Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	May 18, 2021, 9:36 a.m.	May 18, 2021, 9:38 a.m.

Size	4.4MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`3db9825a26cbb1f4bffd62194c5c52cc`
SHA256	`5cb22ad59b4939061964e9573c8d68d713b863dce697514d3db5b5966ac96bf8`
CRC32	`561E3C77`
ssdeep	`98304:AtuIzz7rT4oppuU5/shL5gn3o4Y01cVqT4AY3:qu/m/GL5gnq01coMAY3`
PDB Path	C:\Users\Test\source\repos\Trinity-Miner\Trinity-Miner\obj\Release\Trinity-Miner.pdb
Yara	Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT Is_DotNET_EXE - (no description) PE_Header_Zero - PE File Signature OS_Processor_Check_Zero - OS Processor Check IsPE32 - (no description)

Trinity-Miner_1.exe "C:\Users\test22\AppData\Local\Temp\Trinity-Miner_1.exe"
7948
- xmrig.exe "C:\Users\test22\AppData\Roaming\xmrig.exe" -p trinity-miner --donate-level 5 -o pool.supportxmr.com:443 -u 89UyhNJWGyP6xoycGBA3A6HjdNEs7g3jr34EXVtqGYzg5wLEbmZY2AcGy5Kw5NRfjaYTUyW1dKCHGinv7fGMg45zVCRQwNM -k --tls
  7768

Name	Response	Post-Analysis Lookup
pool.supportxmr.com	A 91.121.140.167 A 94.23.247.226 CNAME pool-fr.supportxmr.com A 37.187.95.110 A 94.23.23.52 A 149.202.83.171	94.23.23.52

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch
37.187.95.110	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

Flow	Issuer	Subject	Fingerprint
TLS 1.2 192.168.56.102:49809 37.187.95.110:443	C=IT, ST=Pool, L=Daemon, O=Mining Pool, CN=mining.pool	C=IT, ST=Pool, L=Daemon, O=Mining Pool, CN=mining.pool	ed:70:55:ea:18:df:51:b7:88:49:41:f5:e7:18:23:f7:46:ca:a5:e1

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 18, 2021, 9:28 a.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 18, 2021, 9:28 a.m.			0	0
IsDebuggerPresent May 18, 2021, 9:28 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

C:\Users\Test\source\repos\Trinity-Miner\Trinity-Miner\obj\Release\Trinity-Miner.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx May 18, 2021, 9:28 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (47 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 2490368 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006e0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000008c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2371000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2a0b000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 1441792 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000ad0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000bb0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2372000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2374000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bda000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c8c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92cb6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c90000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bec000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bfb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92c2c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bfd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bd2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92bea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7948 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe92d41000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:28 a.m.	process_identifier: 7768 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000530000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:29 a.m.	process_identifier: 7768 region_size: 262144 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000020fe0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:29 a.m.	process_identifier: 7768 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000000000 allocation_type: 536883200 (MEM_COMMIT\|MEM_RESERVE\|MEM_LARGE_PAGES) process_handle: 0xffffffffffffffff		-1073741727
NtAllocateVirtualMemory May 18, 2021, 9:29 a.m.	process_identifier: 7768 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000211a0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory May 18, 2021, 9:29 a.m.	process_identifier: 7768 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000000000 allocation_type: 536883200 (MEM_COMMIT\|MEM_RESERVE\|MEM_LARGE_PAGES) process_handle: 0xffffffffffffffff		-1073741727
NtAllocateVirtualMemory May 18, 2021, 9:29 a.m.	process_identifier: 7768 region_size: 131072 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000211c0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Roaming\xmrig.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW May 18, 2021, 9:28 a.m.	thread_identifier: 5720 thread_handle: 0x0000000000000204 process_identifier: 7768 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "C:\Users\test22\AppData\Roaming\xmrig.exe" -p trinity-miner --donate-level 5 -o pool.supportxmr.com:443 -u 89UyhNJWGyP6xoycGBA3A6HjdNEs7g3jr34EXVtqGYzg5wLEbmZY2AcGy5Kw5NRfjaYTUyW1dKCHGinv7fGMg45zVCRQwNM -k --tls filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000000000000021c	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses May 18, 2021, 9:28 a.m.	flags: 14 family: 0		111	0

