umbral | 712a0d5ea39f3325f80d76423fa07d8796bf0b75d35d69e8b32714d8836dfd50

Analysis

max time kernel
300s
max time network
298s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
22-09-2024 10:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

SynsWaveV1.exe
Size

358KB
MD5

fe2e1aa24f67aef8cca2a83269e49eb8
SHA1

22eff1e84d25f5daf052a046c4c6a66c37f63cc4
SHA256

712a0d5ea39f3325f80d76423fa07d8796bf0b75d35d69e8b32714d8836dfd50
SHA512

97a7dc677ee2c8ca61729b2ec0532a2d59fb705d413c76f2f5b197053d15cd462a560038e49a75c4b76b3c9255a48690a97dfd7d89d81692c37a7547c6bad837
SSDEEP

6144:o5aLkSNxlSl2ZvRbTs6iG0GkBnTYQSeMMHg/dRS4Y83PUf0KrZUNsC:AfG+2ZRQ7GdynTYQSMAV44YGPNKraS

Score

10^/10

umbral xworm execution persistence rat stealer trojan

Malware Config

Extracted

Family

umbral

https://discord.com/api/webhooks/1287356979475386418/SjsKMoKntf-tJwWJfIOoeVJTxW-pZZsUeBXbJHYWlQ4Unqm9uEyyu-DxEGFodPCSL8F6

Extracted

Family

xworm

expected-schema.gl.at.ply.gg:2980

Attributes

Install_directory
%Userprofile%
install_file
USB.exe

Signatures

Detect Umbral payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001ab74-5.dat	family_umbral
behavioral2/memory/1452-14-0x00000202DBAB0000-0x00000202DBAF0000-memory.dmp	family_umbral

Detect Xworm Payload 2 IoCs

resource	yara_rule
behavioral2/files/0x000900000001ac3e-13.dat	family_xworm
behavioral2/memory/2364-18-0x0000000000040000-0x000000000005E000-memory.dmp	family_xworm

Umbral
Umbral stealer is an opensource moduler stealer written in C#.
stealer umbral
Xworm
Xworm is a remote access trojan written in C#.
trojan rat xworm

Command and Scripting Interpreter: PowerShell 1 TTPs 4 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1824	powershell.exe
2116	powershell.exe
4564	powershell.exe
2016	powershell.exe

Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	RuntimeBroker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk	RuntimeBroker.exe

Executes dropped EXE 8 IoCs

pid	Process
1452	MISHA_litvin.exe
2364	RuntimeBroker.exe
4148	SynsWave.exe
4668	RuntimeBroker
348	RuntimeBroker
2572	RuntimeBroker
1344	RuntimeBroker
664	RuntimeBroker

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "C:\\Users\\Admin\\RuntimeBroker"	RuntimeBroker.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
21	raw.githubusercontent.com
22	raw.githubusercontent.com

