libhwloc-5.dll threat report

MD5 13f32f17d6f0db924bb26f30afaa3218
Latest seen 2021-06-18 20:22:13 (4 years ago)
First seen 2019-06-13 15:21:15 (6 years ago)
Size 1 MB
Signed by Stax Digital LLC

GridinSoft Anti-Malware detection

Detected by GridinSoft before you download

The current ThreatInfo record shows this exact file hash detected as Risk.CoinMiner. Download GridinSoft Anti-Malware to scan the device, confirm whether this file is present, and remove the detected object if it is found.

Detection name
Risk.CoinMiner
Recommended action
Scan and remove
Last analysis
2021-06-18 20:22:13 (4 years ago)
File hash
13f32f17d6f0db924bb26f30afaa3218
Download Anti-Malware

Why it matters

Why GridinSoft flags this file

Detection

GridinSoft identifies the sample as Risk.CoinMiner.

Timeline

First seen 2019-06-13 15:21:15 (6 years ago); latest analysis 2021-06-18 20:22:13 (4 years ago).

Digital signature

Signed by Stax Digital LLC. The signature is reported as valid, but signed files can still be bundled or abused.

Observed locations

ThreatInfo has seen this file in user or system paths listed below. Unexpected locations increase the need for local verification.

Recommended action

What to do next

  1. Compare the MD5 above with the file found on the device.
  2. Check whether the file appears in the observed locations or under one of the alternate names.
  3. Run GridinSoft Anti-Malware to confirm the detection and remove the file if it is present.

libhwloc-5.dll is a Windows file recorded in the ThreatInfo database. The current detection status is Risk.CoinMiner, based on the latest analysis from 2021-06-18 20:22:13 (4 years ago).

If libhwloc-5.dll appears on your computer unexpectedly, treat it as suspicious. Check its location, digital signature, and recent system changes before allowing it to run. A full anti-malware scan is recommended when this file is detected as Risk.CoinMiner.

MD5: 13f32f17d6f0db924bb26f30afaa3218
Size: 1 MB
First Published: 2019-06-13 15:21:15 (6 years ago)
Latest Published: 2021-06-18 20:22:13 (4 years ago)
Status: Risk.CoinMiner (on last analysis)
Analysis Date: 2021-06-18 20:22:13 (4 years ago)
libhwloc-5.dll detection screenshot

The screenshot is a visual record of a GridinSoft Anti-Malware detection for this sample. Use the hash and metadata above as the primary identifiers when comparing the file on your system.

Signed By: Stax Digital LLC
Status: Valid

The signature on libhwloc-5.dll is reported as valid. A valid signature helps confirm publisher identity, but it does not automatically make the file safe if the installer was bundled, abused, or downloaded from an untrusted source.

%appdata%\honey miner\miners
%sysdrive%\windows.old\users\moonc\appdata\roaming\honey miner\miners
%appdata%\honey miner\miners
%appdata%\honey miner\miners
%appdata%\honey miner\miners
%appdata%\honey miner\miners
%appdata%\honey miner\miners
%appdata%\honey miner\miners
%appdata%\honey miner\miners
%appdata%\honey miner\miners

ThreatInfo has observed libhwloc-5.dll in the locations listed above. Files found in temporary folders, user profile folders, startup locations, or unusual application directories should be reviewed more carefully than files installed under a known program directory.

23.1%
15.4%
15.4%
7.7%
7.7%
7.7%
7.7%
7.7%
7.7%

The strongest geographic signal for this file is United States with 23.1% of observed hits. Geographic distribution can help identify targeted campaigns, regional software bundles, or where a file is most commonly reported.

Windows 10 100.0%

The most common operating system signal for libhwloc-5.dll is Windows 10 with 100.0% of observed hits. If your system differs from the common profile, check whether the file was introduced by a specific installer, archive, or removable device.

libhwloc-5.dll is identified as pe for 64 systems. The subsystem is Windows CUI. PE header values are useful for triage, especially when they do not match the expected publisher, product, or release timeline.

Subsystem: Windows CUI
PE Type: pe
OS Bitness: 64
Image Base: 0x0000000069e80000
Entry Address: 0x000013b0

PE Sections:

Name Size of data MD5
.text 125952 db2eb910bcadda77045fccf86dabf968
.data 1024 c872561727e787e9eacc9e00ecdfc79a
.rdata 22016 a212a310691e2bcb574f0ec3da1b83d6
.pdata 5120 cec7c88098486519c596da65dc1fc5ec
.xdata 5632 f16cd189bfbc1f34e22074e11eb4ff1c
.bss 0 00000000000000000000000000000000
.edata 7168 1b73bd4579c64b3fd735d9033dc67662
.idata 3584 77e17ad2fefef8008a45c267efa7b48b
.CRT 512 93ac0cee33830fd9ac147e0afd8e3fb3
.tls 512 37b569ae7ff6a2b0edb78939c2219541
.reloc 512 cf92ac9567b2de0b5ca9662b2f1466e0
/4 2048 71ad458b8741547d8a0fe713ccf8db21
/19 875008 4d51523edbf39e1fb1cb5c9ba7dc279e
/31 30720 ce034b91a7f4714bd49d037fc2aee753
/45 49664 ff4cba2f8bd197c326b598837fda5439
/57 28672 d1105ef64b8169cf2ad95ce38e23489c
/70 15872 d148a36205b4d8bf3bd0717b46b3dd59
/81 245248 94c01c90a530400ba03536e2f3ee130e
/92 24576 ad752b975c6d7e9b98bacea062336c9c

PE section names and hashes can reveal packing, injected resources, or unusual build artifacts. Sections with uncommon names, very large raw data, or hashes that differ from a trusted copy deserve additional review.

More information: