TrendLabs: (Almost) Hollow and Innocent: Monero Miner Remains Undetected via Process Hollowing

Figure 2. Arithmetic operations performed on the alphanumeric characters

REF: https://blog.trendmicro.com/trendlabs-security-intelligence/almost-hollow-and-innocent-monero-miner-remains-undetected-via-process-hollowing/