808b319d355192973423e7cc8627da66f4da8cc3425fc6c944cfd33fac14f440

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 04:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

TeamsSetup_c_w_.exe
Size

1.4MB
MD5

1d1958ef6d1ae9a3d1f805ab29b44ae7
SHA1

3ac34d8071efd38a665147cf9ebac513f05c8576
SHA256

808b319d355192973423e7cc8627da66f4da8cc3425fc6c944cfd33fac14f440
SHA512

e8ff4eab25dcbcaa227b84f8e227c9ae5b3115f1d4f979091b5f61ac18cd6f2021ec318d5f382193d3bebe6977c2b23e5c009ba7e0fcf3ad289b61b92ab9bcb6
SSDEEP

24576:P9Yu8GgnSf7uw7w8q4Lgqc25Ztn064avviB1f42xVP3aIAU9W4iza7OHd7Z3mfqm:OGMo7N/8P253nTfvvIfvtqDU9vUa7UdA

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	Update.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000\Control Panel\International\Geo\Nation	Teams.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	Teams.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	Teams.exe

Executes dropped EXE 6 IoCs

pid	Process
4272	Update.exe
980	Squirrel.exe
3176	Teams.exe
572	Teams.exe
5916	Teams.exe
6064	Teams.exe

Loads dropped DLL 22 IoCs

pid	Process
3176	Teams.exe
3176	Teams.exe
572	Teams.exe
572	Teams.exe
572	Teams.exe
572	Teams.exe
5644	regsvr32.exe
5780	regsvr32.exe
5780	regsvr32.exe
5780	regsvr32.exe
5780	regsvr32.exe
5780	regsvr32.exe
5780	regsvr32.exe
5916	Teams.exe
5916	Teams.exe
5916	Teams.exe
5916	Teams.exe
5916	Teams.exe
6064	Teams.exe
3936	regsvr32.exe
3936	regsvr32.exe
3936	regsvr32.exe

Registers COM server for autorun 1 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAddin\\1.0.23241.2\\x86\\Microsoft.Teams.AddinLoader.dll"	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAddin\\1.0.23241.2\\x64\\Microsoft.Teams.AddinLoader.dll"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 7 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	Teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	Teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	Teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	Teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\2	Teams.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{C12F0DE5-9A7D-425C-B391-8BE004EAA2F6}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{57C3CB4D-C794-456F-846D-0E1ECA78BD00}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{53D014C1-54DB-42B3-9DFD-8E231EF2C356}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{B22EDBEA-9E61-4703-82BE-01C05619B6D6}\ProxyStubClsid32	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{FA7971EF-1E41-429F-8C79-DAC5F88D444B}\TypeLib\Version = "1.0"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{F7EE956B-A713-48D3-AFEF-0A28F37740B3}\ = "IAsynchronousOperation"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{57E5D78F-B8CF-4D2A-BFA2-602BCF01DB81}\TypeLib	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{2C59A886-ACD3-46BB-8BAC-7C1C59FB2E0D}\ = "IPreviousConversationsManagerNewItemCountChangedEventData"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{F4BEB62B-8A4E-4212-9030-B1B115E4C2F1}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{219DC126-9A48-483F-80C2-3F22B3B47829}\TypeLib\ = "{B9AA1F11-F480-4054-A84E-B5D9277E40A8}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{CA62E6F3-3E6D-451B-AEAA-6A1B7AACF8D4}\TypeLib\Version = "1.0"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{4023052E-E3B7-48A3-BCB3-CA2234D9BAEE}\TypeLib\ = "{B9AA1F11-F480-4054-A84E-B5D9277E40A8}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{D0DBB17D-565E-486C-A47B-BA32DC1FAD0A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{9274DBDC-43CE-45AA-A817-414A4494AD28}\TypeLib\Version = "1.0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{4875C050-BA9C-4A05-891E-E7B0A9463664}	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{C14A2DE1-2C90-49E6-B871-46D338A88FF5}	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{3C821E32-6F56-46E2-8137-E45F664226AB}\ProxyStubClsid32	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{3C821E32-6F56-46E2-8137-E45F664226AB}\ = "_IRoom2Callback"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{DBA05C15-1C07-4A76-8248-08D8416A24E3}\TypeLib	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{A0984F01-5D2C-4302-87A0-69BE7B015143}	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{AF2ABA54-F591-42BA-8004-20944C9FB4D7}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{7356D7BB-FD71-4554-84A1-3BBE28726551}\ = "ISearchResults"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{082EE280-726E-417F-99CB-81A0CCBFF883}	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{04378C72-E58F-47C0-8621-901B85CA2ED4}\TypeLib	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{88C688B0-3908-4C56-A2E8-F90AB705C536}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{CA7EEB7A-7DC3-4FFE-A174-23DB5A003C04}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{2C59A886-ACD3-46BB-8BAC-7C1C59FB2E0D}\ = "IPreviousConversationsManagerNewItemCountChangedEventData"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{21629AB6-9557-4985-9237-49177F618692}	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{BD891697-C93E-4A0B-9B6C-004BD81B6EE8}\ProxyStubClsid32	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{420A24E2-5C31-4262-9BD5-058682300ED6}\TypeLib\ = "{B9AA1F11-F480-4054-A84E-B5D9277E40A8}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{A4E1D1E4-7839-473B-95FA-5D33DDC0D2DD}	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{0CA9BAE8-DD28-4929-A821-4D00F11203CC}\TypeLib\Version = "1.0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{086F0E9D-A416-40F9-877C-F1C82DC1A6AD}\TypeLib	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{9B3A702D-5BE1-4FCE-ADB3-EBBD23E078C3}\ProxyStubClsid32	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{EFEC2816-F16D-48D8-9306-26C810F0EA55}\ = "IContactInformationChangedEventData"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{339D28C6-3D1A-45D4-BA14-A56742749A43}	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{DBA05C15-1C07-4A76-8248-08D8416A24E3}	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{7CFE77CD-731D-48B2-82B1-ECA3414D62E3}\TypeLib\Version = "1.0"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{F644C610-A146-4A56-8338-A69C45C71CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{8F04E92D-EE26-4B64-B9C1-56DD90816810}\ = "IFollowedRoomsChangedEventData"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{55A21CF3-A2B3-484E-BE2A-14280F501289}\ = "IVideoView"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{87665417-C861-4E1D-ACE8-3F566EE986A2}\ProxyStubClsid32\ = "{00020420-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{5E7AB04C-E4B8-49FB-85FF-9E2BCA2899D3}\TypeLib\Version = "1.0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{12480BD4-072F-4763-B9FB-41B2CA54F9CD}\TypeLib	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{533891F1-A460-43E6-8BDA-6D0D2C13ADDE}\TypeLib\ = "{B9AA1F11-F480-4054-A84E-B5D9277E40A8}"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{8665FD95-7720-4F9E-B605-6ABCBD7EDFF4}	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{25D64AEA-0E65-49CB-8D6D-65DB0AC1AF65}\ = "IClientSettingsChangedEventData"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{ABF012A2-2068-4B4D-80D7-6D386BA7C8A2}\TypeLib\Version = "1.0"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{2495B94C-38AF-439B-BBA0-0AD38D959CE4}\TypeLib\Version = "1.0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{4C675532-6D55-49DD-8C8E-3C1CC5624CF2}\ProxyStubClsid32	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{DAC6D77B-12F7-405C-BB33-002D6D4007F3}\ProxyStubClsid32	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{0BDB9057-28AE-4BF0-AFF0-12A148E51637}	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{F5996C71-77AB-4020-9776-C2C270FEF2AE}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{37C7F935-E215-46D2-82A3-A451840EC733}	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{25025B1B-0084-44D1-B383-9FFC9A99ABCD}\ = "_IConversationManagerEvents"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{FA7971EF-1E41-429F-8C79-DAC5F88D444B}\TypeLib\ = "{B9AA1F11-F480-4054-A84E-B5D9277E40A8}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{464D5228-9F68-4B1F-B430-156A104E2B85}\TypeLib\Version = "1.0"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{B1F3ACAE-139E-41D4-A5CE-50FE87A29737}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{7CC306E9-2546-4101-82AB-29613AD6F7A7}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{7BF20B14-58D1-494B-B301-9B16BACC9610}	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{9E0F8FCA-D9C9-47CD-87F4-5554217DFFCC}\TypeLib\Version = "1.0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\WOW6432Node\Interface\{12480BD4-072F-4763-B9FB-41B2CA54F9CD}\ProxyStubClsid32	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2890696111-2332180956-3312704074-1000_Classes\Interface\{2F8C3E58-436B-42DB-8924-6C394B37DCA2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	Update.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4272	Update.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe
Token: SeCreatePagefilePrivilege	572	Teams.exe
Token: SeShutdownPrivilege	572	Teams.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4272	Update.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4272	3272	TeamsSetup_c_w_.exe	86
PID 3272 wrote to memory of 4272	3272	TeamsSetup_c_w_.exe	86
PID 3272 wrote to memory of 4272	3272	TeamsSetup_c_w_.exe	86
PID 4272 wrote to memory of 980	4272	Update.exe	95
PID 4272 wrote to memory of 980	4272	Update.exe	95
PID 4272 wrote to memory of 980	4272	Update.exe	95
PID 4272 wrote to memory of 3176	4272	Update.exe	96
PID 4272 wrote to memory of 3176	4272	Update.exe	96
PID 4272 wrote to memory of 572	4272	Update.exe	101
PID 4272 wrote to memory of 572	4272	Update.exe	101
PID 4272 wrote to memory of 5644	4272	Update.exe	102
PID 4272 wrote to memory of 5644	4272	Update.exe	102
PID 4272 wrote to memory of 5644	4272	Update.exe	102
PID 5644 wrote to memory of 5780	5644	regsvr32.exe	104
PID 5644 wrote to memory of 5780	5644	regsvr32.exe	104
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 5916	572	Teams.exe	105
PID 572 wrote to memory of 6064	572	Teams.exe	106
PID 572 wrote to memory of 6064	572	Teams.exe	106
PID 4272 wrote to memory of 3936	4272	Update.exe	107
PID 4272 wrote to memory of 3936	4272	Update.exe	107
PID 4272 wrote to memory of 3936	4272	Update.exe	107