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	ip-api.com

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3088	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1824	powershell.exe
1824	powershell.exe
1824	powershell.exe
2116	powershell.exe
2116	powershell.exe
2116	powershell.exe
4564	powershell.exe
4564	powershell.exe
4564	powershell.exe
2016	powershell.exe
2016	powershell.exe
2016	powershell.exe
2364	RuntimeBroker.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
4148	SynsWave.exe
4148	SynsWave.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2468	taskmgr.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	RuntimeBroker.exe
Token: SeDebugPrivilege	1452	MISHA_litvin.exe
Token: SeIncreaseQuotaPrivilege	2136	wmic.exe
Token: SeSecurityPrivilege	2136	wmic.exe
Token: SeTakeOwnershipPrivilege	2136	wmic.exe
Token: SeLoadDriverPrivilege	2136	wmic.exe
Token: SeSystemProfilePrivilege	2136	wmic.exe
Token: SeSystemtimePrivilege	2136	wmic.exe
Token: SeProfSingleProcessPrivilege	2136	wmic.exe
Token: SeIncBasePriorityPrivilege	2136	wmic.exe
Token: SeCreatePagefilePrivilege	2136	wmic.exe
Token: SeBackupPrivilege	2136	wmic.exe
Token: SeRestorePrivilege	2136	wmic.exe
Token: SeShutdownPrivilege	2136	wmic.exe
Token: SeDebugPrivilege	2136	wmic.exe
Token: SeSystemEnvironmentPrivilege	2136	wmic.exe
Token: SeRemoteShutdownPrivilege	2136	wmic.exe
Token: SeUndockPrivilege	2136	wmic.exe
Token: SeManageVolumePrivilege	2136	wmic.exe
Token: 33	2136	wmic.exe
Token: 34	2136	wmic.exe
Token: 35	2136	wmic.exe
Token: 36	2136	wmic.exe
Token: SeIncreaseQuotaPrivilege	2136	wmic.exe
Token: SeSecurityPrivilege	2136	wmic.exe
Token: SeTakeOwnershipPrivilege	2136	wmic.exe
Token: SeLoadDriverPrivilege	2136	wmic.exe
Token: SeSystemProfilePrivilege	2136	wmic.exe
Token: SeSystemtimePrivilege	2136	wmic.exe
Token: SeProfSingleProcessPrivilege	2136	wmic.exe
Token: SeIncBasePriorityPrivilege	2136	wmic.exe
Token: SeCreatePagefilePrivilege	2136	wmic.exe
Token: SeBackupPrivilege	2136	wmic.exe
Token: SeRestorePrivilege	2136	wmic.exe
Token: SeShutdownPrivilege	2136	wmic.exe
Token: SeDebugPrivilege	2136	wmic.exe
Token: SeSystemEnvironmentPrivilege	2136	wmic.exe
Token: SeRemoteShutdownPrivilege	2136	wmic.exe
Token: SeUndockPrivilege	2136	wmic.exe
Token: SeManageVolumePrivilege	2136	wmic.exe
Token: 33	2136	wmic.exe
Token: 34	2136	wmic.exe
Token: 35	2136	wmic.exe
Token: 36	2136	wmic.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeIncreaseQuotaPrivilege	1824	powershell.exe
Token: SeSecurityPrivilege	1824	powershell.exe
Token: SeTakeOwnershipPrivilege	1824	powershell.exe
Token: SeLoadDriverPrivilege	1824	powershell.exe
Token: SeSystemProfilePrivilege	1824	powershell.exe
Token: SeSystemtimePrivilege	1824	powershell.exe
Token: SeProfSingleProcessPrivilege	1824	powershell.exe
Token: SeIncBasePriorityPrivilege	1824	powershell.exe
Token: SeCreatePagefilePrivilege	1824	powershell.exe
Token: SeBackupPrivilege	1824	powershell.exe
Token: SeRestorePrivilege	1824	powershell.exe
Token: SeShutdownPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeSystemEnvironmentPrivilege	1824	powershell.exe
Token: SeRemoteShutdownPrivilege	1824	powershell.exe
Token: SeUndockPrivilege	1824	powershell.exe
Token: SeManageVolumePrivilege	1824	powershell.exe
Token: 33	1824	powershell.exe
Token: 34	1824	powershell.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe
2468	taskmgr.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2364	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1452	4880	SynsWaveV1.exe	73
PID 4880 wrote to memory of 1452	4880	SynsWaveV1.exe	73
PID 4880 wrote to memory of 2364	4880	SynsWaveV1.exe	74
PID 4880 wrote to memory of 2364	4880	SynsWaveV1.exe	74
PID 4880 wrote to memory of 4148	4880	SynsWaveV1.exe	75
PID 4880 wrote to memory of 4148	4880	SynsWaveV1.exe	75
PID 4148 wrote to memory of 4860	4148	SynsWave.exe	77
PID 4148 wrote to memory of 4860	4148	SynsWave.exe	77
PID 1452 wrote to memory of 2136	1452	MISHA_litvin.exe	78
PID 1452 wrote to memory of 2136	1452	MISHA_litvin.exe	78
PID 2364 wrote to memory of 1824	2364	RuntimeBroker.exe	81
PID 2364 wrote to memory of 1824	2364	RuntimeBroker.exe	81
PID 2364 wrote to memory of 2116	2364	RuntimeBroker.exe	84
PID 2364 wrote to memory of 2116	2364	RuntimeBroker.exe	84
PID 2364 wrote to memory of 4564	2364	RuntimeBroker.exe	86
PID 2364 wrote to memory of 4564	2364	RuntimeBroker.exe	86
PID 2364 wrote to memory of 2016	2364	RuntimeBroker.exe	88
PID 2364 wrote to memory of 2016	2364	RuntimeBroker.exe	88
PID 2364 wrote to memory of 3088	2364	RuntimeBroker.exe	90
PID 2364 wrote to memory of 3088	2364	RuntimeBroker.exe	90

