSH
T135236FE07AF95CCAEB66A67E4183D222623CF5E047635B530734B4B24F63F9239C1612
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\bz2.pyd
Size 35KB
SHA256 29520df660a5bbd704b9106a6650a66e4f5766b904d05f97146668d41dbf5839
MD5 c9c00bc854a39e66b27787d188f9e8d7
SHA1 21f20cf6c628b529db4bdb853b679f9bf23590e3
SHA512 8887b5ca542220cac04d5a6a22a06f95db560f4fe0f9a128ceb642ed9716abcffba2146cce682eb16c4da3f423649a61904a73c4357d9fdbd5ddf606790199a3
SSDEEP 768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
TLSH
T1F9F2E1D3747293CEE4ED583A1DC63902A225C59CC7D1ABD4BDEC503B8201F143A5DAE8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cacert.pem

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\certifi\cacert.pem
Size 277KB
SHA256 397b833e5acf89a2709b964401a9aca68d24b62349b72bbe38684e586aa07a27
MD5 dd2dd543395692705f7dda0f5e7750fa
SHA1 40d7ce60393978a29fb0e0b1e849658e48cf7887
SHA512 3ba0d6ad8b6838b04fbfdebad20eb5544c093ba592b517aa383708a34ce2bd215db2bf010090251674dbcfd4eda3c44f770c9fbf314304de918d7e59e2596cf2
SSDEEP 6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
TLSH
T118547D964F165C09388FF1C1CA9B231BDD3E027B99FAB0F129066848D24762617FDD9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\config.json
Size 1KB
SHA256 7bcbdbb5b450bed0a6abb77f49be9668bf223d121e0b644e942d6c45221f487a
MD5 b112d56c0aeca51b6c6fa3bbc1fb416a
SHA1 bcd5d59a41ae832603ad55d749e1172cc0c90ac8
SHA512 6c3c58c02d8b3ad00d0c5c678ad07072b09717416150ccaeffb0833b74bd283fd005ca831d589ae3d47da8ff1cc77724e2d149491b1add6f863993aaaa75e82b
TLSH
T1EE213A20CA380CB712D5313C59FDA3931A68D6434EA53E39754C5A4C2F1DB3E66B2BD6
MD5 SHA1 SHA512 TLSH

Submit Download

cacerts.txt

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\httplib2\cacerts.txt
Size 132KB
SHA256 2039836a620f956ec094eaae7c9b41a04c76f31130898b11014d9e83c905f0de
MD5 14ba876ba2515a25bbb511f24bf06653
SHA1 291dcdee67e880b21fd7001cb8350c3ecee4cac8
SHA512 5035f82df06308a14f6626c54382b3ab34b6d664c8394b48f75275f69dcc2b93266d843b51f0b586e5f12fcd70fe3660b5b08afc20738df6d8c812592c0d71e4
SSDEEP 3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
TLSH
T1BFD35C8A4F155C04288FE5D1CA87231BDE39427F86EEB0F129576855D20362B27FCE9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcm90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\msvcm90.dll
Size 220KB
SHA256 7a74da389fbd10a710c294c2e914dc6f18e05f028f07958a2fa53ac44f0e4b90
MD5 d34a527493f39af4491b3e909dc697ca
SHA1 afee32fcd9ce160680371357a072f58c5f790d48
SHA512 0dabc5455eb02601d7c40a9c49b3ade750b1118934ef3785fb314fa313437bc02b243571aba25f1661a69dcea36838530c12762a2e6602d14a9b03770a82cca6
SSDEEP 3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
TLSH
T1BD24189E5B138D3BD59A1373F5A3C304A27B689257A173C3811BA2281A543C4FDB6ED3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\msvcp90.dll
Size 327KB
SHA256 9694756f43b20abc50f95646c54e9e36cd6edf8eed3db846064567399f4e7566
MD5 92ea2db0e788894c43753c550216a886
SHA1 da8c7a178ba0ca80d321666f5642a7436b640602
SHA512 90e72a68c7267e8d0986a75247ae7b2339e4c2a981d686342b2ef90b1fcf9695b558d0bd5932f7c53524e02cc664b974ba76783fde919b24eb36795db3300ba6
SSDEEP 6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
TLSH
T13E64332337070EF2E595B3C076C5432297F1BC5A4655B36392DFE0652F9A39C62A3AE0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr90.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\msvcr90.dll
Size 244KB
SHA256 df86421e354f817607f2bafc9188569242fcf9dd564b28f3e2915c86a0ba1f54
MD5 199d34b03c7d0eb804a6d9869184b8d4
SHA1 03148854519d0970c1bbdc089d3e8de1aed61c47
SHA512 e4269ca993393422a90231daabd390771a635eeb0817a9d00dccef496372bb4b57b615529f26a2e8132bde825cdaca07d965d207421c02ea6471da214354361e
SSDEEP 6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
TLSH
T1BB3402AE9E2F5E13D8CF82366C14D526403E980012F4BF8559E31F2C098D7AD6E48F6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