C:\Users\Admin\AppData\Local\Temp\TeamsSetup_c_w_.exe
"C:\Users\Admin\AppData\Local\Temp\TeamsSetup_c_w_.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
  "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=TeamsSetup_c_w_.exe --bootstrapperMode
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe" --updateSelf=C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    3⤵
    - Executes dropped EXE
    PID:980
- - C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-install 1.6.00.27573
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3176
- - C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
    "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-firstrun
    3⤵
    - Checks computer location settings
    - Checks system information in the registry
    - Executes dropped EXE
    - Loads dropped DLL
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:572
  - - C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\Admin\AppData\Roaming\Microsoft\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1692 --field-trial-handle=1876,i,9370080791829098787,2519254254275973550,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:5916
  - - C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --user-data-dir="C:\Users\Admin\AppData\Roaming\Microsoft\Teams" --mojo-platform-channel-handle=2132 --field-trial-handle=1876,i,9370080791829098787,2519254254275973550,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      PID:6064
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\Microsoft.Teams.AddinLoader.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:5644
  - - C:\Windows\system32\regsvr32.exe
      /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\Microsoft.Teams.AddinLoader.dll"
      4⤵
      Loads dropped DLL
      Registers COM server for autorun
      PID:5780
- - C:\Windows\SysWOW64\regsvr32.exe
    "C:\Windows\SysWOW64\regsvr32.exe" /s /n /i:user "C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x86\Microsoft.Teams.AddinLoader.dll"
    3⤵
    - Loads dropped DLL
    - Registers COM server for autorun
    - Modifies registry class
    PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\MSVCP140.dll

Filesize
561KB

MD5
d11780f0bd79b2585426837430fa2abd

SHA1
a00681211038fc58ea1e6ddef11ca2aad92d07e2

SHA256
d89db2cec12557af7fbffda1768776c03f6894da2f090e5a9da8916c0ed1479f

SHA512
b6fb95b85892eb6eef218bb635f03f45c7c01bce4e7eba12a49389c17e44cb09680a9fe650ffa0661028e9c367aacedb7a955a84cc40250dc6599838e833332e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\Microsoft.Teams.AddinLoader.dll

Filesize
235KB

MD5
5016022826d87bff7d01ddaa207ab7ab

SHA1
692a1d20f7ea09dea979c93e8e5e20aa23259c77

SHA256
3bc361d2daaa74488497e42e74e6ca0b6b4b208b4628cb04dc413445d138ff42

SHA512
f84e4b0c1a03407919655d11dda5978bb9dd0fc46fc5022032710f08aefe8df4fbfd8ef55fe6cf01f4854f3403c5bef4a5dffe135508f6aab732ff4363b7eb1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\Microsoft.Teams.AddinLoader.dll

Filesize
235KB

MD5
5016022826d87bff7d01ddaa207ab7ab

SHA1
692a1d20f7ea09dea979c93e8e5e20aa23259c77

SHA256
3bc361d2daaa74488497e42e74e6ca0b6b4b208b4628cb04dc413445d138ff42

SHA512
f84e4b0c1a03407919655d11dda5978bb9dd0fc46fc5022032710f08aefe8df4fbfd8ef55fe6cf01f4854f3403c5bef4a5dffe135508f6aab732ff4363b7eb1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\Microsoft.Teams.AddinLoader.dll

Filesize
235KB

MD5
5016022826d87bff7d01ddaa207ab7ab

SHA1
692a1d20f7ea09dea979c93e8e5e20aa23259c77

SHA256
3bc361d2daaa74488497e42e74e6ca0b6b4b208b4628cb04dc413445d138ff42

SHA512
f84e4b0c1a03407919655d11dda5978bb9dd0fc46fc5022032710f08aefe8df4fbfd8ef55fe6cf01f4854f3403c5bef4a5dffe135508f6aab732ff4363b7eb1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\VCRUNTIME140.dll

Filesize
104KB

MD5
d80c271dff54790fc18865d71c608af6

SHA1
9e15e0b826e8c559ab94a57ddc392371c9fb323f

SHA256
357b549ea8153cd18ed39cf56d3d148944cad7b7194a966928fea5a4b2934c22

SHA512
4ebe62802946dad86de308d401aa088851788d3c7699d7f73c9bdc1a1651dee13a9dcbf4d9b115c69115e9df642cc2f16f8a4333611cf61eae76c274b56e64e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\VCRUNTIME140_1.dll

Filesize
46KB

MD5
65a7502d1d99c6d6c273a04261c9568e

SHA1
427d18586e7ed24a668ca175fb046a454a4a4365

SHA256
d3dc71f6e8ebe1cac24567f83cd49b60fc3467bbb049ed851c713fc6a6719416

SHA512
896cbbfbb793ccaeacb1ec7040170a04849345d0766a7abcd8fc8b72e5aa107bff34fa7a53f59bdaf986cfcbac0851df5882666dce9b735a88ab02eaab1d52eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\msvcp140.dll

