overlord | 719df509a9a138af9bc8758a93fc589521c342baf0a390cb0936a60fd0140519

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/11/2026, 13:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-04_c2511dfe1a792b9056ba71be26174e09_akira_cobalt-strike.exe
Size 589KB
Sample261105-q7gnmacz7k
SHA256 719df509a9a138af9bc8758a93fc589521c342baf0a390cb0936a60fd0140519
MD5 c2511dfe1a792b9056ba71be26174e09
SHA1 b298d91a41840bdcbb16d7cf97193b127afaacc2
SHA512 2c9c75d62e673d1996cae97ca95e23760185cfb8374f8bec293e246deeadb64d786b75a9f6ec6ba32ba3f1f9873b2857b415583f9c6293613b6f98441d2035e5
SSDEEP 6144:Nelg+2hHFoDsGVK3V6zudUMcbn+rycLcMPr698nsz+JxgH5/OpapXc5Zpd46a4lf:Ylg+LVK8udFccLlsz+JuH5m3UGLWaXv
TLSH
T1EAD47D07B6A6A1BCD15AC03883469672F673B4C90631BDBF03E487312F69E519F2D719
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution overlord xmrig miner persistence privilege_escalation rat spyware stealer trojan

Malware Config

Extracted

Family

overlord

734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Extracted

Family

overlord

734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Signatures

Family: Overlord
Overlord is an open-source Windows RAT written in Golang.
rat overlord
Family: xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
miner xmrig

Detects Overlord RAT 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c1e1-565.dat	family_overlord
behavioral2/memory/5200-695-0x00007FF7F62F0000-0x00007FF7F8DC6000-memory.dmp	family_overlord
behavioral2/memory/5200-740-0x00007FF7F62F0000-0x00007FF7F8DC6000-memory.dmp	family_overlord

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify = "1"	reg.exe

Custom signature

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs

resource	yara_rule
behavioral2/memory/4444-527-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4444-554-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4444-561-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs
behavioral2/memory/4444-750-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Custom signature

Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 3 IoCs

resource	yara_rule
behavioral2/files/0x000e00000001c1e1-565.dat	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5200-695-0x00007FF7F62F0000-0x00007FF7F8DC6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers
behavioral2/memory/5200-740-0x00007FF7F62F0000-0x00007FF7F8DC6000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_References_Browsers

Custom signature

Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs

resource	yara_rule
behavioral2/memory/4444-527-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4444-554-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4444-561-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore
behavioral2/memory/4444-750-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore

Custom signature

Detects executables containing URLs to raw contents of a Github gist 4 IoCs

resource	yara_rule
behavioral2/memory/4444-527-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4444-554-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4444-561-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL
behavioral2/memory/4444-750-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp	INDICATOR_SUSPICIOUS_EXE_RawGitHub_URL

XMRig Miner payload 2 IoCs

miner

resource	yara_rule
behavioral2/memory/1264-559-0x00007FF613D90000-0x00007FF6144F7000-memory.dmp	xmrig
behavioral2/memory/4392-560-0x00007FF679370000-0x00007FF679AD7000-memory.dmp	xmrig

Command and Scripting Interpreter: PowerShell 1 TTPs 27 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5724	powershell.exe
5368	powershell.exe
2596	powershell.exe
3268	powershell.exe
2896	powershell.exe
6060	powershell.exe
4356	powershell.exe
4860	powershell.exe
3096	powershell.exe
3052	powershell.exe
4788	powershell.exe
2600	powershell.exe
3496	powershell.exe
1788	powershell.exe
2896	powershell.exe
3496	powershell.exe
3096	powershell.exe
5368	powershell.exe
3052	powershell.exe
3268	powershell.exe
2600	powershell.exe
6060	powershell.exe
1788	powershell.exe
4356	powershell.exe
5724	powershell.exe
4788	powershell.exe
2596	powershell.exe

Modifies Windows Firewall 2 TTPs 20 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
5724	netsh.exe
5712	netsh.exe
3372	netsh.exe
3244	netsh.exe
4928	netsh.exe
5448	netsh.exe
604	netsh.exe
1960	netsh.exe
4692	netsh.exe
2364	netsh.exe
5512	netsh.exe
2616	netsh.exe
3340	netsh.exe
1368	netsh.exe
2780	netsh.exe
5688	netsh.exe
2424	netsh.exe
4392	netsh.exe
4612	netsh.exe
1828	netsh.exe

Executes a file named after a Windows system binary 1 TTPs 3 IoCs

The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

defense_evasion

Match Legitimate Name or Location

T1036.005

description	ioc	Process
File opened (read-only)	C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe	SecurityHealthService.exe
File opened (read-only)	C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe	SecurityHealthService.exe

Executes dropped EXE 10 IoCs

pid	Process
4444	python.exe
1264	AntiMalwareServiceExecutable.exe
4392	AntiMalwareServiceExecutable.exe
5200	svhost.exe
2148	SecurityHealthService.exe
120	WindowsSecurityService.exe
5892	SecurityHealthService.exe
4868	SecurityHealthService.exe
5764	WindowsSecurityService.exe
4572	WindowsSecurityService.exe

Loads dropped DLL 40 IoCs

pid	Process
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
4444	python.exe
5764	WindowsSecurityService.exe

Reads WinSCP keys stored on the system 2 TTPs
Tries to access WinSCP stored sessions.
spyware stealer

Data from Local System
T1005

Credentials in Registry
T1552.002
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh	netsh.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 14 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	python.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AntiMalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AntiMalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	AntiMalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	svhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	svhost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2026-11-04_c2511dfe1a792b9056ba71be26174e09_akira_cobalt-strike.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2026-11-04_c2511dfe1a792b9056ba71be26174e09_akira_cobalt-strike.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	AntiMalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	SecurityHealthService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WindowsSecurityService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WindowsSecurityService.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	python.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AntiMalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AntiMalwareServiceExecutable.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AntiMalwareServiceExecutable.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	AntiMalwareServiceExecutable.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	svhost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svhost.exe

Kills process with taskkill 1 IoCs

defense_evasion

pid	Process
3548	taskkill.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
6108	schtasks.exe
3716	schtasks.exe