perfmon.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\perfmon.pyd
Size 11KB
SHA256 ac491704af920be0e503f0243d2d371e230622e213e9f082347b52c0a7b009c2
MD5 ee813500a441b5ffdacd853e95bee669
SHA1 7f05f1493380af3fe08f55524f6ff90c47c0cc4d
SHA512 060d079a93add067eb062d2b1cb9977719be68ae1223b0219dbb14cc9c6c66ff47d9929945636b577bc7f1bb84d5500b88acd5f7bf636cc63bd4c88534af724e
SSDEEP 192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
TLSH
T11A328D17E6F65799D0EB423008AF770B0C61B91ED894A65C9AD820775C81F547E28B72
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\pyexpat.pyd
Size 51KB
SHA256 0beb3b16f9a11f93137365a1179d2062a414adaba337bcac05a083a921775b50
MD5 ad560121efd8e249fc3414200d98f75f
SHA1 73040f9bc04e733a85da00e364ef85583f505636
SHA512 6da2b01773dce658dcfd9219dd8d093f60eaff669ed600c9a62efc39fb3e362f051a499fac85777c1b8f364b1ad2e134e080cae720fc5477711a7ed7f191a5c7
SSDEEP 1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
TLSH
T1D933F12FFBDE7754E66AF0771D8E7E032031911EA1E08CBD8619711B1A21760ED8D7A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\select.pyd
Size 9KB
SHA256 7b90ec138ac8415d9b747612063d19147fec2b1e99de97c3b5636e8ca40b346e
MD5 57eb00056ac8c38cd4f3153fb9507f13
SHA1 ddee8e74fcc81b6301145f27c0f1ccf4b9185e1c
SHA512 05f7ef6bd065d7db3f41dfa95187fa40a14f58fa5d4705f2df5982db18eeb6d4e93c473d05932436bf645e76e0b23532867011e92ef953ec247b55648ed9c6ef
SSDEEP 192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
TLSH
T13B127E42DB6BCF69C1AD813A0C9B784B18A1D61D9244567AEFE831330C67B04391CFE3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\unicodedata.pyd
Size 177KB
SHA256 35c84d824db175dd71046806a59bc711021abce04698fa304b1e2a9855e50a9c
MD5 9a465cfaa788e29e7b1366c012ebc75c
SHA1 10d9c49bb6652d9b04e17608d9ed35b036112647
SHA512 31bee259c78ceb1e4f5c52e7b2cbd0eb62a071fc9c748df47ab824e383efdc3b218168700341b96d139dabfb3e4d7644341f22e52982b7c7f135a9e35b300b00
SSDEEP 3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
TLSH
T1A60412CDC0825A9AD5F8D335C806B29562D8AA1DE61B11E8A3FC00393F5AFD116EDF46
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32evtlog.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\win32evtlog.pyd
Size 19KB
SHA256 ac9c5c4baa4de19bddf55313f29182f26eb80312c31266413672c61424a5c6e0
MD5 317360be68901d11f3d02af1c151a4dc
SHA1 570bf03be1a737cf3d0cf3fc8e77261cf64e2051
SHA512 25c25c23dd4fe1957cdfad833d4570553c2627775008f3939525b6a3d1892f8b6cb7a9f20d454166338df4dfc8a98306a1160016ae4cb2e9464944945afa0a82
SSDEEP 384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
TLSH
T1B292AE9FF55ED45DC1EF413E0DBF3A5A4615C12DD3C84B7E62D8222B0C44794ACA8BA1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xmrig.exe

Path C:\Users\Admin\AppData\Local\Temp\_MEI45482\xmrig.exe
Size 1.8MB
SHA256 4bf737b29ff521bc263eb1f2c1c5ea04b47470cccd1beae245d98def389929bd
MD5 13bdd9cd9f7e51746172996262b5a873
SHA1 3834f8179abd7a827e927505f3c226ac8bbcf3ee
SHA512 49879918505d042312f20b2fc8310a8c4a58aa266ed1ab05e0481f7e11385da0920cf9d756f842eb98e4394f14725385b74a99b38fc8a60222fa4cc873cb8040
SSDEEP 49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
TLSH
T1DF9533373686DA38E73B2871A10AFAAEFD130D0B5D72236993C4B71EAB736145178543
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HelpPane.exe