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe
"C:\Users\Admin\AppData\Local\Temp\SynsWaveV1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe
  "C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1452
- - C:\Windows\System32\Wbem\wmic.exe
    "wmic.exe" csproduct get uuid
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2136
- C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe
  "C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2364
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1824
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker.exe'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2116
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\RuntimeBroker'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:4564
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionProcess 'RuntimeBroker'
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    PID:2016
- - C:\Windows\System32\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /create /f /RL HIGHEST /sc minute /mo 1 /tn "RuntimeBroker" /tr "C:\Users\Admin\RuntimeBroker"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3088
- C:\Users\Admin\AppData\Roaming\SynsWave.exe
  "C:\Users\Admin\AppData\Roaming\SynsWave.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4148
- - C:\Windows\system32\cmd.exe
    C:\Windows\system32\cmd.exe /c cls
    3⤵
    PID:4860

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2468

C:\Users\Admin\RuntimeBroker
C:\Users\Admin\RuntimeBroker
1⤵
- Executes dropped EXE
PID:4668

C:\Users\Admin\RuntimeBroker
C:\Users\Admin\RuntimeBroker
1⤵
- Executes dropped EXE
PID:348

C:\Users\Admin\RuntimeBroker
C:\Users\Admin\RuntimeBroker
1⤵
- Executes dropped EXE
PID:2572

C:\Users\Admin\RuntimeBroker
C:\Users\Admin\RuntimeBroker
1⤵
- Executes dropped EXE
PID:1344

C:\Users\Admin\RuntimeBroker
C:\Users\Admin\RuntimeBroker
1⤵
- Executes dropped EXE
PID:664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\RuntimeBroker.log

Filesize
654B

MD5
16c5fce5f7230eea11598ec11ed42862

SHA1
75392d4824706090f5e8907eee1059349c927600

SHA256
87ba77c13905298acbac72be90949c4fe0755b6eff9777615aa37f252515f151

SHA512
153edd6da59beea6cc411ed7383c32916425d6ebb65f04c65aab7c1d6b25443d143aa8449aa92149de0ad8a975f6ecaa60f9f7574536eec6b38fe5fd3a6c6adc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
ad5cd538ca58cb28ede39c108acb5785

SHA1
1ae910026f3dbe90ed025e9e96ead2b5399be877

SHA256
c9e6cb04d6c893458d5a7e12eb575cf97c3172f5e312b1f63a667cbbc5f0c033

SHA512
c066c5d9b276a68fa636647bb29aea05bfa2292217bc77f5324d9c1d93117772ee8277e1f7cff91ec8d6b7c05ca078f929cecfdbb09582522a9067f54740af13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
43dae3e092de54f471b70e2bae25eaaf

SHA1
c6d84536fc53a5d40de779ff9f77b15cb7d1ab4a

SHA256
cfeee9bbb69bece3bdcba4af6bf3d20e9a9bd70c4dcf2328a44eac6a6958af07

SHA512
29542bdc0a632e143ed24baa03f6f1221028fb3fbbf254e2c844a003a9978b2d5cc9183a0afbe8ced2a62b822071b354cef41d9475ac9b0b28cb9380da121e52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
7f54a331bf3258023d4902d80fea8476

SHA1
be4e077ac23ddaafb4ee954fd8f9562b0635ed44

SHA256
823b31436d5b504f2fe28c6ae4eb7dea4a2340c44574cb6b59b2adeedef1e089

SHA512
6e17407c90cda604856bd7014c77b289b69bf62901bc0d38a31b89fe219a22cbb5f10216d1c3263a11f9b1cc30e72ae5ed87b4e50501dea4440b842fd7f4180e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
db4cc15dff442379601b9d13c80ceb0c