Suspicious behavior: EnumeratesProcesses 45 IoCs

pid	Process
1788	powershell.exe
1788	powershell.exe
4356	powershell.exe
4356	powershell.exe
4356	powershell.exe
4860	powershell.exe
4860	powershell.exe
4860	powershell.exe
2148	SecurityHealthService.exe
2148	SecurityHealthService.exe
2148	SecurityHealthService.exe
2148	SecurityHealthService.exe
5724	powershell.exe
5724	powershell.exe
5724	powershell.exe
3096	powershell.exe
3096	powershell.exe
3096	powershell.exe
5368	powershell.exe
5368	powershell.exe
5368	powershell.exe
3052	powershell.exe
3052	powershell.exe
3052	powershell.exe
4788	powershell.exe
4788	powershell.exe
4788	powershell.exe
2596	powershell.exe
2596	powershell.exe
2596	powershell.exe
3268	powershell.exe
3268	powershell.exe
3268	powershell.exe
2600	powershell.exe
2600	powershell.exe
2600	powershell.exe
2896	powershell.exe
2896	powershell.exe
2896	powershell.exe
3496	powershell.exe
3496	powershell.exe
3496	powershell.exe
6060	powershell.exe
6060	powershell.exe
6060	powershell.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeIncreaseQuotaPrivilege	1788	powershell.exe
Token: SeSecurityPrivilege	1788	powershell.exe
Token: SeTakeOwnershipPrivilege	1788	powershell.exe
Token: SeLoadDriverPrivilege	1788	powershell.exe
Token: SeSystemProfilePrivilege	1788	powershell.exe
Token: SeSystemtimePrivilege	1788	powershell.exe
Token: SeProfSingleProcessPrivilege	1788	powershell.exe
Token: SeIncBasePriorityPrivilege	1788	powershell.exe
Token: SeCreatePagefilePrivilege	1788	powershell.exe
Token: SeBackupPrivilege	1788	powershell.exe
Token: SeRestorePrivilege	1788	powershell.exe
Token: SeShutdownPrivilege	1788	powershell.exe
Token: SeDebugPrivilege	1788	powershell.exe
Token: SeSystemEnvironmentPrivilege	1788	powershell.exe
Token: SeRemoteShutdownPrivilege	1788	powershell.exe
Token: SeUndockPrivilege	1788	powershell.exe
Token: SeManageVolumePrivilege	1788	powershell.exe
Token: 33	1788	powershell.exe
Token: 34	1788	powershell.exe
Token: 35	1788	powershell.exe
Token: 36	1788	powershell.exe
Token: SeDebugPrivilege	4356	powershell.exe
Token: SeDebugPrivilege	4444	python.exe
Token: SeDebugPrivilege	3548	taskkill.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeIncreaseQuotaPrivilege	4860	powershell.exe
Token: SeSecurityPrivilege	4860	powershell.exe
Token: SeTakeOwnershipPrivilege	4860	powershell.exe
Token: SeLoadDriverPrivilege	4860	powershell.exe
Token: SeSystemProfilePrivilege	4860	powershell.exe
Token: SeSystemtimePrivilege	4860	powershell.exe
Token: SeProfSingleProcessPrivilege	4860	powershell.exe
Token: SeIncBasePriorityPrivilege	4860	powershell.exe
Token: SeCreatePagefilePrivilege	4860	powershell.exe
Token: SeBackupPrivilege	4860	powershell.exe
Token: SeRestorePrivilege	4860	powershell.exe
Token: SeShutdownPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeSystemEnvironmentPrivilege	4860	powershell.exe
Token: SeRemoteShutdownPrivilege	4860	powershell.exe
Token: SeUndockPrivilege	4860	powershell.exe
Token: SeManageVolumePrivilege	4860	powershell.exe
Token: 33	4860	powershell.exe
Token: 34	4860	powershell.exe
Token: 35	4860	powershell.exe
Token: 36	4860	powershell.exe
Token: SeIncreaseQuotaPrivilege	4860	powershell.exe
Token: SeSecurityPrivilege	4860	powershell.exe
Token: SeTakeOwnershipPrivilege	4860	powershell.exe
Token: SeLoadDriverPrivilege	4860	powershell.exe
Token: SeSystemProfilePrivilege	4860	powershell.exe
Token: SeSystemtimePrivilege	4860	powershell.exe
Token: SeProfSingleProcessPrivilege	4860	powershell.exe
Token: SeIncBasePriorityPrivilege	4860	powershell.exe
Token: SeCreatePagefilePrivilege	4860	powershell.exe
Token: SeBackupPrivilege	4860	powershell.exe
Token: SeRestorePrivilege	4860	powershell.exe
Token: SeShutdownPrivilege	4860	powershell.exe
Token: SeDebugPrivilege	4860	powershell.exe
Token: SeSystemEnvironmentPrivilege	4860	powershell.exe
Token: SeRemoteShutdownPrivilege	4860	powershell.exe
Token: SeUndockPrivilege	4860	powershell.exe
Token: SeManageVolumePrivilege	4860	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4812	ShellHost.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 4444	2732	2026-11-04_c2511dfe1a792b9056ba71be26174e09_akira_cobalt-strike.exe	90
PID 4444 wrote to memory of 1788	4444	python.exe	92
PID 4444 wrote to memory of 4356	4444	python.exe	95
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 6072	4444	python.exe	97
PID 4444 wrote to memory of 3548	4444	python.exe	100
PID 4444 wrote to memory of 1264	4444	python.exe	102
PID 4444 wrote to memory of 5200	4444	python.exe	105
PID 5200 wrote to memory of 4860	5200	svhost.exe	106
PID 4444 wrote to memory of 2148	4444	python.exe	108
PID 2148 wrote to memory of 4948	2148	SecurityHealthService.exe	110
PID 2148 wrote to memory of 5724	2148	SecurityHealthService.exe	112
PID 2148 wrote to memory of 3096	2148	SecurityHealthService.exe	114
PID 2148 wrote to memory of 5368	2148	SecurityHealthService.exe	116
PID 4444 wrote to memory of 120	4444	python.exe	118
PID 120 wrote to memory of 3052	120	WindowsSecurityService.exe	119
PID 2148 wrote to memory of 3716	2148	SecurityHealthService.exe	121
PID 120 wrote to memory of 4788	120	WindowsSecurityService.exe	125
PID 2148 wrote to memory of 2596	2148	SecurityHealthService.exe	127
PID 120 wrote to memory of 3268	120	WindowsSecurityService.exe	129
PID 2148 wrote to memory of 2600	2148	SecurityHealthService.exe	131
PID 120 wrote to memory of 2364	120	WindowsSecurityService.exe	133
PID 2148 wrote to memory of 4868	2148	SecurityHealthService.exe	135
PID 120 wrote to memory of 5712	120	WindowsSecurityService.exe	187
PID 120 wrote to memory of 932	120	WindowsSecurityService.exe	139
PID 120 wrote to memory of 5688	120	WindowsSecurityService.exe	141
PID 120 wrote to memory of 3372	120	WindowsSecurityService.exe	143
PID 120 wrote to memory of 2424	120	WindowsSecurityService.exe	145
PID 120 wrote to memory of 5512	120	WindowsSecurityService.exe	147
PID 120 wrote to memory of 5448	120	WindowsSecurityService.exe	149
PID 120 wrote to memory of 604	120	WindowsSecurityService.exe	151
PID 120 wrote to memory of 2616	120	WindowsSecurityService.exe	153
PID 120 wrote to memory of 3340	120	WindowsSecurityService.exe	155
PID 120 wrote to memory of 6108	120	WindowsSecurityService.exe	157
PID 120 wrote to memory of 5764	120	WindowsSecurityService.exe	159
PID 5764 wrote to memory of 2896	5764	WindowsSecurityService.exe	160
PID 5764 wrote to memory of 3496	5764	WindowsSecurityService.exe	164
PID 5764 wrote to memory of 6060	5764	WindowsSecurityService.exe	166
PID 5764 wrote to memory of 1960	5764	WindowsSecurityService.exe	168
PID 5764 wrote to memory of 4392	5764	WindowsSecurityService.exe	170
PID 5764 wrote to memory of 1964	5764	WindowsSecurityService.exe	172
PID 5764 wrote to memory of 1368	5764	WindowsSecurityService.exe	174
PID 5764 wrote to memory of 4692	5764	WindowsSecurityService.exe	176
PID 5764 wrote to memory of 3244	5764	WindowsSecurityService.exe	178
PID 5764 wrote to memory of 4928	5764	WindowsSecurityService.exe	180
PID 5764 wrote to memory of 4612	5764	WindowsSecurityService.exe	182
PID 5764 wrote to memory of 1828	5764	WindowsSecurityService.exe	184
PID 5764 wrote to memory of 5724	5764	WindowsSecurityService.exe	186
PID 5764 wrote to memory of 2780	5764	WindowsSecurityService.exe	188