Filesize
561KB

MD5
d11780f0bd79b2585426837430fa2abd

SHA1
a00681211038fc58ea1e6ddef11ca2aad92d07e2

SHA256
d89db2cec12557af7fbffda1768776c03f6894da2f090e5a9da8916c0ed1479f

SHA512
b6fb95b85892eb6eef218bb635f03f45c7c01bce4e7eba12a49389c17e44cb09680a9fe650ffa0661028e9c367aacedb7a955a84cc40250dc6599838e833332e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\vcruntime140.dll

Filesize
104KB

MD5
d80c271dff54790fc18865d71c608af6

SHA1
9e15e0b826e8c559ab94a57ddc392371c9fb323f

SHA256
357b549ea8153cd18ed39cf56d3d148944cad7b7194a966928fea5a4b2934c22

SHA512
4ebe62802946dad86de308d401aa088851788d3c7699d7f73c9bdc1a1651dee13a9dcbf4d9b115c69115e9df642cc2f16f8a4333611cf61eae76c274b56e64e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\vcruntime140.dll

Filesize
104KB

MD5
d80c271dff54790fc18865d71c608af6

SHA1
9e15e0b826e8c559ab94a57ddc392371c9fb323f

SHA256
357b549ea8153cd18ed39cf56d3d148944cad7b7194a966928fea5a4b2934c22

SHA512
4ebe62802946dad86de308d401aa088851788d3c7699d7f73c9bdc1a1651dee13a9dcbf4d9b115c69115e9df642cc2f16f8a4333611cf61eae76c274b56e64e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\vcruntime140.dll

Filesize
104KB

MD5
d80c271dff54790fc18865d71c608af6

SHA1
9e15e0b826e8c559ab94a57ddc392371c9fb323f

SHA256
357b549ea8153cd18ed39cf56d3d148944cad7b7194a966928fea5a4b2934c22

SHA512
4ebe62802946dad86de308d401aa088851788d3c7699d7f73c9bdc1a1651dee13a9dcbf4d9b115c69115e9df642cc2f16f8a4333611cf61eae76c274b56e64e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x64\vcruntime140_1.dll

Filesize
46KB

MD5
65a7502d1d99c6d6c273a04261c9568e

SHA1
427d18586e7ed24a668ca175fb046a454a4a4365

SHA256
d3dc71f6e8ebe1cac24567f83cd49b60fc3467bbb049ed851c713fc6a6719416

SHA512
896cbbfbb793ccaeacb1ec7040170a04849345d0766a7abcd8fc8b72e5aa107bff34fa7a53f59bdaf986cfcbac0851df5882666dce9b735a88ab02eaab1d52eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x86\MSVCP140.dll

Filesize
436KB

MD5
feee9142eb94fc60a54a6c913f90d5ba

SHA1
a5cc3fd692e2e9373471728981d66eddbe268540

SHA256
8f873ccee8eeb02b68a668fdd91e97f9158a54e03e7c365f6059f58294fce370

SHA512
6e92fb28628c426d902561dcce09858a4042612bcb52550be9d4ba115bd9a17c65d9eaf833c21e33c8198e771d033afb786cc5ef57994c351163ea1034254897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x86\Microsoft.Teams.AddinLoader.dll

Filesize
238KB

MD5
a388c3ed03cd64a45702846a401f34a0

SHA1
b4dde0e56bb108fdd822b0d109b18fc03886ccbb

SHA256
82653d8a1f398527cfe2804bd893ec487b440d6024517312aafa68bff1e6c173

SHA512
3e335939d66796a602f66a1fca13a4c204ef59fce1c23b5b5f51b71517cc38ae36f598f1632fed797ba47b4604e3da2b8cd1d949463ba6eda42510eae4b56887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x86\Microsoft.Teams.AddinLoader.dll

Filesize
238KB

MD5
a388c3ed03cd64a45702846a401f34a0

SHA1
b4dde0e56bb108fdd822b0d109b18fc03886ccbb

SHA256
82653d8a1f398527cfe2804bd893ec487b440d6024517312aafa68bff1e6c173

SHA512
3e335939d66796a602f66a1fca13a4c204ef59fce1c23b5b5f51b71517cc38ae36f598f1632fed797ba47b4604e3da2b8cd1d949463ba6eda42510eae4b56887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x86\VCRUNTIME140.dll

Filesize
84KB

MD5
3c14f6303043b5deacd94a73216683f5

SHA1
082229998f8a1c9112ddf55981b67d4b895e0956

SHA256
2e02d2013f384924c115346d11c4abae42b3aed765510a6fd6e30c50772511be

SHA512
cd988fdd6cee6750267ca9ca0aa61355b4db730562f49e50a6446b9aaa84e41222c993b3df20341e9c7942efcd9627be86386d71b4cadb2f90a1659e2f0cb4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x86\msvcp140.dll

Filesize
436KB

MD5
feee9142eb94fc60a54a6c913f90d5ba

SHA1
a5cc3fd692e2e9373471728981d66eddbe268540

SHA256
8f873ccee8eeb02b68a668fdd91e97f9158a54e03e7c365f6059f58294fce370

SHA512
6e92fb28628c426d902561dcce09858a4042612bcb52550be9d4ba115bd9a17c65d9eaf833c21e33c8198e771d033afb786cc5ef57994c351163ea1034254897

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.23241.2\x86\vcruntime140.dll

Filesize
84KB

MD5
3c14f6303043b5deacd94a73216683f5

SHA1
082229998f8a1c9112ddf55981b67d4b895e0956

SHA256
2e02d2013f384924c115346d11c4abae42b3aed765510a6fd6e30c50772511be

SHA512
cd988fdd6cee6750267ca9ca0aa61355b4db730562f49e50a6446b9aaa84e41222c993b3df20341e9c7942efcd9627be86386d71b4cadb2f90a1659e2f0cb4ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsPresenceAddin\Uc.tlb

Filesize
445KB

MD5
e3c8b42670ebb0530ee81f427671aaa1

SHA1
f8c75abc800c7326e6e814947390c14575d691cb

SHA256
1b31630cd15bfdc663b9630790b968aee407730dc94f48bb96fbedac9ecb1002

SHA512
4cca913dd1890dbfa72195eff3cb5856ac6c01a4a910df719376ea13264e129823d3788eb874c222534aee1e1cf7b3ace71900002252449a872bb3c9447f3b98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\TeamsPresenceAddin\Uc.win32.tlb

Filesize
445KB

MD5
2eb6c328ace10bee32eecb6609578aab

SHA1
3fde2f845cf62ff557fd49e46fa6f761cff4c7ea

SHA256
40f438a5f0d0e9ff5bbcab29d51bc7b6cba03548c5db021a05426665a2f98a69

SHA512
e4ff466ceba47c71046985ab1e62877bfc57d5a98f0e966c46f64fb23710c85cc2aa3bd2f4b0abc134d18a501d7a01ffe881110fc57a8b5ddb07c89dcd4f3514

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\app.ico

Filesize
168KB

MD5
247d14144a313421d8d84aa0ea54d249

SHA1
83befdd6eba57faa3d3074aa08a28a4e8d75076a

SHA256
2d5aa67b8ace13a94fd09316787e3c9aba2adac767b6e2ab769a2265a2ad20f0

SHA512
f2d79a2a75148efaf90a4a92980e781b1f94a4a1034383ffe5749983085ef7eafa29d4804094296b212795501b4b4a126bc47c24a91b60c24104bc4b24d99565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\D3DCompiler_47.dll

Filesize
4.7MB

MD5
aca9fc4ea866205b438d8351ceb13795

SHA1
280785961d9a1e3287ece7a1979ccb0e8b47de61

SHA256
f4a87f69baeb7c432a2901eb6388926a2631322496aca5b0ab59a14ff249b3dc

SHA512
707a84ed47cc0b137b7704f63af3232461f4240007e42c4a9a30be934c6dceb0ca92d798b3727fec5f3c6c872804853a2ae53785219bc346b955457b5cfb121f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe

Filesize
2.5MB

MD5
abe348c381aa9d40f051bc3ca1510a11

SHA1
1a43fc8a1f392bd12c6f00cba18cff99b6bd643d

SHA256
1e80826a740b4032577fd88697c2813ae6248c5c082f9a4bfd918c20fc9d5d99

SHA512
9c9a6687b1240c2efa5d88f3a5f4f761940687ae4ed664074958fb2d9fd7026fbf39085f0eb515776440e96273acbd7eedcd08c869d7a8f6bc7ba8a2f07f7d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe

Filesize
2.5MB

MD5
abe348c381aa9d40f051bc3ca1510a11

SHA1
1a43fc8a1f392bd12c6f00cba18cff99b6bd643d

SHA256
1e80826a740b4032577fd88697c2813ae6248c5c082f9a4bfd918c20fc9d5d99

SHA512
9c9a6687b1240c2efa5d88f3a5f4f761940687ae4ed664074958fb2d9fd7026fbf39085f0eb515776440e96273acbd7eedcd08c869d7a8f6bc7ba8a2f07f7d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Squirrel.exe

Filesize
2.5MB

MD5
abe348c381aa9d40f051bc3ca1510a11

SHA1
1a43fc8a1f392bd12c6f00cba18cff99b6bd643d

SHA256
1e80826a740b4032577fd88697c2813ae6248c5c082f9a4bfd918c20fc9d5d99

SHA512
9c9a6687b1240c2efa5d88f3a5f4f761940687ae4ed664074958fb2d9fd7026fbf39085f0eb515776440e96273acbd7eedcd08c869d7a8f6bc7ba8a2f07f7d4f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe

Filesize
142.6MB

MD5
89b717809a5a49d19e7e06746982bf0b

SHA1
68d25b5f5a57cf5dc0d63644338c04ea906d472b

SHA256
2024533463df3c945a74c774858285915ffb4e083031b51b8135bbbf5e8fc5ee

SHA512
db98217580cd73c4d34d9e4aa0e67455f753c4d8d89cd0ec83cad3a40c1cf8819f411b0f339fbc73cb24588b38b7345d43dcbd822a6060f1a8fdbb2803c400a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe

Filesize
142.6MB

MD5
89b717809a5a49d19e7e06746982bf0b

SHA1
68d25b5f5a57cf5dc0d63644338c04ea906d472b

SHA256
2024533463df3c945a74c774858285915ffb4e083031b51b8135bbbf5e8fc5ee

SHA512
db98217580cd73c4d34d9e4aa0e67455f753c4d8d89cd0ec83cad3a40c1cf8819f411b0f339fbc73cb24588b38b7345d43dcbd822a6060f1a8fdbb2803c400a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe

Filesize
142.6MB

MD5
89b717809a5a49d19e7e06746982bf0b

SHA1
68d25b5f5a57cf5dc0d63644338c04ea906d472b

SHA256
2024533463df3c945a74c774858285915ffb4e083031b51b8135bbbf5e8fc5ee

SHA512
db98217580cd73c4d34d9e4aa0e67455f753c4d8d89cd0ec83cad3a40c1cf8819f411b0f339fbc73cb24588b38b7345d43dcbd822a6060f1a8fdbb2803c400a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe

Filesize
142.6MB

MD5
89b717809a5a49d19e7e06746982bf0b

SHA1
68d25b5f5a57cf5dc0d63644338c04ea906d472b

SHA256
2024533463df3c945a74c774858285915ffb4e083031b51b8135bbbf5e8fc5ee

SHA512
db98217580cd73c4d34d9e4aa0e67455f753c4d8d89cd0ec83cad3a40c1cf8819f411b0f339fbc73cb24588b38b7345d43dcbd822a6060f1a8fdbb2803c400a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\Teams.exe

Filesize
142.6MB

MD5
89b717809a5a49d19e7e06746982bf0b

SHA1
68d25b5f5a57cf5dc0d63644338c04ea906d472b

SHA256
2024533463df3c945a74c774858285915ffb4e083031b51b8135bbbf5e8fc5ee

SHA512
db98217580cd73c4d34d9e4aa0e67455f753c4d8d89cd0ec83cad3a40c1cf8819f411b0f339fbc73cb24588b38b7345d43dcbd822a6060f1a8fdbb2803c400a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\chrome_100_percent.pak

Filesize
125KB

MD5
0cf9de69dcfd8227665e08c644b9499c

SHA1
a27941acce0101627304e06533ba24f13e650e43

SHA256
d2c299095dbbd3a3cb2b4639e5b3bd389c691397ffd1a681e586f2cfe0e2ab88

SHA512
bb5d340009cef2bcb604ef38fdd7171fed0423c2dc6a01e590f8d15c4f6bc860606547550218db41fba554609e8395c9e3c3508dfa2d8b202e5059e7646bdcef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\chrome_200_percent.pak

Filesize
174KB

MD5
d88936315a5bd83c1550e5b8093eb1e6

SHA1
6445d97ceb89635f6459bc2fb237324d66e6a4ee

SHA256
f49abd81e93a05c1e53c1201a5d3a12f2724f52b6971806c8306b512bf66aa25

SHA512
75142f03df6187fb75f887e4c8b9d5162902ba6aac86351186c85e5f0a2d3825ca312a36cf9f4bd656cdfc23a20cd38d4580ca1b41560d23ebaa0d41e4cf1dd2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\d3dcompiler_47.dll

Filesize
4.7MB

MD5
aca9fc4ea866205b438d8351ceb13795

SHA1
280785961d9a1e3287ece7a1979ccb0e8b47de61

SHA256
f4a87f69baeb7c432a2901eb6388926a2631322496aca5b0ab59a14ff249b3dc

SHA512
707a84ed47cc0b137b7704f63af3232461f4240007e42c4a9a30be934c6dceb0ca92d798b3727fec5f3c6c872804853a2ae53785219bc346b955457b5cfb121f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\ffmpeg.dll

Filesize
2.7MB

MD5
8f1aa47446467bd2ab17404be0947c26

SHA1
f181e223aeeda637140ea8270dc10ebf7f998868

SHA256
d9f50e3c98812d88c4c54b43600f8cf930404625de322a4a4ae88337619b8514

SHA512
4ef2613cd09a28a4d68ce6a1a7b1d5f69efaa38f36d99ba38e953249f670c8f73ec3eac181cbd313c8a5206849abd3b619feb79ad6446da2413da65ca3dd50c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\ffmpeg.dll

Filesize
2.7MB

MD5
8f1aa47446467bd2ab17404be0947c26

SHA1
f181e223aeeda637140ea8270dc10ebf7f998868

SHA256
d9f50e3c98812d88c4c54b43600f8cf930404625de322a4a4ae88337619b8514

SHA512
4ef2613cd09a28a4d68ce6a1a7b1d5f69efaa38f36d99ba38e953249f670c8f73ec3eac181cbd313c8a5206849abd3b619feb79ad6446da2413da65ca3dd50c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\ffmpeg.dll

Filesize
2.7MB

MD5
8f1aa47446467bd2ab17404be0947c26

SHA1
f181e223aeeda637140ea8270dc10ebf7f998868

SHA256
d9f50e3c98812d88c4c54b43600f8cf930404625de322a4a4ae88337619b8514

SHA512
4ef2613cd09a28a4d68ce6a1a7b1d5f69efaa38f36d99ba38e953249f670c8f73ec3eac181cbd313c8a5206849abd3b619feb79ad6446da2413da65ca3dd50c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\ffmpeg.dll

Filesize
2.7MB

MD5
8f1aa47446467bd2ab17404be0947c26

SHA1
f181e223aeeda637140ea8270dc10ebf7f998868

SHA256
d9f50e3c98812d88c4c54b43600f8cf930404625de322a4a4ae88337619b8514

SHA512
4ef2613cd09a28a4d68ce6a1a7b1d5f69efaa38f36d99ba38e953249f670c8f73ec3eac181cbd313c8a5206849abd3b619feb79ad6446da2413da65ca3dd50c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\ffmpeg.dll

Filesize
2.7MB

MD5
8f1aa47446467bd2ab17404be0947c26

SHA1
f181e223aeeda637140ea8270dc10ebf7f998868

SHA256
d9f50e3c98812d88c4c54b43600f8cf930404625de322a4a4ae88337619b8514

SHA512
4ef2613cd09a28a4d68ce6a1a7b1d5f69efaa38f36d99ba38e953249f670c8f73ec3eac181cbd313c8a5206849abd3b619feb79ad6446da2413da65ca3dd50c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\icudtl.dat

Filesize
9.9MB

MD5
e489031f278c5148ae16585a56861f66

SHA1
4a8a2d9c11e17528785e3d17ad6b7f77f0b206da

SHA256
b3791911ad1d46b1ca18e224a645d6cf37345d36bf233891be8b87843d10f651

SHA512
94ba1c51a70e23b678f02ac0b8d3a59f82b2109dd3b932321e8a23519cbacbf9da82f5d4e942d24f6e42e8463a9eb1ebf7f2054435081c8569b0e9836ba530b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\libEGL.dll

Filesize
489KB

MD5
a920c001eab57483ee2f53d14d7679f8

SHA1
6c89d51f9bc9feddf678682cf3b66b78f79dab44

SHA256
815db285b4bc987fc82bc563e299052f8ec2e5a10e839662e9884980300c819a

SHA512
280ae92d0ba33ebb3103c11880502a844370c56cec2ae8f92d2a6b026cb2440946b13cf1a90ecc5d693ae53ddd6f9571498d6d81f02d720f37381cdab069d78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\libGLESv2.dll

Filesize
6.9MB

MD5
99f807495fc127920962c569701d821a

SHA1
22e14375866f3ff44b5a6420518e2590b1ace01c

SHA256
de329ef42955183f9f245768275ac0e0bbb5eaa9bf1a7047ce9227fda85c2e63

SHA512
94eaeb6d73ffe55c402cb5fbe583f72006095ed8329d73cfe68df9f1ffb3af8873f0568a7d08ef92d9fbe8cce2bfb543932231a580675c0284311f3186a930d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\libegl.dll

Filesize
489KB

MD5
a920c001eab57483ee2f53d14d7679f8

SHA1
6c89d51f9bc9feddf678682cf3b66b78f79dab44

SHA256
815db285b4bc987fc82bc563e299052f8ec2e5a10e839662e9884980300c819a

SHA512
280ae92d0ba33ebb3103c11880502a844370c56cec2ae8f92d2a6b026cb2440946b13cf1a90ecc5d693ae53ddd6f9571498d6d81f02d720f37381cdab069d78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\libglesv2.dll

Filesize
6.9MB

MD5
99f807495fc127920962c569701d821a

SHA1
22e14375866f3ff44b5a6420518e2590b1ace01c

SHA256
de329ef42955183f9f245768275ac0e0bbb5eaa9bf1a7047ce9227fda85c2e63

SHA512
94eaeb6d73ffe55c402cb5fbe583f72006095ed8329d73cfe68df9f1ffb3af8873f0568a7d08ef92d9fbe8cce2bfb543932231a580675c0284311f3186a930d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\locales\en-US.pak

Filesize
115KB

MD5
f982582f05ea5adf95d9258aa99c2aa5

SHA1
2f3168b09d812c6b9b6defc54390b7a833009abf

SHA256
4221cf9bae4ebea0edc1b0872c24ec708492d4fe13f051d1f806a77fe84ca94d

SHA512
75636f4d6aa1bcf0a573a061a55077106fbde059e293d095557cddfe73522aa5f55fe55a48158bf2cfc74e9edb74cae776369a8ac9123dc6f1f6afa805d0cc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources.pak

Filesize
4.9MB

MD5
ec39e11f63dc76f4e0333158f6479269

SHA1
90b92e03e2c299d241f6e392573ec7643f688197

SHA256
5066ceab1b4a8ed5bd24726dd85a1a21debb866800a946267ad6a009451c0f0d

SHA512
68e8a2e1f2e62e71660d9d8c77c3da86044f79ac24af0472752bbf13447ec6439dad938d08cec1cc5504a15a72b9aaaa1828039656890ccda7e10f91daf77d4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar

Filesize
25.5MB

MD5
ad1790c620666b615cb96daa655399bd

SHA1
391f9f9c9b771b563496ad77e81febff01e5050e

SHA256
4c345b7da574dcfdb615a2f607364075322a460f3c9679b01e02df39928d9a8c

SHA512
5c784d8d4a10b8597bc22a293586f0058d85a84a0d43d76d0cfb9a2a5a56e355159cb5e4bfe73578d83017bb55b581afac4fca03e0ec336318b657eed0ab4f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keytar4\build\Release\keytar.node

Filesize
204KB

MD5
5da7a7ce31d9e95f3be756728b791ef7

SHA1
0cfa5852979359ca912530a9258272e5bcf8e9e8

SHA256
ee69bcdfb12370a683368af3b19f38810b19ed7f6e414febf6091e879874ed16

SHA512
494587ff0b305c37bd2140fdf679c6c4e3fe7f0756afbd16c2ec6180dfb2b2b04f0ff7bc084f4c4b5b322032eed7eff8bbadfb1c84ab7bb235f290e28cea9d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keytar4\build\Release\keytar.node

Filesize
204KB

MD5
5da7a7ce31d9e95f3be756728b791ef7

SHA1
0cfa5852979359ca912530a9258272e5bcf8e9e8

SHA256
ee69bcdfb12370a683368af3b19f38810b19ed7f6e414febf6091e879874ed16

SHA512
494587ff0b305c37bd2140fdf679c6c4e3fe7f0756afbd16c2ec6180dfb2b2b04f0ff7bc084f4c4b5b322032eed7eff8bbadfb1c84ab7bb235f290e28cea9d25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\native-utils\build\Release\native-utils.node

Filesize
232KB

MD5
367f8fe488acdd13811c978b54d146aa

SHA1
62c0b6249fb5a87c74054a3e10f209f1bbd51d21

SHA256
592262a6cfe0afcc392ed9846b325acff18be26a40655a68302ff6f68eb76794

SHA512
23adde3b706ab0125bb7da7d316e5e2e4856ff66eb3321155d7b4a0f037969acfd17b7acb429ef7c5c1998bfb936467a4a2f6c90a494ddd9936c4f0adbf24e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\native-utils\build\Release\native-utils.node

Filesize
232KB

MD5
367f8fe488acdd13811c978b54d146aa

SHA1
62c0b6249fb5a87c74054a3e10f209f1bbd51d21

SHA256
592262a6cfe0afcc392ed9846b325acff18be26a40655a68302ff6f68eb76794

SHA512
23adde3b706ab0125bb7da7d316e5e2e4856ff66eb3321155d7b4a0f037969acfd17b7acb429ef7c5c1998bfb936467a4a2f6c90a494ddd9936c4f0adbf24e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\native-utils\build\Release\native-utils.node

Filesize
232KB

MD5
367f8fe488acdd13811c978b54d146aa

SHA1
62c0b6249fb5a87c74054a3e10f209f1bbd51d21

SHA256
592262a6cfe0afcc392ed9846b325acff18be26a40655a68302ff6f68eb76794

SHA512
23adde3b706ab0125bb7da7d316e5e2e4856ff66eb3321155d7b4a0f037969acfd17b7acb429ef7c5c1998bfb936467a4a2f6c90a494ddd9936c4f0adbf24e94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\registry-utils\build\Release\registry-utils.node

Filesize
188KB

MD5
16c987813cc1283a67e2f00b4717155d

SHA1
d769623fc01a9a83bad95a45c580be528ac46f54

SHA256
ba00e768f5bf18aebe725c6b39c807a09d204bfcbfaa1b0b160919d41f416f4a

SHA512
974006436e317cf81bddac624ed10697aaa43d904d2fc79ecda598124410f6f5368d7c3ea84391e2509b6ab52ee010d3dd4c4a9ec2cfe02ec8caffdcfcbc1041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\registry-utils\build\Release\registry-utils.node

Filesize
188KB

MD5
16c987813cc1283a67e2f00b4717155d

SHA1
d769623fc01a9a83bad95a45c580be528ac46f54

SHA256
ba00e768f5bf18aebe725c6b39c807a09d204bfcbfaa1b0b160919d41f416f4a

SHA512
974006436e317cf81bddac624ed10697aaa43d904d2fc79ecda598124410f6f5368d7c3ea84391e2509b6ab52ee010d3dd4c4a9ec2cfe02ec8caffdcfcbc1041

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Large_120.png

Filesize
1016B

MD5
e3b1ba3900bffae493b4463f9a6fbc48

SHA1
0bddcab7f9537f01900cb7a7ab0fbb1042e460e7

SHA256
8fde3d7378d0e9148068c3a9406d5bd754e93c9810ff5d2b8535fc2b65e0830e

SHA512
8ca0a6304bd871b1f2beccf6af9cbb2ec97d05b233b9388cfc760b262509b8bf6f9b50b837d21018fca6e8627fa11ae67f6af49440a837701b4c9ae920585246

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Large_144.png

Filesize
1KB

MD5
6974cfc337bf190d728c6824ef94afb6

SHA1
741daba13f01c19518e2e1e72a93df2c96227934

SHA256
115340c0940669c7a55670f03737492fb86d5e34e0390e5664eea3f9b4147b0c

SHA512
679afa5d417748680624314a6e5ff63cbf37d11bf5e95fd2d2114076f1dcd75196849eb39b1d456a8a5db0019ef2c4c2fd61ea70651daf158b87a69d8b017faf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Large_192.png

Filesize
1KB

MD5
177094a528723cef49fa2ffdfab57cf5

SHA1
cbae150edcd83f2e9bb87a0bb86cf076eebc41c2

SHA256
66cd5e3cfc69af5087d33c570cfe424b50935b01c27e618ca11822ac7ae6d1e6

SHA512
ad9394116d2e132eb2bff48f1ae4ab7aec5b372ffd2b7b41e29cd8bf26c87725bb48d0c3ad85f7c3c94b4556872a06876d1e95f4ad8a0cf63dd949dbe350d8e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Large_96.png

Filesize
821B

MD5
fafba571265b20e0ec4423fead972e1b

SHA1
b686d74ff48e3b990f0e312bb0f3af4e8f53069a

SHA256
1fb3b4832e92b1e2f998cd2ff4a872000822cbb897d869194195e5c4f8d43cd0

SHA512
d0523ccc27436a80c5a14094ad244349efe68fb5a813f97539c3025fcc1f05d6cec9b8ffd04883e35bcd787a36901246687162b4b86717e81e747b2cf035dd2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Small_120.png

Filesize
574B

MD5
503e86e4628933d17b5b41b4918d6c9f

SHA1
f884f45cf4ef5b435e554ea30f654f076e50bdf5

SHA256
1c80cc98643e1d060b9443c98e9afe663125398f7bb99e5bab2c0eb952c9c111

SHA512
22d115a09597f7a8cb0c5bcd0e0bba55798d3a431b28ec27e9ddaa356bf0af674bdb78e6d9a3911e2750354d42a8ad628ebd0a7716410360f6d1160258e12c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Small_144.png

Filesize
627B

MD5
75713d844925ac3404d59c5d56dd996a

SHA1
88f0f5b5450772a85fd61fb5fd54c3a6f7e48585

SHA256
d4746496079e9c334715958852fa8fb59e54dbdead19d83001fa15c1793d27b2

SHA512
b60e132bd5251084b2c7a22591d72dfdfebb7a24987adb8e78ca345694f6043c1f3c7a9205b6052cf3846fcf33179506bff88c1d1bc8093a7563cf150ec5d30a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Small_192.png

Filesize
875B

MD5
f323d73771349b6374462b8a4b708d83

SHA1
39f8860aec7ac9ff8df80c770a23f3ac8c3be4a1

SHA256
ea0327cd2d987cf069747f70a317e552c0304170177101aa578f04d2ebe9ffb6

SHA512
5377fd3886fcdef87b61f1cc825655e6b977e370563b2c2f7b3bb675b8adcce621a47f056945a9c0a41f9c10bf4df6694167e62a310b146587f898d39e753eb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Assets\NewMeeting_Small_96.png

Filesize
483B

MD5
a2761de768472d09d1e02c92ebd144b5

SHA1
60ba18f0ff47b9e9c3e23b5ae9e95e3d319b5c5d

SHA256
ac7fe3232888bf96c520d586c723149cd3127e1ce7cc65bc35ba1984cc27bbca

SHA512
f330db55b79e561d2dac1cd051421f91d6981a489a004eb0eae3ae090b1386ddf46efb675a9b6f75a0bb83f741b5da12e4dfb872ee41782773bfaec9014ca667

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.Bond.Interfaces.dll

Filesize
27KB

MD5
439846b818f0fed3da3a12075ac206c7

SHA1
89ceac994a8a6ee405e9e22c95418c9b318b9a64

SHA256
fd41c971f78f488855d566410fe43cde2025b6184f60081e1464b54e5e352de1

SHA512
2c843c8cb8ada9e35474c66684dbe398de7229df0ac13341cbc00dfbe01f80c33b837ba2325cf284d0d177533d0c3a2365cbac30f63309a334876594e6321d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.Bond.dll

Filesize
149KB

MD5
44a8b726db76681119a941c349aaea55

SHA1
8dbfc784f0208233962163a2fe0c74aa5a57203e

SHA256
5e0a105928d9780a6d250c29d6422ca7794cddf3ebbb0470b48eded64990be67

SHA512
d040548a5636fad163f1a155483a77fa0afc83eb3a8b81b8e73af4a950923d138938b2e1690b5c79e738dbd0839032e76d508d3eb5331dc939363252b1be718f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.IdentityModel.JsonWebTokens.dll

Filesize
76KB

MD5
735613ffca4fc153938b392cfbe2e684

SHA1
0bbb300032f1d26ae3ec44b6d7901ccd3679ae97

SHA256
4b47764a7ec8d55d155d4559854011476b34184e57c5537e8ae78786ddd82715

SHA512
0658bc8102daa7677f47238e0e00f85d3720a454f6567a70807b81ec792c6ecff1fac230962999230bb320d0fe1d163fe601200e0100bee839c49e84034245cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.IdentityModel.Logging.dll

