Overview

overview

10

Static

static

3

2026-11-05...ke.exe

windows10-2004-x64

9

2026-11-05...ke.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    06/11/2026, 12:48

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-05_ad264ad8800f0f8cfea54bbaa1259825_akira_cobalt-strike.exe
  • Size 1.5MB
  • Sample261106-p1x7csxt7n
  • SHA256 0c2839e35d796379ff19a56c7383a60a3768e750e33bac052d017ae827433586
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
defense_evasiondiscoveryexecutionoverlordxmrigminerpersistenceprivilege_escalationratspywarestealertrojan

Malware Config

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Extracted

Family

  • overlord

C2

  • 734r7hw4s32wehashwdz273dn323eeasd.antimalwarediagnostics.st

Signatures

  • Family: Overlord

    Overlord is an open-source Windows RAT written in Golang.

    ratoverlord
  • Family: xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Detects Overlord RAT 1 IoCs
  • Windows security bypass 2 TTPs 2 IoCs
    defense_evasiontrojan
  • XMRig Miner payload 4 IoCs
    miner
  • Custom signature
    Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 4 IoCs
  • Custom signature
    Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 1 IoCs
  • Custom signature
    Detects executables containing SQL queries to confidential data stores. Observed in infostealers 4 IoCs
  • Custom signature
    Detects executables containing URLs to raw contents of a Github gist 4 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 25 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Modifies Windows Firewall 2 TTPs 20 IoCs
    defense_evasion
  • Executes a file named after a Windows system binary 1 TTPs 1 IoCs

    The file runs from a user directory while carrying the name of an executable that normally only exists in System32.

    defense_evasion
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 36 IoCs
  • Reads WinSCP keys stored on the system 2 TTPs

    Tries to access WinSCP stored sessions.

    spywarestealer
  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 60 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    defense_evasion
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 43 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 40 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-05_ad264ad8800f0f8cfea54bbaa1259825_akira_cobalt-strike.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-05_ad264ad8800f0f8cfea54bbaa1259825_akira_cobalt-strike.exe"
    1⤵
    • Reads the TCP/IP host and domain name from the registry
    • Suspicious use of WriteProcessMemory
    PID:3688
    • C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
      "C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe" C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\loader.py
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Reads the TCP/IP host and domain name from the registry
      PID:1964
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'powershell.exe' -ErrorAction SilentlyContinue"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1808
      • C:\Program Files\Google\Chrome\Application\chrome.exe
        "C:\Program Files\Google\Chrome\Application\chrome.exe"
        3⤵
          PID:3740
        • C:\Windows\SYSTEM32\taskkill.exe
          taskkill /F /IM Telegram.exe
          3⤵
          • Kills process with taskkill
          • Suspicious use of AdjustPrivilegeToken
          PID:5568
        • C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
          C:\Users\Admin\AppData\Local\Temp\AntiMalwareServiceExecutable.exe
          3⤵
          • Checks processor information in registry
          PID:2032
        • C:\Users\Admin\AppData\Local\Temp\svhost.exe
          C:\Users\Admin\AppData\Local\Temp\svhost.exe
          3⤵
          • Checks processor information in registry
          • Suspicious use of WriteProcessMemory
          PID:1372
          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
            powershell.exe -NoProfile -NonInteractive -WindowStyle Hidden -Command "$a = New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Microsoft\DeviceSync\svhost.exe.exe'; $t = New-ScheduledTaskTrigger -AtLogOn; $s = New-ScheduledTaskSettingsSet -ExecutionTimeLimit ([TimeSpan]::Zero) -StartWhenAvailable; $p = New-ScheduledTaskPrincipal -UserId $env:USERNAME -RunLevel Highest; Register-ScheduledTask -TaskName 'svhost.exe_139cb51b' -Action $a -Trigger $t -Settings $s -Principal $p -Force | Out-Null"
            4⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4728
        • C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
          C:\Users\Admin\AppData\Local\Temp\SecurityHealthService.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:5616
          • C:\Windows\system32\schtasks.exe
            "schtasks" /Delete /TN MicrosoftEdgeUpdateTaskMachine /F
            4⤵
              PID:6140
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'SecurityHealthService.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5748
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:1380
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:4588
            • C:\Windows\system32\schtasks.exe
              "schtasks" /Create /TN MicrosoftEdgeUpdateTaskMachineCore /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
              4⤵
              • Scheduled Task/Job: Scheduled Task
              PID:4996
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3204
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'wildrig.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3448
            • C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
              "C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe"
              4⤵
              • Executes dropped EXE
              PID:3012
          • C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
            C:\Users\Admin\AppData\Local\Temp\WindowsSecurityService.exe
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1888
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:5788
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3240
            • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
              "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
              4⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              PID:3844
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall set allprofiles state off
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:980
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall set allprofiles settings notifyonlisten disable
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:2076
            • C:\Windows\system32\reg.exe
              "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
              4⤵
              • Windows security bypass
              PID:5292
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:5612
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1764
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:1420
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3236
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:3412
            • C:\Windows\system32\netsh.exe
              "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
              4⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:5020
              • C:\Windows\System32\Conhost.exe
                \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                5⤵
                  PID:1380
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:200
              • C:\Windows\system32\netsh.exe
                "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                4⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:5788
              • C:\Windows\system32\schtasks.exe
                "schtasks" /Create /TN MicrosoftSecurityHealthService /XML C:\Users\Admin\AppData\Local\Temp\task.xml /F
                4⤵
                • Scheduled Task/Job: Scheduled Task
                PID:3248
              • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                "C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe"
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Reads the TCP/IP host and domain name from the registry
                • Suspicious use of WriteProcessMemory
                PID:5600
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\Microsoft' -ErrorAction SilentlyContinue"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4892
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'WindowsSecurityService.exe' -ErrorAction SilentlyContinue"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:4840
                • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                  "powershell" -WindowStyle Hidden -Command "Add-MpPreference -ExclusionProcess 'pawns-sdk.dll' -ErrorAction SilentlyContinue"
                  5⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  PID:5224
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall set allprofiles state off
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4088
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall set allprofiles settings notifyonlisten disable
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:3476
                • C:\Windows\system32\reg.exe
                  "reg" add "HKLM\SOFTWARE\Microsoft\Security Center" /v FirewallDisableNotify /t REG_DWORD /d 1 /f
                  5⤵
                  • Windows security bypass
                  PID:4276
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_In
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4612
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Exe_Out
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4104
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_In
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:1776
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall delete rule name=PawnsSDK_Dll_Out
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:1536
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:5248
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Exe_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe enable=yes profile=any
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:1188
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_In dir=in action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4344
                • C:\Windows\system32\netsh.exe
                  "netsh" advfirewall firewall add rule name=PawnsSDK_Dll_Out dir=out action=allow program=C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll enable=yes profile=any
                  5⤵
                  • Modifies Windows Firewall
                  • Event Triggered Execution: Netsh Helper DLL
                  PID:4732
        • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
          "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
          1⤵
            PID:2188
          • C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
            "C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe"
            1⤵
              PID:4940
            • C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
              1⤵
              • Executes dropped EXE
              PID:3292
            • C:\Windows\System32\ShellHost.exe
              "C:\Windows\System32\ShellHost.exe"
              1⤵
              • Suspicious use of SetWindowsHookEx
              PID:5028
            • C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
              C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
              1⤵
              • Executes a file named after a Windows system binary
              • Executes dropped EXE
              PID:4928
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k GPSvcGroup
              1⤵
                PID:2072
              • C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                1⤵
                • Executes dropped EXE
                PID:3240

              Network

                    MITRE ATT&CK Enterprise v16

                    Reconnaissance

                    Resource Development

                    Initial Access

                    Execution

                    Command and Scripting Interpreter

                    1
                    T1059

                    PowerShell

                    1
                    T1059.001

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Persistence

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Privilege Escalation

                    Create or Modify System Process

                    1
                    T1543

                    Windows Service

                    1
                    T1543.003

                    Event Triggered Execution

                    1
                    T1546

                    Netsh Helper DLL

                    1
                    T1546.007

                    Scheduled Task/Job

                    1
                    T1053

                    Scheduled Task

                    1
                    T1053.005

                    Defense Evasion

                    Impair Defenses

                    2
                    T1562

                    Disable or Modify System Firewall

                    1
                    T1562.004

                    Disable or Modify Tools

                    1
                    T1562.001

                    Masquerading

                    1
                    T1036

                    Match Legitimate Name or Location

                    1
                    T1036.005

                    Modify Registry

                    1
                    T1112

                    Credential Access

                    Unsecured Credentials

                    1
                    T1552

                    Credentials in Registry

                    1
                    T1552.002

                    Discovery

                    Query Registry

                    2
                    T1012

                    System Information Discovery

                    1
                    T1082

                    System Network Configuration Discovery

                    1
                    T1016

                    Lateral Movement

                    Collection

                    Data from Local System

                    1
                    T1005

                    Command and Control

                    Exfiltration

                    Impact

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 d28ef187840dcd1fe0a8a757ef9cd326023bec38b39ef1338f91d508d55dcf28
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 287307bc450d600c2d2233396ad78e35ee001205892e0d2fc4efa4360072a1f1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 24d8ae5f4116797c59fc197d8cbb19fcbb8728a987496abd69750cc5714a3b51
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 01a79adb8097faeac715e1700793ed2b1fef62308a4f5304b7d160e0540eadc1
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 a3207c3ee42894b8aa1adf9f4f5bb0f2aa99adc02097c3162cf1b2b2c1936d05
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 f7680072ca5221cf2d0f5ef9769a208e6ade25923ae1978cfe80fbdc4748dc3a
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 7b1b8531c3ecda17e384155d74dbdad5372357052a9ebf3533d8e2108e27ed8b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 dc4ebf4baa7b27ac79e1e8787c84c5adaaaad1ec2f83eaf97b5e28040afcf03b
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 6ad9771b926d9c16b8743ffa0fc4755fca30a058fe8c865c911d6e57edfa7294
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    StartupProfileData-NonInteractive
                    • Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                    • Size 1KB
                    • SHA256 cf945b43222be12fe29077d14d2ce5a41c5f926508e7f4beb813741bd761cdb8
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    __PSScriptPolicyTest_1btylwti.lbh.psm1
                    • Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_1btylwti.lbh.psm1
                    • Size 60B
                    • SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    task.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\task.xml
                    • Size 1KB
                    • SHA256 866c309e3f0fd83e2302fc260f299f828ab434db274e8aa17071fdfcbc9ee148
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    task.xml
                    • Path C:\Users\Admin\AppData\Local\Temp\task.xml
                    • Size 1KB
                    • SHA256 d38843aa9ff9ba500efa707cc46d3bedf33dab3f453cbcb43165f853a9159bf5
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    AntiMalwareServiceExecutable.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\AntiMalwareServiceExecutable.exe
                    • Size 7.4MB
                    • SHA256 b4359324e3cffb3dc521a808dfa0b5d7bd92dc6e08eb7527da41e1e1312d3265
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    SecurityHealthService.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SecurityHealthService.exe
                    • Size 2.1MB
                    • SHA256 43df0e02e06854ecb4470f92f67c9599bfa3c249fc6470f52289d7f9c6354e7d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _raw_aes.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\_raw_aes.pyd
                    • Size 29KB
                    • SHA256 2e8b4a482bace75664f01a2c41ab698c88c623d92ea6f1151bd84568dfdba92e
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _raw_aesni.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\_raw_aesni.pyd
                    • Size 15KB
                    • SHA256 a9a3f72954948f56b4ba627e1e47c8ddca5ca0a24670737eceb45ca2788eb621
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _raw_des3.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Cipher\_raw_des3.pyd
                    • Size 12KB
                    • SHA256 6fa4fa76c619e0c10f84e0c8104ab13f4f9c6f7149d23f9240a088e57e33597d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _SHA1.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Hash\_SHA1.pyd
                    • Size 16KB
                    • SHA256 fa1a99dd7dd8b0a21ceb5d2364c7b7e6e4ee07bac4c7da9f1a73bb8f26f076be
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _SHA256.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Hash\_SHA256.pyd
                    • Size 23KB
                    • SHA256 a8dc548fbe8f2cdd0ae65c1ee68ed8819fa803bb31fb993f4d9e0711caefd6a1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _scrypt.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Protocol\_scrypt.pyd
                    • Size 13KB
                    • SHA256 1ec656d41e41b90a06d5c82e32953d18e9aaba3531a326e0caff46b76f76fc08
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _cpuid_c.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_cpuid_c.pyd
                    • Size 10KB
                    • SHA256 5ae5523787b53dcd4a5bcc63898d2cdb2254f1df1c5c473668487c8662eb1f00
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _strxor.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\Crypto\Util\_strxor.pyd
                    • Size 10KB
                    • SHA256 acab35fa1a42cac4590cffa758ad05af9cf8b5c158f53a58f8377884ad8236e8