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2026-11-04_c2511dfe1a792b9056ba71be26174e09_akira_cobalt-strike.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-04_c2511dfe1a792b9056ba71be26174e09_akira_cobalt-strike.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
  "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe" C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\loader.py
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Reads the TCP/IP host and domain name from the registry
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4444
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1788
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'python.exe' -ErrorAction SilentlyContinue"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4356
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe"
    3⤵
    PID:6072
- - C:\Windows\SYSTEM32\taskkill.exe
    taskkill /F /IM Telegram.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:3548
- - C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
    C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    PID:1264
- - C:\Users\Admin\AppData\Local\Temp\svhost.exe
    C:\Users\Admin\AppData\Local\Temp\svhost.exe
    3⤵
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Checks processor information in registry
    - Suspicious use of WriteProcessMemory
    PID:5200
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svhost.exe.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svhost.exe_139cb51b' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:4860
- - C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
    C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
    3⤵
    - Executes a file named after a Windows system binary
    - Executes dropped EXE
    - Reads the TCP/IP host and domain name from the registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:2148
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /Delete /TN MicrosoftEdgeUpdateTaskMachine /F
      4⤵
      PID:4948
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5724
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3096
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:5368
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /Create /TN MicrosoftEdgeUpdateTaskMachineCore /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3716
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2596
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:2600
  - - C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe"
      4⤵
      Executes dropped EXE
      PID:4868
- - C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
    C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
    3⤵
    - Executes dropped EXE
    - Suspicious use of WriteProcessMemory
    PID:120
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3052
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:4788
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious behavior: EnumeratesProcesses
      PID:3268
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles state off
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2364
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall set allprofiles settings notifyonlisten disable
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5712
  - - C:\Windows\system32\reg.exe
      "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
      4⤵
      Windows security bypass
      PID:932
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5688
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3372
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2424
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5512
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:5448
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:604
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:2616
  - - C:\Windows\system32\netsh.exe
      "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
      4⤵
      Modifies Windows Firewall
      Event Triggered Execution: Netsh Helper DLL
      PID:3340
  - - C:\Windows\system32\schtasks.exe
      "schtasks" /Create /TN MicrosoftSecurityHealthService /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6108
  - - C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Reads the TCP/IP host and domain name from the registry
      Suspicious use of WriteProcessMemory
      PID:5764
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:2896
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:3496
    - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        
        "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
        5⤵
        Command and Scripting Interpreter: PowerShell
        Suspicious behavior: EnumeratesProcesses
        
        PID:6060
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall set allprofiles state off
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1960
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall set allprofiles settings notifyonlisten disable
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4392
    - - C:\Windows\system32\reg.exe
        
        "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
        5⤵
        Windows security bypass
        
        PID:1964
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1368
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4692
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:3244
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4928
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:4612
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:1828
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:5724
      - C:\Windows\System32\Conhost.exe
        
        \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
        6⤵
        
        PID:5712
    - - C:\Windows\system32\netsh.exe
        
        "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
        5⤵
        Modifies Windows Firewall
        Event Triggered Execution: Netsh Helper DLL
        
        PID:2780

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4788

C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
1⤵
PID:4432

C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
1⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Checks processor information in registry
PID:4392

C:\Windows\System32\ShellHost.exe
"C:\Windows\System32\ShellHost.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4812

C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
1⤵
- Executes a file named after a Windows system binary
- Executes dropped EXE
PID:5892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3452

C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
1⤵
- Executes dropped EXE
PID:4572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Disable or Modify Tools

T1562.001

Masquerading

T1036

Match Legitimate Name or Location

T1036.005

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Credentials in Registry

T1552.002

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
MD5 acbc65123954839a819fa2495d239bf7
SHA1 063cff64444a6e3b4be1445b4cecb477e4d6ae47
SHA512 af07d3f6dcf1779bcc864aabe9e08563b20b8df8238df7bb08a5fe3b4e40d10f2e2a4442a042fe5d7a320e3b8195799ecc885549faa8babb5909eb32271e7b91
TLSH
T170216833B3DD8615CC9A413A10CDAC1036B6C7DB40DECFAB7B84E655A43F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_5vgqi14k.fdh.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5vgqi14k.fdh.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

svhost.exe.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svhost.exe.exe
Size 10.5MB
SHA256 59612f52b72988c5028f549c97926755c6ced681708793cb8d052b2bd3a5d68b
MD5 42ef4bcf0c498bad4676c8f6d0b3a71e
SHA1 7075be144e45f105a807f8fff864739152dd8ad8
SHA512 41ccfbad9b92f4cdcda0e695e183df56bf57a4020667aa15a05e9c36af1f5a7dc25f735ac3fffeb665b452ac01edab64fa7adcd34d084e4a9e276fa6278ad792
SSDEEP 98304:CtKDzFYScvNAjn4kGyyEag9XLUUsmRZDu1vaozK9mog:CmeQn4maUDuHK4
TLSH
T15CB64A17EDA555E8C5EED1308A669263BB717C481B3023D72BA0F7242F76BD06EB9700
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AES.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\AES.py
Size 12KB
SHA256 9d07a7461db781b5fd107589bebeb118e69686ef292930039159f08f9cbe6612
MD5 53bdbdd467e07176e72d86db76c75cb9
SHA1 ac6199c6547cb1846d3ba8f2975450021a25e732
SHA512 ed84828ed06eb4fb12583c7b37702adb39c7b91b1073e47fe5039b8d4d9bb47fc0afb20659179fc4c0d3e6276ac073d0b71ecda5128757000d8550ed857fc23f
SSDEEP 384:4ePLSIot8PdJala+nR9f/jRL1h9/0cVmh/jah/j3st/L/Km90:jPuzydJala+nR9f/jRL1h9/0cVmh/jaT
TLSH
T1C942D7335D87ADC169B640863DBD9069EB3B025F3D412612367D861CAFF7B3092BA24D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DES3.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\DES3.py
Size 7KB
SHA256 0008c23a5532defa645baad7e8625d04fa7304152a30f225ffba7ae38ef12ef4
MD5 a2ff6689c2049e9251e5febec25f60c2
SHA1 4236ff57ea80c70cfdfe9447c19caf4563e5d79a
SHA512 00bb7f21f0651d551a70179302da81e9ba1b618dce7380c2cf46baee7d3bde0034d9f63374ff9164641a3920784a210e594f39dc49d4121f9d596b6719792b41
SSDEEP 192:BKQHvCWQLz1GLoi2byIxLK9t4A5zRdQNn4:0eCWYAVvWK9t4wNmNn4
TLSH
T121F183135DC7E9D3157484E63E78E059E723D12F3E921A4136AD901CAFB9B31E36618C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\__init__.py
Size 4KB
SHA256 d7f7c98b77761b301d1636b425af5c75cb72095d9083ec23da503c7509c6f02b
MD5 0d917ebe3fd87839213ddca6ac99ecda
SHA1 7b9d1b7c75427180c2e67bc76723c609713fb976
SHA512 6682395f7317c9d901775b2d72ae2f000901e41afebef690a704cc2dbeb27611f695f3c67e4145e0a0af46fab161417a10332e3d499957e8cdd20c98c7f05b52
SSDEEP 96:m1FvWQq1jGIDvODZsadyeUl+epp9SuiRtuW9k2t:m1FvKjgKZXzp3iaW9Pt
TLSH
T1EA91DD019DA6FCD68974E8C91E7CF219C7F21403AE2125A3B88CE359EFB056086F91D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aes.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\_raw_aes.pyd
Size 29KB
SHA256 2e8b4a482bace75664f01a2c41ab698c88c623d92ea6f1151bd84568dfdba92e
MD5 27e2bc3786f46743cea11c0748a78087
SHA1 a86a811ec92408635cd45cce21de8b3e3a3ae255
SHA512 87be4f06c326ef74f57f446ad1dd79bd44d67111be751f2ca7468f1d20b2bfdb378a291a1a9e3e3f89d2b55f188651297ddf6a8190333f1880db73efe4bc044b
SSDEEP 384:SE3BC/ajA+4TDbPIO8jLkTsLjda0p37usOo8Vd6IHiPKDkAKB5F0OGuu:P3Bb0dbgO8jLkYL3xahoICS4AIW
TLSH
T1C6D26C79A82C87E2CD46E5B585B6186BF92212354763D5FF438105703C637E8FB3AE82
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_aesni.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\_raw_aesni.pyd
Size 15KB
SHA256 a9a3f72954948f56b4ba627e1e47c8ddca5ca0a24670737eceb45ca2788eb621
MD5 6b7b7b2afd32291e1908abba35c1c2b5
SHA1 174e101d6f619be0c90b18ed57ce942a6ed74a53
SHA512 b70d527031cf08350affc3bfbdff5c51d3d7f91780d1987b113c0e4bd4132d2b04f1855c1833dc99fedeccca52b482040b2a0bee44b56086cf254e1f5af336b6
SSDEEP 384:T3yeYCan36Gv5g/yqFvDELxZW9YU0ouZN:T3yeYCan36GvS/y27ELSYUgN
TLSH
T1C1621A84FB4E14B6E1B002BA8893D99AF420751013530AEF03A09D1E6F657C92B3CDF7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_raw_des3.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\_raw_des3.pyd
Size 12KB
SHA256 6fa4fa76c619e0c10f84e0c8104ab13f4f9c6f7149d23f9240a088e57e33597d
MD5 26f683f010b63284e3d2cdfe01f1b253
SHA1 fb0689a6fba9d503a2ddd3fef1353252206522e4
SHA512 f09072a0ffaf2cdcce544a2be85c5219b7c5bb5a948d1edc0be041b88e32164a68f8c3b8ff746d09b5652fb1b411e2357fdc88c3ebd4d58c57dd7e27f2ace635
SSDEEP 192:6cr4BrSM8M/qwZSilxnLhgTFHgIQQJuaH:6c8BrSpUSi/L6T2IxJuu
TLSH
T14C424D44AE4845BAE52B837DC5F70E0AF3A4F62053B557D703A5646B5CB3FC6B239088
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Protocol\__init__.py
Size 1KB
SHA256 ab386ec979f0e5091c297b5de0c41e71b64393b85d7e4c53b188d7239879d4a8
MD5 424017d43f6423d6b4a01f008e20bf7d
SHA1 b8e1b0fb856d8799a43677f4f01e99850a66f281
SHA512 570b1f98041d1d093bcb639f9516aef7523f36d870c99c6690eb37d2110388079cd20ad36fcfe35b5f0771d1aa9e7a5b41c63eafdf206c7ecac7171ffc1c5558
TLSH
T10C31125702445BD36AF2574536D5FE84F08DA02D3F236C09187DA285577B32EE4B7421
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Random\__init__.py
Size 1KB
SHA256 28f3d1bda93153c01b49e06d292f681e538d729954582b88d628800a960eeaba
MD5 95ffc7b00e968213997b42038edb182b
SHA1 97ba733f38a08c1b303d0d2a5a7a0182f66ce00f
SHA512 841f0ffebb3fa1595b6c94ba78c80ad01202cf2b73fa932cdb4906904ecf11dd73b336e2a44dff3c78ab4a4e4d279ab19f7848c59f0d4b72eb8ba780ba9e0338
TLSH
T1A741B553F687E9A526B9405729D0F889E29DF1171E671914BC5CA01C0B32738F4F980D
MD5 SHA1 SHA512 TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\__init__.py
Size 1KB
SHA256 8c875b3fbd34cc64eb65016e7a598389a54cb8df2370b249b6201e40afc97b12
MD5 82fb50b6687eb4ab3560108a83601747
SHA1 1d2d6652426e585301abb906c280af6ad31fbf26
SHA512 8358f2ff25b1b2183e7c2504bdcea46ca18f1ec71e8a0fd6e036419dd8d7ab4851f6e3e4afcf05d184810c7b5df3b9bda1c4d2bf5fc9d559d16446dc2c07f40a
TLSH
T1DC4156E8724323D274AB91817CA7B44EE625D05669672E01312EE2840BFF37C52F6B59
MD5 SHA1 SHA512 TLSH

Submit Download

_bytes.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_bytes.py
Size 775B
SHA256 e834eb0834bcc3ce4729ba2163e13b1c3efa29b6b55b9b0e870faa293f7d202b
MD5 350dab8afad71c73b425cb9a6c295e5c
SHA1 a80217a3ab8502073fc4722840f6b3bb4ef09ced
SHA512 05472e41887cdd38391b7f07f00a1b33a4292191a8ef5ff6cfa9dd791d3021cca901b36aee064cd495b0c1fa89cf793654dc3cd0517d4652f8145bdac302c2c3
TLSH
T15F012006BE1BE24C8BFE0948D461C803F90EA1124321E8ED3CDD452E1B3048C8AFD04D
MD5 SHA1 SHA512 TLSH

Submit Download

_cpu_features.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_cpu_features.py
Size 2KB
SHA256 d82732265751f753a19dfa4dc48a312267e992110d39cce5be9adf828ba0fcd4
MD5 89b5d5eb4cd33b1d932d1d912b8b07e9
SHA1 93b5b1b71e7e57b1af9613d6b9fe102b293746c6
SHA512 9226714f0fbd223b33f3fe45a061dac75849d7cb9eaea1d493a839e9f0fa47a844c82ed83e82da74f2988119d289086fd152e292d83c1f46f21fdc0e4ee2ec55
TLSH
T1E141DBAFAC0BD24B8231C48FE719E816E7096B1376E42563FC8DD1686F3A525A1F118C
MD5 SHA1 SHA512 TLSH

Submit Download

_cpuid_c.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_cpuid_c.pyd
Size 10KB
SHA256 5ae5523787b53dcd4a5bcc63898d2cdb2254f1df1c5c473668487c8662eb1f00
MD5 8c8afda9a26a33aaf0fc2f18a665ac0e
SHA1 1895fc4966750741e196c5f6daec47f1fa4dd414
SHA512 f74397780d35264cbdfc4183067aaebf1bed453b45032d97ff9715c87a9b50ac3b806c0b7b0a8dc854cf8e1326f5a21a64847eea28214efb19b40e2cebac8387
SSDEEP 96:LvfqosF19Az5BFP1IQkANHoLzLnCgXJkMivBmpfEtMpUO7ai+uaHoyBp:cIF7P1IuYLnCgXJLi5ef/y3uaHn
TLSH
T16022F94CFFD58CD5E6218279C8A70E1CB1BDB6241BB233CB0371652E6CA77C9A17A544
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_file_system.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_file_system.py
Size 848B
SHA256 9153706d78c07b485b4b70334958dc3375bc1a1810d38cfa55d09210ca844b34
MD5 63b90fc774d773df00898aa0cf450e6d
SHA1 b918437c3c4e11eec8bb115a8efdf914eaa4c762
SHA512 39fccbf45bb3a40e9ae3d104b99d11bd9ddb1dc616eb4f801b544b3aa97a90fd666ede325857be60cd1bc5200c0ff087727effb0f3784e16bf541bdf3a1ace88
TLSH
T1B301CE42AC5F124343F1D01AFE14C86DD704966B96172D2C7CCC0025ABB2141D3EC04C
MD5 SHA1 SHA512 TLSH

Submit Download

_raw_api.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_raw_api.py
Size 18KB
SHA256 c18d684da98b19b12bf9ab997d54b190ab7dc73c9122e2bb07bd179812c0379d
MD5 5be8f734945366bcd06db690d4715afb
SHA1 72b8506cbdaf6a0b9f330bc57f859b34ec59c63f
SHA512 3f1c2805fdf58d279cc9f414354ef7ae8f992dcac04f4acb085cf8989dd9a5dd9856e81e5f706a8dd983fcca5c0918fbf291cce010d8d05515dda3dbf02da66e
SSDEEP 384:0rskrs9VqH8va2Ne7ttGQNqXD6ZLIYncpZ8MT1j8yQYiwVgw:0r6qHOaFGQNqXD6ZLXcfgyQYi+gw
TLSH
T18B82B4536E0BE6655372C80E8907D48EF709A10316A54916BAFCD0B83F37639D2F96DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

__init__.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\__init__.py
Size 2KB
SHA256 ffe5b22b4464d3e0603cab87b3bb79b3d6eded3bd73447853becf2562b3f4e91
MD5 462b54219be839fa6498aba7adaf7ff7
SHA1 82edaacb7fd199401f6a23bb6547f0c5dbe6f6ea
SHA512 b6da4a17bea12091e5af2ac357b258b166dc788a52fa7ed2886df8172df0f8410e8bd5d7d73be5243fab3990d724cea01097eaf5b1f3c5a916ca19543b650e6a
TLSH
T1714140ABDF5E0D77127E08B385048605D722D28F871A8B077D38984E2F3A051E6E25BE
MD5 SHA1 SHA512 TLSH