Path C:\Users\Admin\HelpPane.exe
Size 5.9MB
SHA256 9194b57673209c8534888f61b0cdefa34f463ae50cd78f72ab2b3348220baaf9
MD5 5616a3471565d34d779b5b3d0520bb70
SHA1 42df726156bee4a54ea328bd72a659602ab7d03e
SHA512 21f70509a14eaf5dd63b533df612b64b07ff0e991d3a4ba3c17c9618bc952bccb61e189c04ca234fb374d2c75779aff108fd9bc7c44857e4034887b861058c1e
SSDEEP 98304:RLbSThOfTCiFBXmfFs+JhEpCVoR8oMEOJ6Ty3RvX+UGD823FUuzmH:tBfTCiUs0VSLOJgyBGUA8Ch8
TLSH
T151563345F4809837F139153629F980F2B07DBC7297244BDBA35E2AA56E317D83239A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1076-561-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-531-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-546-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-516-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-576-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-592-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-607-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-622-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-637-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-652-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-667-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-683-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/1076-698-0x0000000000400000-0x00000000009B6000-memory.dmp

Download

memory/3192-146-0x0000000000830000-0x000000000083A000-memory.dmp

Download

memory/3192-182-0x0000000074DA0000-0x0000000074EA7000-memory.dmp

Download

memory/3192-152-0x0000000075060000-0x0000000075310000-memory.dmp

Download

memory/3192-154-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Download

memory/3192-163-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Download

memory/3192-162-0x0000000075020000-0x0000000075031000-memory.dmp

Download

memory/3192-161-0x0000000075040000-0x000000007505D000-memory.dmp

Download

memory/3192-159-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Download

memory/3192-181-0x0000000075020000-0x0000000075031000-memory.dmp

Download

memory/3192-188-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Download

memory/3192-187-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Download

memory/3192-186-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Download

memory/3192-185-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Download

memory/3192-184-0x0000000000830000-0x000000000083A000-memory.dmp

Download

memory/3192-183-0x0000000000810000-0x0000000000824000-memory.dmp

Download

memory/3192-124-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/3192-180-0x0000000074EB0000-0x0000000075019000-memory.dmp

Download

memory/3192-179-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/3192-178-0x0000000075040000-0x000000007505D000-memory.dmp

Download

memory/3192-177-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Download

memory/3192-164-0x0000000075060000-0x0000000075310000-memory.dmp

Download

memory/3192-155-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Download

memory/3192-141-0x0000000000810000-0x0000000000824000-memory.dmp

Download

memory/3192-118-0x0000000075060000-0x0000000075310000-memory.dmp

Download

memory/3192-153-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Download

memory/3192-136-0x0000000074DA0000-0x0000000074EA7000-memory.dmp

Download

memory/3192-125-0x0000000075040000-0x000000007505D000-memory.dmp

Download

memory/3192-131-0x0000000075020000-0x0000000075031000-memory.dmp

Download

memory/3192-132-0x0000000074EB0000-0x0000000075019000-memory.dmp

Download

memory/3280-135-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Download

memory/3280-122-0x0000000000900000-0x0000000000914000-memory.dmp

Download

memory/3280-129-0x0000000000920000-0x000000000092A000-memory.dmp

Download

memory/3280-140-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Download

memory/3280-117-0x0000000075500000-0x0000000075607000-memory.dmp

Download

memory/3280-64-0x0000000075870000-0x0000000075B20000-memory.dmp

Download

memory/3280-65-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Download

memory/3280-468-0x0000000075870000-0x0000000075B20000-memory.dmp

Download

memory/3280-72-0x00000000757A0000-0x00000000757BD000-memory.dmp

Download

memory/3280-73-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Download

memory/3280-74-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Download

memory/3280-75-0x0000000075780000-0x0000000075791000-memory.dmp

Download

memory/3280-76-0x0000000075610000-0x0000000075779000-memory.dmp

Download

memory/3280-66-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Download

memory/3280-67-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Download

memory/3280-57-0x0000000000920000-0x000000000092A000-memory.dmp

Download

memory/3280-53-0x0000000000900000-0x0000000000914000-memory.dmp

Download

memory/3280-49-0x0000000075500000-0x0000000075607000-memory.dmp

Download

memory/3280-37-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/3280-46-0x0000000075610000-0x0000000075779000-memory.dmp