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _bz2.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_bz2.pyd
                    • Size 83KB
                    • SHA256 3ed0e5058d370fb14aa5469d81f96c5685559c054917c7280dd4125f21d25f62
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ctypes.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ctypes.pyd
                    • Size 122KB
                    • SHA256 74e0e8384f6c2503215f4cf64c92efe7257f1aec44f72d67ad37dc8ba2530bc1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _elementtree.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_elementtree.pyd
                    • Size 130KB
                    • SHA256 4869325e5cffbd13d3cc02dc78226478adfb51a802b52ff65b5adfacff3511f1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _hashlib.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_hashlib.pyd
                    • Size 64KB
                    • SHA256 fd77a5756a17ec0788989f73222b0e7334dd4494b8c8647b43fe554cf3cfb354
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _lzma.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_lzma.pyd
                    • Size 156KB
                    • SHA256 7bf9ff61babebd90c499a8ed9b62141f947f90d87e0bbd41a12e99d20e06954a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _queue.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_queue.pyd
                    • Size 31KB
                    • SHA256 dbdabb5fe0ccbc8b951a2c6ec033551836b072cab756aaa56b6f22730080d173
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _socket.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_socket.pyd
                    • Size 81KB
                    • SHA256 b102522c23dac2332511eb3502466caf842d6bcd092fbc276b7b55e9cc01b085
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _sqlite3.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_sqlite3.pyd
                    • Size 122KB
                    • SHA256 ee0e9b0a0af6a98d5e8ad5b9878688d2089f35978756196222b9d45f49168a9d
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _ssl.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_ssl.pyd
                    • Size 174KB
                    • SHA256 a5d361707f7a2a2d726b20770e8a6fc25d753be30bcbcbbb683ffee7959557c2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _wmi.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\_wmi.pyd
                    • Size 36KB
                    • SHA256 752fb80edb51f45d3cc1c046f3b007802432b91aef400c985640d6b276a67c12
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    cd.cp312-win_amd64.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\charset_normalizer\cd.cp312-win_amd64.pyd
                    • Size 113KB
                    • SHA256 2bdbc0805f85565d76f8d6166e451bfafa6d5490b06b36c9f423cd0102b4f149
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    md.cp312-win_amd64.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\charset_normalizer\md.cp312-win_amd64.pyd
                    • Size 203KB
                    • SHA256 b08be5d29125f39a92e22d0abe4b9160753f7a790fffd07258319a8e16394afa
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libcrypto-3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libcrypto-3.dll
                    • Size 5.0MB
                    • SHA256 05fe080eab7fc535c51e10c1bd76a2f3e6217f9c91a25034774588881c3f99de
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libffi-8.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libffi-8.dll
                    • Size 38KB
                    • SHA256 eff52743773eb550fcc6ce3efc37c85724502233b6b002a35496d828bd7b280a
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    libssl-3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\libssl-3.dll
                    • Size 768KB
                    • SHA256 2e9fbcd8f7fdc13a5179533239811456554f2b3aa2fb10e1b17be0df81c79006
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    _psutil_windows.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\psutil\_psutil_windows.pyd
                    • Size 69KB
                    • SHA256 0035450801bd7d938e9e146c5ec28e619cb5a5f4a18cdc53ac7e9734c7f94f78
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    pyexpat.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\pyexpat.pyd
                    • Size 197KB
                    • SHA256 efd6099b1a6efdadd988d08dce0d8a34bd838106238250bccd201dc7dcd9387f
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python.exe
                    • Size 101KB
                    • SHA256 fd5c46d73d29ba21b04c844bbaf9096066136526911230645a2a040d23fb612b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python3.dll
                    • Size 66KB
                    • SHA256 5146005c36455e7ede4b8ecc0dc6f6fa8ea6b4a99fedbabc1994ae27dfab9d1b
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    python312.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\python312.dll
                    • Size 6.6MB
                    • SHA256 21700f0bad5769a1b61ea408dc0a140ffd0a356a774c6eb0cc70e574b929d2e2
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    select.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\select.pyd
                    • Size 30KB
                    • SHA256 411d6f538bdbaf60f1a1798fa8aa7ed3a4e8fcc99c9f9f10d21270d2f3742019
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    sqlite3.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\sqlite3.dll
                    • Size 1.5MB
                    • SHA256 7ef475d27f9634f6a75e88959e003318d7eb214333d25bdf9be1270fa0308c82
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    stealer.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\stealer.pyd
                    • Size 2.1MB
                    • SHA256 6bef692ae87b97e3c22729c84ce9884d39c60140689d6d2bee8d2509ce640db5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    unicodedata.pyd
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\unicodedata.pyd
                    • Size 1.1MB
                    • SHA256 bc2cf23b7b7491edcf03103b78dbaf42afd84a60ea71e764af9a1ddd0fe84268
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vcruntime140.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\vcruntime140.dll
                    • Size 116KB
                    • SHA256 4d292623516f65c80482081e62d5dadb759dc16e851de5db24c3cbb57b87db83
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    vcruntime140_1.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\SystemCache\vcruntime140_1.dll
                    • Size 48KB
                    • SHA256 a113f192195f245f17389e6ecbed8005990bcb2476ddad33f7c4c6c86327afe5
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    WindowsSecurityService.exe
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\WindowsSecurityService.exe
                    • Size 1.8MB
                    • SHA256 193e32e8970955c87b3b9da9dc2fd46005662ea78739023dae7dca73b771e232
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    config_cache.json
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\config_cache.json
                    • Size 556B
                    • SHA256 1839144a579b963cd46bb53938b93e234e01dbf20413fe3a5d4b3125397325a4
                    • MD5 SHA1 SHA512 TLSH
                    Submit Download

                    pawns-sdk.dll
                    • Path C:\Users\Admin\AppData\Roaming\Microsoft\pawns-sdk.dll
                    • Size 6.1MB
                    • SHA256 33d53ee8eb4955ac7aa80f2a3fc0ae97ebaf6f418a8a09ae8d569ae5596bc5f1
                    • MD5 SHA1 SHA512 SSDEEP TLSH
                    Submit Download

                    memory/1372-577-0x00007FF708C50000-0x00007FF70B726000-memory.dmp
                    Download

                    memory/1808-466-0x0000019F75E10000-0x0000019F75E32000-memory.dmp
                    Download

                    memory/1808-478-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-479-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-460-0x00007FFB1690F000-0x00007FFB16910000-memory.dmp
                    Download

                    memory/1808-461-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-476-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-464-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-475-0x0000019F76290000-0x0000019F7629A000-memory.dmp
                    Download

                    memory/1808-473-0x0000019F760B0000-0x0000019F760CE000-memory.dmp
                    Download

                    memory/1808-474-0x0000019F760D0000-0x0000019F76182000-memory.dmp
                    Download

                    memory/1808-470-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-469-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-465-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-467-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1808-468-0x00007FFB16780000-0x00007FFB17124000-memory.dmp
                    Download

                    memory/1964-498-0x00007FFB18010000-0x00007FFB1823E000-memory.dmp
                    Download

                    memory/1964-481-0x00007FFB18010000-0x00007FFB1823E000-memory.dmp
                    Download

                    memory/1964-619-0x00007FFB18010000-0x00007FFB1823E000-memory.dmp
                    Download

                    memory/1964-506-0x00007FFB18010000-0x00007FFB1823E000-memory.dmp
                    Download

                    memory/2032-505-0x00007FF7ADC40000-0x00007FF7AE3A7000-memory.dmp
                    Download

                    memory/3204-567-0x000002B44AFE0000-0x000002B44B092000-memory.dmp
                    Download

                    memory/3292-504-0x00007FF7BC9C0000-0x00007FF7BD127000-memory.dmp
                    Download

                    memory/3448-574-0x000001F0BA300000-0x000001F0BA3B2000-memory.dmp
                    Download

                    memory/3688-38-0x00007FF7AF330000-0x00007FF7AF430000-memory.dmp
                    Download

                    memory/3688-0-0x00007FF7AF330000-0x00007FF7AF430000-memory.dmp
                    Download

                    memory/3688-621-0x00007FF7AF330000-0x00007FF7AF430000-memory.dmp
                    Download

                    memory/3844-558-0x0000021039960000-0x0000021039A12000-memory.dmp
                    Download

                    memory/4728-516-0x0000017F2FAF0000-0x0000017F2FB0E000-memory.dmp
                    Download

                    memory/4892-587-0x000001E3F3D70000-0x000001E3F3E22000-memory.dmp
                    Download

                    memory/5600-612-0x0000000068490000-0x0000000068B06000-memory.dmp
                    Download

                    memory/5600-617-0x0000000068490000-0x0000000068B06000-memory.dmp
                    Download

                    memory/5600-623-0x0000000068490000-0x0000000068B06000-memory.dmp
                    Download

                    memory/5600-625-0x0000000068490000-0x0000000068B06000-memory.dmp
                    Download

                    memory/5600-627-0x0000000068490000-0x0000000068B06000-memory.dmp
                    Download

                    memory/5600-630-0x0000000068490000-0x0000000068B06000-memory.dmp
                    Download

                    memory/5600-634-0x0000000068490000-0x0000000068B06000-memory.dmp
                    Download