Submit Download

VCRUNTIME140.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\VCRUNTIME140.dll
Size 116KB
SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
MD5 be8dbe2dc77ebe7f88f910c61aec691a
SHA1 a19f08bb2b1c1de5bb61daf9f2304531321e0e40
SHA512 0da644472b374f1da449a06623983d0477405b5229e386accadb154b43b8b083ee89f07c3f04d2c0c7501ead99ad95aecaa5873ff34c5eeb833285b598d5a655
SSDEEP 1536:+qvQ1Dj2DkX7OcujarvmdlYNABCmgrP4ddbkZIecbWcFML/UXzlghzdMFw84hzk:+qvQ1D2CreiABCmgYecbWVLUD6h+b4ho
TLSH
T1C4C37C4673A402B7D52EC274C1E25A06EB71B5448770ABCF03B589AA0F53BE1AF3D359
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\VCRUNTIME140_1.dll
Size 48KB
SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
MD5 f8dfa78045620cf8a732e67d1b1eb53d
SHA1 ff9a604d8c99405bfdbbf4295825d3fcbc792704
SHA512 ba7f8b7ab0deb7a7113124c28092b543e216ca08d1cf158d9f40a326fb69f4a2511a41a59ea8482a10c9ec4ec8ac69b70dfe9ca65e525097d93b819d498da371
SSDEEP 768:wPIyGVrxmKqOnA4j3z6Su77A+i0QLxi9z9Rtii9zn+:fBr87uW1nA8QLx+zrti+zn+
TLSH
T194235B9097784446D96B99B0C0D6DE57BD3CFAA20B50928F0BA1D14C1E63BD0FB3D22E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_bz2.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_bz2.pyd
Size 83KB
SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
MD5 5bebc32957922fe20e927d5c4637f100
SHA1 a94ea93ee3c3d154f4f90b5c2fe072cc273376b3
SHA512 afbe80a73ee9bd63d9ffa4628273019400a75f75454667440f43beb253091584bf9128cbb78ae7b659ce67a5faefdba726edb37987a4fe92f082d009d523d5d6
SSDEEP 1536:i2sz7yc51BVo1QX/FPI11IK1cDm015ssO687sjkD1ISCV087Syyxt+:dsz2c5eQXB4am05spd7MkD1ISCVzL
TLSH
T1D8839E92E3956AF5F81F81BD56C1036AE771B954075083EFF348C25A2F02F816DAC36A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ctypes.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ctypes.pyd
Size 122KB
SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
MD5 fb454c5e74582a805bc5e9f3da8edc7b
SHA1 782c3fa39393112275120eaf62fc6579c36b5cf8
SHA512 727ada80098f07849102c76b484e9a61fb0f7da328c0276d82c6ee08213682c89deeb8459139a3fbd7f561bffaca91650a429e1b3a1ff8f341cebdf0bfa9b65d
SSDEEP 3072:CXw32spTVYgFoj6N2xE9sb7VFf/EkZBq5syCtYPU9pISLPTj:CgGEOgFoj68ksTf/ENs7
TLSH
T138C36C0B339400AAEBA34179C8B36E07D7F1B41B175183CF1294C69A2F637A76E6E315
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_hashlib.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_hashlib.pyd
Size 64KB
SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
MD5 da02cefd8151ecb83f697e3bd5280775
SHA1 1c5d0437eb7e87842fde55241a5f0ca7f0fc25e7
SHA512 a13bc5c481730f48808905f872d92cb8729cc52cfb4d5345153ce361e7d6586603a58b964a1ebfd77dd6222b074e5dcca176eaaefecc39f75496b1f8387a2283
SSDEEP 1536:JgHpgE4Z27b4ZWZnEmIAtISOIx7SyZUxN:i14ZeEmIAtISOIx7+
TLSH
T1D9538D09A69544E8C96781B8C8A35F57FAF2F1511B10A7DF0368C18D2F237C3A7BA752
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_lzma.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_lzma.pyd
Size 156KB
SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
MD5 195defe58a7549117e06a57029079702
SHA1 3795b02803ca37f399d8883d30c0aa38ad77b5f2
SHA512 c47a9b1066dd9744c51ed80215bd9645aab6cc9d6a3f9df99f618e3dd784f6c7ce6f53eabe222cf134ee649250834193d5973e6e88f8a93151886537c62e2e2b
SSDEEP 3072:Bsvkxuqgo7e2uONqG+hi+CSznfF9mNopXnmnu1ISZ1Vk:BnuFo7Jg1NYOp2uO
TLSH
T1ADF33992A394F0D5F6728C78D6624F17D7F6780A0320929A02CCD37D2B1FB759A2A317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_socket.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_socket.pyd
Size 81KB
SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
MD5 dd8ff2a3946b8e77264e3f0011d27704
SHA1 a2d84cfc4d6410b80eea4b25e8efc08498f78990
SHA512 958224a974a3449bcfb97faab70c0a5b594fa130adc0c83b4e15bdd7aab366b58d94a4a9016cb662329ea47558645acd0e0cc6df54f12a81ac13a6ec0c895cd8
SSDEEP 1536:ldcydNgIznrvGvLfo4o7zfqwXJ9/s+S+pzo08/n1IsJhv6cpISLwV97Sy7UxV:l6ydrr+DgxjqwXJ9/sT+pzoN1IwhScpf
TLSH
T15D835A11A69050FADB77C0B5C2675E22FBB0B5C01395938F1166C51E1F33782BEBAB92
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_sqlite3.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_sqlite3.pyd
Size 122KB
SHA256 ee0e9b0a0af6a98d5e8ad5b9878688d2089f35978756196222b9d45f49168a9d
MD5 c3a41d98c86cdf7101f8671d6cebefda
SHA1 a06fce1ac0aab9f2fe6047642c90b1dd210fe837
SHA512 c088372afcfe4d014821b728e106234e556e00e5a6605f616745b93f345f9da3d8b3f69af20e94dbadfd19d3aa9991eb3c7466db5648ea452356af462203706c
SSDEEP 3072:D2dTrLbXVx7Qt+HEG1CO4w5yWrrPrrrrrrbEOyfgD/pWwb8tISOQAZ:qNVxMt7ZC5zrWgbos8S
TLSH
T153C35B67235400AAE9B751B8C1630B17DBB5F422573083CF42A0C68A2F777C76E7AB65
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_ssl.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ssl.pyd
Size 174KB
SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
MD5 c87c5890039c3bdb55a8bc189256315f
SHA1 84ef3c2678314b7f31246471b3300da65cb7e9de
SHA512 e750dc36ae00249ed6da1c9d816f1bd7f8bc84ddea326c0cd0410dbcfb1a945aac8c130665bfacdccd1ee2b7ac097c6ff241bfc6cc39017c9d1cde205f460c44
SSDEEP 3072:AHtmUArl7bOGLbfbmeq2wfq6XDQJsY2GvMe1ba+VRJNI7IM/H9o/PCrXuI51ISCQ:Ym5lfOGLbjBOq6XD4MejTGl
TLSH
T102046D47B5842EBBD813E4BAC1230913DBF1F015331257DE48D6D6460F17B4AAEAAB63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

_wmi.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_wmi.pyd
Size 36KB
SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
MD5 8a9a59559c614fc2bcebb50073580c88
SHA1 4e4ced93f2cb5fe6a33c1484a705e10a31d88c4d
SHA512 9b17c81ff89a41307740371cb4c2f5b0cf662392296a7ab8e5a9eba75224b5d9c36a226dce92884591636c343b8238c19ef61c1fdf50cc5aa2da86b1959db413
SSDEEP 768:9mqQhTcYv/NxO01ISCiO5YiSyvoAMxkEzef:9m7GINxO01ISCik7SyOxvef
TLSH
T161F28E67E7940895E93BCAB9C8965E27E971B5825B11C3CF331882590F323C1AE7E371
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libcrypto-3.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libcrypto-3.dll
Size 5.0MB
SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
MD5 e547cf6d296a88f5b1c352c116df7c0c
SHA1 cafa14e0367f7c13ad140fd556f10f320a039783
SHA512 9f42edf04c7af350a00fa4fdf92b8e2e6f47ab9d2d41491985b20cd0adde4f694253399f6a88f4bdd765c4f49792f25fb01e84ec03fd5d0be8bb61773d77d74d
SSDEEP 98304:n3+pefu6fSar+SJ8aqfPomg1CPwDvt3uFlDCE:3G+u6fb+SJ8aqfwmg1CPwDvt3uFlDCE
TLSH
T1E6366A6AA7A80188E5BAC13CCA534617D6B1F816577097CF19A1967C0F33FDA2B3DB40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libffi-8.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libffi-8.dll
Size 38KB
SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
MD5 0f8e4992ca92baaf54cc0b43aaccce21
SHA1 c7300975df267b1d6adcbac0ac93fd7b1ab49bd2
SHA512 6e1b223462dc124279bfca74fd2c66fe18b368ffbca540c84e82e0f5bcbea0e10cc243975574fa95ace437b9d8b03a446ed5ee0c9b1b094147cefaf704dfe978
SSDEEP 768:NiQfxQemQJNrPN+moyijAc5YiSyvkIPxWEqG:dfxIQvPkmoyijP7SytPxF
TLSH
T10B037C0B458418A4E657D53D97A64A2AC335B9240B60F2CB03D4C2BA3F6B7D6FB7C358
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

libssl-3.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libssl-3.dll
Size 768KB
SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
MD5 19a2aba25456181d5fb572d88ac0e73e
SHA1 656ca8cdfc9c3a6379536e2027e93408851483db
SHA512 df17dc8a882363a6c5a1b78ba3cf448437d1118ccc4a6275cc7681551b13c1a4e0f94e30ffb94c3530b688b62bff1c03e57c2c185a7df2bf3e5737a06e114337
SSDEEP 12288:ytPc2nnGoNg4kSHoxX09yO5EavUFe9Xb12:y9jnnpTHoxXUsFe9XbM
TLSH
T1CBF44B9DB3B8059CE9F6D13D86934623E3B6F4152370EBDB065186790F23BD52A3A348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

loader.py

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\loader.py
Size 558B
SHA256 615fff797efa7048d4211649b750bdead96f39dd35cc9b75fe6351c368681332
MD5 b46597f976250ecab447867122bcc462
SHA1 b4daedd52049fc91628a0c158d80a16f77a2ff11
SHA512 257b101e44ccf40b3e2a42b9fa82e6b2e2261a55b683b8cbb135e3f17c59ec7cdf8ee6d5a1a30fba4bba0764ded35d70b5ce814da7f5b4f070e7ab2bb0c410fb
TLSH
T17EF0C95340C81EB39363C2B4C1A0C0A913C189ABDE1B923079CC87265F8A83949A4392
MD5 SHA1 SHA512 TLSH

Submit Download

python.exe

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
Size 101KB
SHA256 fd5c46d73d29ba21b04c844bbaf9096066136526911230645a2a040d23fb612b
MD5 67d2e7c2c9737e21717a4d2336493adc
SHA1 46c8683e323c49c7093c7394c992420d37376e6e
SHA512 36f7e98fcca905f8207d6165dec4e75f17afc139c29ed3c44d29726cb1978ac6451dd28ddc2d65a1333eb10856410c6b6ec7ae802f54d8fd54de79be31f20c4f
SSDEEP 1536:bj28KbuEYE+9z2wp+FavGmhMn+IhzZtzs/zZR/7Sy7Rqxa:bS8KbuAs0FNmhMn+IhNm/zZR/l
TLSH
T138A3E48A6A1E8590C5748471037B87F65B2C2F62A9C3C68D67C17F16EA7C2C1F909B73
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python3.DLL

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python3.DLL
Size 66KB
SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
MD5 a07661c5fad97379cf6d00332999d22c
SHA1 dca65816a049b3cce5c4354c3819fef54c6299b0
SHA512 6ddeb9d89ccb4d2ec5d994d85a55e5e2cc7af745056dae030ab8d72ee7830f672003f4675b6040f123fc64c19e9b48cabd0da78101774dafacf74a88fbd74b4d
SSDEEP 768:GV1EbYGVXq6KC/prVHBN0cW18itCQDFPnOMFn+gikF/nFX14uewjBcCCC0yamM/L:GDmF61JFn+/OxpISL0v7Syqx0
TLSH
T15A637012BB54F8A3DBFA69FC39D199CD542B12CC872584ECA57893D30E1A310A6E734D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312._pth

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312._pth
Size 82B
SHA256 c83ed2c063a83e0d18db045192731517042dc4d73064659af36692697fd60acc
MD5 fca38d61223c3573096f075b4b1cace9
SHA1 d0028f3838d40a797bf4fad79883c90265a052da
SHA512 8f980d6f00c79444e9b9d7df288ce9a55c16e419086b697973b12da9b42faf10992671af8ec963476e2b9113856e3610f599b39d26ff9ea9b8887c39ea65c597
TLSH
T10BA022020AA300A00230B0E83FC020F88F323388AB00220C88C02E3A0200E30AAE322F
MD5 SHA1 SHA512 TLSH

Submit Download

python312.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312.dll
Size 6.6MB
SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
MD5 d521654d889666a0bc753320f071ef60
SHA1 5fd9b90c5d0527e53c199f94bad540c1e0985db6
SHA512 7a726835423a36de80fb29ef65dfe7150bd1567cac6f3569e24d9fe091496c807556d0150456429a3d1a6fd2ed0b8ae3128ea3b8674c97f42ce7c897719d2cd3
SSDEEP 49152:PPknDqOJlpxSupRo2vXDZ2lgghXQIX2CG4Ts99kdwQAvyodh1GCOepxk1NHh8yfE:kdlpx9p5Loehv6JfDvXHDMiETH+0Tn
TLSH
T1A6666B5A7258C0A9C967A0B48C13C29FE7B27C117F50830B31EBB75E2FB3792925A745
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