Download

memory/3280-45-0x0000000075780000-0x0000000075791000-memory.dmp

Download

memory/3280-40-0x00000000757A0000-0x00000000757BD000-memory.dmp

Download

memory/3280-34-0x0000000075870000-0x0000000075B20000-memory.dmp

Download

memory/3820-317-0x0000000074580000-0x0000000074830000-memory.dmp

Download

memory/3820-330-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Download

memory/3820-319-0x0000000074560000-0x000000007457D000-memory.dmp

Download

memory/3820-320-0x0000000074540000-0x0000000074551000-memory.dmp

Download

memory/3820-321-0x00000000743D0000-0x0000000074539000-memory.dmp

Download

memory/3820-322-0x00000000742C0000-0x00000000743C7000-memory.dmp

Download

memory/3820-327-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Download

memory/3820-324-0x0000000000830000-0x0000000000844000-memory.dmp

Download

memory/3820-325-0x0000000000850000-0x000000000085A000-memory.dmp

Download

memory/3820-318-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/3820-328-0x0000000074580000-0x0000000074830000-memory.dmp

Download

memory/3820-329-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Download

memory/4436-638-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-547-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-653-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-684-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-623-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-608-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-593-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-577-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-562-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-668-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-532-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-517-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-503-0x0000000073FF0000-0x000000007400D000-memory.dmp

Download

memory/4436-504-0x0000000073FD0000-0x0000000073FE1000-memory.dmp

Download

memory/4436-514-0x0000000002A50000-0x0000000002A79000-memory.dmp

Download

memory/4436-501-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4436-699-0x0000000074010000-0x00000000742C0000-memory.dmp

Download

memory/4648-259-0x0000000074D70000-0x0000000074D81000-memory.dmp

Download

memory/4648-273-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Download

memory/4648-323-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Download

memory/4648-254-0x0000000075060000-0x0000000075310000-memory.dmp

Download

memory/4648-256-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/4648-270-0x0000000074D90000-0x0000000074DAD000-memory.dmp

Download

memory/4648-271-0x0000000000CC0000-0x0000000000CCA000-memory.dmp

Download

memory/4648-272-0x0000000074D70000-0x0000000074D81000-memory.dmp

Download

memory/4648-258-0x0000000074D90000-0x0000000074DAD000-memory.dmp

Download

memory/4648-279-0x000000001E9B0000-0x000000001E9BD000-memory.dmp

Download

memory/4648-278-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Download

memory/4648-274-0x0000000074BE0000-0x0000000074D49000-memory.dmp

Download

memory/4648-281-0x0000000074940000-0x0000000074A47000-memory.dmp

Download

memory/4648-275-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Download

memory/4648-267-0x0000000075060000-0x0000000075310000-memory.dmp

Download

memory/4648-261-0x0000000074BE0000-0x0000000074D49000-memory.dmp

Download

memory/4648-266-0x00000000026B0000-0x00000000026C4000-memory.dmp

Download

memory/4648-280-0x000000001E7D0000-0x000000001E7DE000-memory.dmp

Download

memory/4648-264-0x0000000074940000-0x0000000074A47000-memory.dmp

Download

memory/4700-277-0x0000000074A50000-0x0000000074BB9000-memory.dmp

Download

memory/4700-263-0x0000000074A50000-0x0000000074BB9000-memory.dmp

Download

memory/4700-260-0x0000000074D50000-0x0000000074D6D000-memory.dmp

Download

memory/4700-276-0x0000000074BC0000-0x0000000074BD1000-memory.dmp

Download

memory/4700-269-0x0000000002410000-0x0000000002424000-memory.dmp

Download

memory/4700-257-0x0000000010000000-0x000000001000E000-memory.dmp

Download

memory/4700-282-0x0000000000A20000-0x0000000000A2A000-memory.dmp

Download

memory/4700-285-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Download

memory/4700-283-0x000000001ECB0000-0x000000001ECC1000-memory.dmp

Download

memory/4700-255-0x0000000074DB0000-0x0000000075060000-memory.dmp

Download

memory/4700-284-0x000000001E7A0000-0x000000001E7C7000-memory.dmp

Download

memory/4700-268-0x0000000074DB0000-0x0000000075060000-memory.dmp

Download

memory/4700-326-0x000000001E8C0000-0x000000001E8E1000-memory.dmp

Download

memory/4700-265-0x0000000074830000-0x0000000074937000-memory.dmp

Download

memory/4700-262-0x0000000074BC0000-0x0000000074BD1000-memory.dmp

Download