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\aldwin

reg_value

"C:\Users\test22\AppData\Local\Temp\Trinity-Miner_1.exe"

Created a service where a service was also not started (1 event)

Time & API	Arguments	Status	Return	Repeated
CreateServiceW May 18, 2021, 9:28 a.m.	service_start_name: start_type: 3 password: display_name: WinRing0_1_2_0 filepath: C:\Users\test22\AppData\Roaming\WinRing0x64.sys service_name: WinRing0_1_2_0 filepath_r: C:\Users\test22\AppData\Roaming\WinRing0x64.sys desired_access: 983551 service_handle: 0x0000000021a31490 error_control: 1 service_type: 1 service_manager_handle: 0x0000000021a31580	1	564335760	0

A stratum cryptocurrency mining command was executed (1 event)

cmdline

"C:\Users\test22\AppData\Roaming\xmrig.exe" -p trinity-miner --donate-level 5 -o pool.supportxmr.com:443 -u 89UyhNJWGyP6xoycGBA3A6HjdNEs7g3jr34EXVtqGYzg5wLEbmZY2AcGy5Kw5NRfjaYTUyW1dKCHGinv7fGMg45zVCRQwNM -k --tls

Detects Virtual Machines through their custom firmware (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation May 18, 2021, 9:28 a.m.	information_class: 76 (SystemFirmwareTableInformation)		-1073741789	0

File has been identified by 49 AntiVirus engines on VirusTotal as malicious (49 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.46219474
FireEye	Generic.mg.3db9825a26cbb1f4
McAfee	Artemis!3DB9825A26CB
Cylance	Unsafe
Sangfor	Win.Coinminer.Generic-7151250-0
K7AntiVirus	Trojan ( 005507361 )
Alibaba	Trojan:Win32/BitMiner.d523d34e
K7GW	Trojan ( 005507361 )
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W32/MSIL_Troj.C.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Injector.ULC
APEX	Malicious
Avast	Win64:CoinminerX-gen [Trj]
ClamAV	Win.Coinminer.Generic-7151250-0
Kaspersky	not-a-virus:HEUR:RiskTool.Win32.BitMiner.gen
BitDefender	Trojan.GenericKD.46219474
NANO-Antivirus	Trojan.Win32.BitMiner.iuujxc
Paloalto	generic.ml
Ad-Aware	Trojan.GenericKD.46219474
Sophos	Generic Reputation PUA (PUA)
DrWeb	Trojan.InjectNET.14
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TROJ_GEN.R002C0GE421
McAfee-GW-Edition	BehavesLike.Win32.Generic.rh
Emsisoft	Trojan.GenericKD.46219474 (B)
SentinelOne	Static AI - Malicious PE
Webroot	W32.Adware.Gen
Avira	TR/Dropper.MSIL.Gen
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	PUA:Win64/CoinMiner
Gridinsoft	Trojan.Win32.CoinMiner.vb
AegisLab	Trojan.Win32.Miner.4!c
GData	Trojan.GenericKD.46219474
Cynet	Malicious (score: 100)
BitDefenderTheta	Gen:NN.ZemsilF.34688.@p0@ampGtDh
ALYac	Trojan.GenericKD.46219474
MAX	malware (ai score=81)
VBA32	Trojan.Miner
Malwarebytes	Malware.AI.3693548997
TrendMicro-HouseCall	TROJ_GEN.R002C0GE421
Rising	HackTool.XMRMiner!1.C2EC (CLOUD)
Ikarus	Trojan.MSIL.Injector
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	Riskware/Miner
AVG	Win64:CoinminerX-gen [Trj]
Cybereason	malicious.85b929
Panda	Trj/GdSda.A

Trinity-Miner_1.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All