python312.zip

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312.zip
Size 3.7MB
SHA256 2331635c9f558b4ee3f87118c89e2f96aa68137e288645137a39dce9d13a9e64
MD5 bbe638683b65d68e643f130eefdd78fd
SHA1 d19238067645b81c78a583afbcb3c68807a40cd7
SHA512 abdfb8a72a372045fd37fd0d1f7bcbee931ffd3a10722ac4cd285d950f4a01b5abe4aa7e730c7d2a8035425099292b88e1b6b8e07b1ef3591b0e96b5c19d3ddc
SSDEEP 49152:eRhSwKQl/6IUfEN7g+nN3AMlsQRI1PYi/EY/0eH0gjGihXoUeBzAFbTwCqZry36q:tw3hIsbACsL1ZLHhYEFF54Q
TLSH
T196063339D97D618BFE93313D3252CC6B960C8B917580B04F3C9514D9ACA62F6AB0A53F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

select.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\select.pyd
Size 30KB
SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
MD5 d0cc9fc9a0650ba00bd206720223493b
SHA1 295bc204e489572b74cc11801ed8590f808e1618
SHA512 d3ebcb91d1b8aa247d50c2c4b2ba1bf3102317c593cbf6c63883e8bf9d6e50c0a40f149654797abc5b4f17aee282ddd972a8cd9189bfcd5b9cec5ab9c341e20b
SSDEEP 384:2RVBC9t6Lhz64wHqFslDT90YpISQGrHQIYiSy1pCQ+42AM+o/8E9VF0Nyes:YGyIHqG1HpISQG75YiSyvB2AMxkEp
TLSH
T10DD28F476B60688AD923C97268A64E27DD35B752871182CF3358C15D1F227C27BBB3A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sqlite3.dll

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\sqlite3.dll
Size 1.5MB
SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
MD5 e52f6b9bd5455d6f4874f12065a7bc39
SHA1 8a3cb731e9c57fd8066d6dad6b846a5f857d93c8
SHA512 764bfb9ead13361be7583448b78f239964532fd589e8a2ad83857192bf500f507260b049e1eb7522dedadc81ac3dfc76a90ddeb0440557844abed6206022da96
SSDEEP 24576:HU/QhAI889YyuQYZlm/8AgzMkf6G5MJ8NW/yKhh+ivz/LZ/Xm+5D3ovTKJz:AVyuQYZlm/8vP6G5MJ8NuF+IzDZ/XPoA
TLSH
T186658C4BF2B801ADC0A7C179C91B170BEBB2B405177497DF5594CA692F23EE217BA324
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

stealer.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\stealer.pyd
Size 2.1MB
SHA256 6bef692ae87b97e3c22729c84ce9884d39c60140689d6d2bee8d2509ce640db5
MD5 7d87b72b31680ace77d4f4cedaaa3ba8
SHA1 b606a10e19641bd9f85fa572402631395fabc5f7
SHA512 c844759a96ef19a72dba6544a87161291f15d3da128b307ee4e76c2ad1eb75cff0a0953d08ebf90146101e08e3acff6ac39127fcaef88895c33eb383f8c519f5
SSDEEP 49152:GKqGlnRLf5CKLixbKYFoz/Z/DGteXcQyFLuHiM0WQqcs4Ee+kGqxRwn0TT6ZMUzB:GhKWCZ/DGteXcQytM0S4EeVxC0vvnsL/
TLSH
T16FA51A53E17230EBC67BC0B45F6BA4737978F82C81307EF695D489322761D62AA6CB14
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

unicodedata.pyd

Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\unicodedata.pyd
Size 1.1MB
SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
MD5 cc8142bedafdfaa50b26c6d07755c7a6
SHA1 0fcab5816eaf7b138f22c29c6d5b5f59551b39fe
SHA512 c3b0c1dbe5bf159ab7706f314a75a856a08ebb889f53fe22ab3ec92b35b5e211edab3934df3da64ebea76f38eb9bfc9504db8d7546a36bc3cabe40c5599a9cbd
SSDEEP 12288:LrEHdcM6hbqCjJ43w9hIpCQvb0QN8MdIEQ+U2BNNmD+99FfcAjL:LrEXPCjfk7bPNfv42BN6yzUAjL
TLSH
T1D3355AC5BB828E66E87B31B944D1212F1361C273476B533BB25513294C8B3B74EE69EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1264-559-0x00007FF613D90000-0x00007FF6144F7000-memory.dmp

Download

memory/1788-503-0x000001E4E8950000-0x000001E4E895A000-memory.dmp

Download

memory/1788-494-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-513-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-506-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-505-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-504-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-511-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-502-0x000001E4E8890000-0x000001E4E8942000-memory.dmp

Download

memory/1788-501-0x000001E4E8860000-0x000001E4E887E000-memory.dmp

Download

memory/1788-507-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-493-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-492-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-491-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-489-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-488-0x000001E4D0380000-0x000001E4D03A2000-memory.dmp

Download

memory/1788-482-0x00007FFF0F94F000-0x00007FFF0F950000-memory.dmp

Download

memory/1788-508-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-510-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/1788-509-0x00007FFF0F7C0000-0x00007FFF10164000-memory.dmp

Download

memory/2732-0-0x00007FF7E7D80000-0x00007FF7E7E0F000-memory.dmp

Download

memory/2732-10-0x00007FF7E7D80000-0x00007FF7E7E0F000-memory.dmp

Download

memory/2732-751-0x00007FF7E7D80000-0x00007FF7E7E0F000-memory.dmp

Download

memory/2896-709-0x00000189DA2F0000-0x00000189DA3A2000-memory.dmp

Download

memory/4392-560-0x00007FF679370000-0x00007FF679AD7000-memory.dmp

Download

memory/4444-554-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp

Download

memory/4444-561-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp

Download

memory/4444-527-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp

Download

memory/4444-750-0x00007FFF10670000-0x00007FFF1089E000-memory.dmp

Download

memory/4860-581-0x00000184E3FE0000-0x00000184E3FFE000-memory.dmp

Download

memory/4860-580-0x00000184E4250000-0x00000184E4302000-memory.dmp

Download

memory/5200-740-0x00007FF7F62F0000-0x00007FF7F8DC6000-memory.dmp

Download

memory/5200-695-0x00007FF7F62F0000-0x00007FF7F8DC6000-memory.dmp

Download

memory/5764-745-0x0000000061A60000-0x00000000620D6000-memory.dmp

Download

memory/5764-749-0x0000000061A60000-0x00000000620D6000-memory.dmp

Download

memory/5764-753-0x0000000061A60000-0x00000000620D6000-memory.dmp

Download

memory/5764-755-0x0000000061A60000-0x00000000620D6000-memory.dmp

Download

memory/5764-757-0x0000000061A60000-0x00000000620D6000-memory.dmp

Download

memory/5764-761-0x0000000061A60000-0x00000000620D6000-memory.dmp

Download