Filesize
39KB

MD5
6a5d3dd17570f2af4f03701a6601ecf7

SHA1
f44d80856399126466a2de4af2520495abbe0e28

SHA256
9e1f53dc85327fce56ef61c85ec83205f351ecc13417a39f8a70cca63b866815

SHA512
1ff7d3c80c0535edeea047d474037ac4603f9913eb079d94eefe21104d4fc5a1d84b7493647ca245751797030a39caab004ba2613071387ee2e7dc1e43a96fd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.IdentityModel.Tokens.dll

Filesize
915KB

MD5
11cb9b85360b269163b41b6de7010d9e

SHA1
7152cae71bf6f10685db610a6378f403483cb3eb

SHA256
036009b0dcd93b7139c01feeeda27f457ba28555af401d19c017a8af2676a072

SHA512
94c5fec7f887534532853edab2670c919bfca9b7dc5723a5c50c6414da85c3203bdb016ae45ee0364efd7e8d76d7cba0887571f1b2e99dd1bfbafb29a557df43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.Teams.MeetingAddin.dll.config

Filesize
515B

MD5
ed080ed5825cf4893ca4f7d1395b9957

SHA1
3905e190109e5df90676f4716a69c815a6e52b44

SHA256
29f368def465f1ae30df31ebca4a976f180dbcf3718605b4acb0d6da95a30855

SHA512
73041863b7916b21a56d5c61933d9922d24b15548d7356dfee42c3ab617f72a04aa8080f3c5eb3f21d968ffb38c7244d4484e78540bf6bb8fc93600a017e43d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.Web.WebView2.Core.dll

Filesize
287KB

MD5
ff5fdea00d203c80e3df0d8dcf04b8ae

SHA1
936f54da3ec239ee050771b629b159fd6bc5c3a2

SHA256
84caadad1ed426fac374f9994ac010ef1c9a343996eb4dd6d39662eb7d6e224c

SHA512
785215962761d1e7a1ff9954380b1cb9b7cf9d37044fb9730fea2d215339a6de673075e09589764466fb58c70b95504d75590d3ce387533c942b769df024e8ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.Web.WebView2.WinForms.dll

Filesize
43KB

MD5
397c0cc58c43ced2b48029bee295d97a

SHA1
1d60a0e118e6323d571b4dff4c6794e75354fa62

SHA256
0b0be126c08ff5c4f30715ecbbd7e02e38ffdfe1051e0a7cbea3d764594c6a16

SHA512
afbf91a7831647be9571ea522d46965b543ca7b94dc676001ec6b8f83950ef07c3f99f0f0c25cf8371e0d0c7f03290773e3c198e0bdf45032a7bc5ad164b71f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Microsoft.Web.WebView2.Wpf.dll

Filesize
49KB

MD5
c49f141fba4b9982d0a9443e815ae564

SHA1
93ead30e595fa32b0e5dc46c4856d8d4c1669d86

SHA256
5aac0fff3bff17fe841d414c46249539d6e82a8d1b741485a3833027a11f2304

SHA512
f60f32773793188e4eb2bd13e3ba9b2f5cc5ed2dcb3cec713dbc3727daaf3804ea120c35c9b8e2ea495b686c717949e1f36ee9aa537547ac27c7511828fb0a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\Newtonsoft.Json.dll

Filesize
697KB

MD5
7e2c7f5eb83a389e569767b135886a6b

SHA1
1d6d4d13b75647f1b2420ceeb0ceee1f9713a50a

SHA256
add7cbc3bc36b41fce1fe654040d7bbcdfd784b939cf94c64dc48a75346d29dc

SHA512
e7c5688c57b19748398965c2fee91af8da51be1d8ac808fa0312f106e579ee4ac869fefaa0bc84813bbbe8e06e4ce8c8c5c76bb70db1bf1ffe06b8053d5d2355

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\System.IdentityModel.Tokens.Jwt.dll

Filesize
91KB

MD5
d90a1f4a84fdf03353b887d1ac4e9ece

SHA1
16ed6eef67e472675e772452fa24d4928ecf7d54

SHA256
d1109162971a0b2c41f44099d77743b6e456970cae780235c7d7cb67cd6118b1

SHA512
178c2399cc21cc661039ecb5539879086671061565ba7cee0088e0304004c2d0a897dd4718a9e3884e0f00bcd74af8fbe0093ccfe952cee453c0759e27393ee5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.23241.2\x64\System.Net.Http.Formatting.dll

Filesize
184KB

MD5
62b57a6a64eb3dae77e54b9b18184e60

SHA1
754deb97395808bcf5a8372195e626bb76066fa0

SHA256
451407e9c25a86e5435ccd82527fc542e6dbe1c231520da0970fd72ad6b7a350

SHA512
61313a7ff6a8a8c033ffe3046bc32713dd5507b4b0df69b5cb303f533ca4e642364cdcaac649b71be1b9eaf7b7447b61c4b66096f921e8f885cd809719cec3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\v8_context_snapshot.bin

Filesize
713KB

MD5
4c90f7d4418456004de92be910411029

SHA1
823ca47d19ffd7f0f5dea56b3e95e8ae2b1b858b

SHA256
cb68eecd538c29737f54f632073a50942e37af2bb3f1a527c0a9dc6b3c7f0669

SHA512
de3361378c67df5ffc2c0de66420e73d24ece4fd47e4f80388e663a0f53ffa854bab9954ae97423f6fc5ba6a483da43fba0cfb53f2c7c2026115587200199a63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\vk_swiftshader.dll

Filesize
4.6MB

MD5
8c406f51fab10bb949a2832fdbc88c81

SHA1
6c968de974783fbb267e6636c530355efd3000a9

SHA256
a9f2bcca3f4d81012766e069fc0cb35d2570fbb8d13c55fbfecf3b15c5b3c536

SHA512
b1bfc5d2ba3bd98b93494a318c04bf881da656e1b3e51953c19322ab3b0bc2aa1b37670885b40e4c1cea88783539e75306b33441f39c39db22ebcc15aeabc0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\current\vk_swiftshader.dll

Filesize
4.6MB

MD5
8c406f51fab10bb949a2832fdbc88c81

SHA1
6c968de974783fbb267e6636c530355efd3000a9

SHA256
a9f2bcca3f4d81012766e069fc0cb35d2570fbb8d13c55fbfecf3b15c5b3c536

SHA512
b1bfc5d2ba3bd98b93494a318c04bf881da656e1b3e51953c19322ab3b0bc2aa1b37670885b40e4c1cea88783539e75306b33441f39c39db22ebcc15aeabc0c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\packages\RELEASES

Filesize
83B

MD5
287f3e10e48ef7e4d433cfef59c06e3c

SHA1
5486b847593c9c4c64b49a08be33a676060c138f

SHA256
4ccc87d1785343fe65d58c02bd038a7df5969a3585c9b30226eef5f8edfe7c6b

SHA512
c4dfc482c77c9a543963866d7de076e386d98539c639d720d4bf2a3cb40447b4cfb7af874763bbd2d1b27f27d69cd39fb5285a7be06640337bf65ab31dda6eae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\packages\Teams-1.6.00.27573-full.nupkg