SHA1
abb9365ff639e2be60358b4b0300c26114539521

SHA256
0cb2d77b985fbc42fe99aa379c2f9c1e10617ae706a0038a6c34c4b148fa5e6c

SHA512
2b591b54d9e81c598433e7be6fa68bd360a8934d4394cad657e900d99e47fc30d4d7faa8be333450d9d68dbceb8ac908dd2529aeb6ddec2c33cdae69025c891a

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_5kbioopm.lg5.ps1

Filesize
1B

MD5
c4ca4238a0b923820dcc509a6f75849b

SHA1
356a192b7913b04c54574d18c28d46e6395428ab

SHA256
6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

SHA512
4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

Download Submit
C:\Users\Admin\AppData\Roaming\MISHA_litvin.exe

Filesize
229KB

MD5
8bb8292d00e8218192562b888b4d7671

SHA1
61a03523336bd54964fbb62338027673d0a138cb

SHA256
a9f8c9cf4ceadfa6bc56ab230c8dfe8a7018e1123ba01039a4059b1814b757a0

SHA512
c19a19dd6b49cc237e751db9d58db56e745f7d00c8d81397928fddef8902b9abec4b9331573be9478d33554c6b77b4f52a055bf2251300736035b5eec24faa1e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RuntimeBroker.lnk

Filesize
784B

MD5
a7c48945a08d78cd9e3784aa2ec7b23a

SHA1
f3850e4703295a31dbfe057dee9e84d413289532

SHA256
987d728c0d894bb2ab4b0c707b0ded2c6329fa757133923a27cb978d95542927

SHA512
781870b54b71181df82276fa955f3f3c68c32b8e753754863955e0fd9948bc0d1892a4d1118e23a6d97a8eb0c3fe55a084871b2ed34b86748169469b587ffd58

Download Submit
C:\Users\Admin\AppData\Roaming\RuntimeBroker.exe

Filesize
94KB

MD5
5e6bae23e86272120e9ccfa3413ece3e

SHA1
7cf89daa0119650ec13ef056c143249c4002a4f1

SHA256
116b46762acbc220ec42b00329392668bf3e24cc00a650f68013465c319cbf4d

SHA512
7a607b3e850f930794bc493aa68d0ecf236a23e98ee912e279b1649bd0e2110e01cefcc5259744c06e1b4a8cccaececdde6c2f18ef8d252414cb461bdd9d3f0d

Download Submit
C:\Users\Admin\AppData\Roaming\SynsWave.exe

Filesize
25KB

MD5
12e7359129744823438f3d6b97192955

SHA1
89872a5a18abefe25d10efa824281718cf85ae39

SHA256
348086f9bd5939a48efcc94702271c1caf92ea11f3b0385367daf9530b51cf3e

SHA512
b38516752817d3ac6541d300cc17176c5bf1c38d321fd19c006cb1f5cf9d5ab7a228184ed267636841225e718f71d9cd8aed5e53e36c7ee3548ed6958b9e8563

Download Submit
memory/1452-14-0x00000202DBAB0000-0x00000202DBAF0000-memory.dmp

Filesize
256KB

Download
memory/1452-23-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

Filesize
9.9MB

Download
memory/1452-19-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

Filesize
9.9MB

Download
memory/1824-31-0x000002607FA10000-0x000002607FA86000-memory.dmp

Filesize
472KB

Download
memory/1824-28-0x000002607F860000-0x000002607F882000-memory.dmp

Filesize
136KB

Download
memory/2364-21-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

Filesize
9.9MB

Download
memory/2364-18-0x0000000000040000-0x000000000005E000-memory.dmp

Filesize
120KB

Download
memory/2364-209-0x00007FFA64190000-0x00007FFA64B7C000-memory.dmp

Filesize
9.9MB

Download
memory/4880-1-0x0000000000160000-0x00000000001C0000-memory.dmp

Filesize
384KB

Download
memory/4880-0-0x00007FFA64193000-0x00007FFA64194000-memory.dmp

Filesize
4KB

Download