Filesize
134.8MB

MD5
ba6bc122457e167d0732855fa7f3d923

SHA1
8bb9594a32fb38007f172e9f18bd61a98ef27ee6

SHA256
c90cb9c1a856c2b99c429f6a30d9e5ef087292d5425409aa12b77f7dda6051b4

SHA512
d8a189f669dc3c6662b95a9ce4dbcc97ec8c69408dff235bf0eeaf9984d61ecdaf6448f4deeebba760cb23f479e2acabac660fef631e25c51e471765de02dc20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Teams\update.exe

Filesize
2.5MB

MD5
08a68041ab1f0499cad86b91ded91a99

SHA1
2b177b9ab61874657dab5edc36b52febda8ceab6

SHA256
d90cf72ef827d746dbc0037ff5bc7ecdb44b55c8bc65f4bb28495ca77c09d921

SHA512
f3315324aad32c51c1dc8e5b9ceaf3ddfc8157cafc41d4af12873783e8c3598d65b84cd2149fbf9b494c0047a4ca795f09010067dfe4bc8542ed6d4710f1506c

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
2.5MB

MD5
08a68041ab1f0499cad86b91ded91a99

SHA1
2b177b9ab61874657dab5edc36b52febda8ceab6

SHA256
d90cf72ef827d746dbc0037ff5bc7ecdb44b55c8bc65f4bb28495ca77c09d921

SHA512
f3315324aad32c51c1dc8e5b9ceaf3ddfc8157cafc41d4af12873783e8c3598d65b84cd2149fbf9b494c0047a4ca795f09010067dfe4bc8542ed6d4710f1506c

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe

Filesize
2.5MB

MD5
08a68041ab1f0499cad86b91ded91a99

SHA1
2b177b9ab61874657dab5edc36b52febda8ceab6

SHA256
d90cf72ef827d746dbc0037ff5bc7ecdb44b55c8bc65f4bb28495ca77c09d921

SHA512
f3315324aad32c51c1dc8e5b9ceaf3ddfc8157cafc41d4af12873783e8c3598d65b84cd2149fbf9b494c0047a4ca795f09010067dfe4bc8542ed6d4710f1506c

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\background.gif

Filesize
8KB

MD5
ff1f29dca0451246c3ca6cb7b023434f

SHA1
b26bea187f072d9a401b7fd06661492418b893ec

SHA256
753d7d351e427246e2b6cc86c45e21f952939e306c3eb2fdb1bd7d67842c64b8

SHA512
ad3d2bac2ada88cba32567a5c2dc67c7b4e3a0d0834c262e577dd77bf3b38cd60b35df72407cbea256343ced449d9c7c01d0a6ee58eb8d1188695359f47e15f2

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif

Filesize
8KB

MD5
3488a1749b859e969c01ba981036fab6

SHA1
a65b72461fa14c89fce0d025e43454830a1f7972

SHA256
c3fa333fdbce95d504aee31912993dc17ab31324428f557ac774f7e98b049b99

SHA512
7363003422bdaabb7943439ee1e846867f0f3d0baed3456424544a81989bd2d142a411cf982d90e4158314d410cd1a1a4ee33d8707219b4274cd2841705bcecc

Download Submit
C:\Users\Admin\AppData\Local\SquirrelTemp\endpoint.json

Filesize
80B

MD5
1afcc3a53b2154f10e73bb2e766f4e05

SHA1
feede5eb677d8659ef7824c3d78e32c1c3cdb9c7

SHA256
00d7742ca8257126b875ed941a04fd500111ec0ad557984d825619f09e93972e

SHA512
846ccad1e382f163af2aacfa7f428bc5c0e794bba734207a0875fdd94c3f383c0f7eb6093eeb289f251b84d35bfd0efb1819b9d61b0d1f34daf5b3911748787c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Teams\SquirrelTelemetry.log

Filesize
16KB

MD5
cddd0559796fe36f4fc5d0e246ed68ec

SHA1
58b995fef2565db5259078b61b6c808cce639699

SHA256
69191ca65f89693e0460f028457310bdd6b44b101920668e8ab7931b08f8705c

SHA512
71d2435c34ec645fd0f6d92ee1a494c9962cda4f91dd961858fa39281d4cbc49548f72bda9ede9d4cc70a0635d343778b19d2ca0bef1a7a686228f3f2597b6c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Teams\SquirrelTelemetry.log

Filesize
6KB

MD5
2b221847dfdd0787bb80e409d7c5c11c

SHA1
f1d3dcdb452076fed16a6fd130ae21d9987e2370

SHA256
2b1f0ba484c127d58150b13446d82eb479a86b24268f263c37ed571692fa1e6f

SHA512
4e23abb7b4aa32487801f3e6d4bb41e8c8b4455e0e691ce563166ed902224ce0fd24e51f58cacb9240d1d6d50cf3d5209d8a220a295bc50c2f7e3dc08e56d119

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Teams\SquirrelTelemetry.log

Filesize
7KB

MD5
70372d297ba0d887e6fc3c1b5c0eb8ac

SHA1
986daf4980624fba3376902cbd597df2c63ef6a5

SHA256
5abed006f6dc543a858eda175680347e0adfb364e2c2739036c027d40057c15f

SHA512
2f289c8777b571a79f33d316e2e1a685fb7e061f4faa925d7b10f242d9fcaf85422d84a3b358d43f3f8426e61da213d2a9f667884e2ea6baccb02cc8c903b9c6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Teams\SquirrelTelemetry.log

Filesize
7KB

MD5
70372d297ba0d887e6fc3c1b5c0eb8ac

SHA1
986daf4980624fba3376902cbd597df2c63ef6a5

SHA256
5abed006f6dc543a858eda175680347e0adfb364e2c2739036c027d40057c15f

SHA512
2f289c8777b571a79f33d316e2e1a685fb7e061f4faa925d7b10f242d9fcaf85422d84a3b358d43f3f8426e61da213d2a9f667884e2ea6baccb02cc8c903b9c6

Download Submit
memory/980-500-0x0000000000020000-0x0000000000296000-memory.dmp

Filesize
2.5MB

Download
memory/980-504-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/980-505-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/980-518-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/980-519-0x0000000004BB0000-0x0000000004BC0000-memory.dmp

Filesize
64KB

Download
memory/980-1076-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4272-30-0x0000000005B80000-0x0000000005B90000-memory.dmp

Filesize
64KB

Download
memory/4272-8-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4272-13-0x0000000006660000-0x00000000066C6000-memory.dmp

Filesize
408KB

Download
memory/4272-12-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4272-11-0x0000000005BB0000-0x0000000005BCE000-memory.dmp

Filesize
120KB

Download
memory/4272-10-0x0000000005AD0000-0x0000000005ADA000-memory.dmp

Filesize
40KB

Download
memory/4272-9-0x0000000005B80000-0x0000000005B90000-memory.dmp

Filesize
64KB

Download
memory/4272-28-0x000000000C5B0000-0x000000000C5E8000-memory.dmp

Filesize
224KB

Download
memory/4272-7-0x0000000000F10000-0x0000000001186000-memory.dmp

Filesize
2.5MB

Download
memory/4272-29-0x000000000C590000-0x000000000C59E000-memory.dmp

Filesize
56KB

Download
memory/4272-1057-0x0000000005ED0000-0x0000000005F62000-memory.dmp

Filesize
584KB

Download
memory/4272-522-0x0000000005EB0000-0x0000000005ED0000-memory.dmp

Filesize
128KB

Download
memory/4272-1069-0x0000000073850000-0x0000000074000000-memory.dmp

Filesize
7.7MB

Download
memory/4272-208-0x0000000005B80000-0x0000000005B90000-memory.dmp

Filesize
64KB

Download
memory/5916-1001-0x00007FFF15F00000-0x00007FFF15F01000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads