a6fe48609e883ccedff1a74986a61fdf9f3bbf60340384ebba8e28a03bbbabc5

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/04/2026, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SetupMT_V6_956.msi
Size 1.2MB
Sample260401-ydntvaf12m
SHA256 a6fe48609e883ccedff1a74986a61fdf9f3bbf60340384ebba8e28a03bbbabc5
MD5 010847b9d43887efa305e74cb206d62c
SHA1 2b69a993f17f07c78d724cf7849d30cf19efd3c7
SHA512 1b3e1d5c7bd015a2ae7b63b1a07adc3284b19c6a271693d102a119b86d29256ce20cb362b9364c5c535f77f4550c237b2e53aa2319746ebbaf37b45fb7bf6d49
SSDEEP 24576:sYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnkxYCX:vQSadD+RwsLdaCPNj96gGKbBm1mndCX
TLSH
T17945339B16508160D94B0B30825AD2ABBD3D6E47285A4684A1EEB7C81DF7F4187FF0F6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3672	msiexec.exe
3	3672	msiexec.exe
4	3672	msiexec.exe
5	3672	msiexec.exe
6	3672	msiexec.exe
7	4320	msiexec.exe
11	2052	powershell.exe
12	2052	powershell.exe
13	2052	powershell.exe
14	2052	powershell.exe
38	2052	powershell.exe
66	2052	powershell.exe
74	2052	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
556	powershell.exe
2052	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
3104	7BA4kZSxbZiE.exe
3680	Update.exe

Loads dropped DLL 6 IoCs

pid	Process
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe
5032	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Install Microsoft Teams v0.1739070300 = "powershell.exe -NoProfile -EP Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\BsJjNHUzai8B\\qw47xKGQUmfF.ps1\" kDgjKQoatYnbVGLPelzhRF6gty6mF2eQWyWtjLPD4RdOcTCQA84= kDgjKQoap+opxi3JADSfF6Z7NYhL+w=="	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
3968	cmd.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 29 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF9ADE70F05C4A2021.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF58394D5E28050AED.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9C35FC0B5BEF6692.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e586906.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI22E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2A18.tmp	msiexec.exe
File created	C:\Windows\Installer\e58690d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_2090742316\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF689DF1BE954F346C.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI216A.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF3BC3D39A63D1875A.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\Installer\e586909.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\e586908.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI21D8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e586909.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF881F2E7ED8616614.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8DA0F26E7B62EBC5.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2C5B.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{32CB9332-AAE8-4921-87DA-590B085FCD00}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_2090742316\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_2090742316\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\e586906.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6ABB.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B16558C537EEFAE.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3672	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7BA4kZSxbZiE.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000d3137aa3aa466ad60000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000d3137aa30000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900d3137aa3000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ad3137aa3000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dd3137aa3000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\user\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134195460979782170"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TeamsAddin.Connect\CurVer\ = "TeamsAddin.Connect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TeamsAddin.Connect\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00\SourceList\Media	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\UserEnabledStartupOnce = "0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.02603\\x64\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.02603\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.02603\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.02603\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\Registry\User\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\msteams\shell\open\command	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TeamsAddin.FastConnect\ = "FastConnect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.02603\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.02603\Runtime = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.02603\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\msteams\shell\open	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.02603\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\msteams	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS\ = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.02603	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TeamsAddin.FastConnect.1\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00\SourceList\PackageName = "SetupMT_V6_956.msi"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\State = "2"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.02603\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.02603\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\2339BC238EAA129478AD95B080F5DC00	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\TeamsAddin.Connect.1	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.02603\\x86\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID\ = "{EABAE40C-B27C-455A-B672-F234DD780948}"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4320	msiexec.exe
4320	msiexec.exe
556	powershell.exe
556	powershell.exe
2052	powershell.exe
2052	powershell.exe
3024	ms-teams.exe
3024	ms-teams.exe
3024	ms-teams.exe
3024	ms-teams.exe
4320	msiexec.exe
4320	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
4316	msedgewebview2.exe
4316	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3672	msiexec.exe
Token: SeSecurityPrivilege	4320	msiexec.exe
Token: SeCreateTokenPrivilege	3672	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3672	msiexec.exe
Token: SeLockMemoryPrivilege	3672	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3672	msiexec.exe
Token: SeMachineAccountPrivilege	3672	msiexec.exe
Token: SeTcbPrivilege	3672	msiexec.exe
Token: SeSecurityPrivilege	3672	msiexec.exe
Token: SeTakeOwnershipPrivilege	3672	msiexec.exe
Token: SeLoadDriverPrivilege	3672	msiexec.exe
Token: SeSystemProfilePrivilege	3672	msiexec.exe
Token: SeSystemtimePrivilege	3672	msiexec.exe
Token: SeProfSingleProcessPrivilege	3672	msiexec.exe
Token: SeIncBasePriorityPrivilege	3672	msiexec.exe
Token: SeCreatePagefilePrivilege	3672	msiexec.exe
Token: SeCreatePermanentPrivilege	3672	msiexec.exe
Token: SeBackupPrivilege	3672	msiexec.exe
Token: SeRestorePrivilege	3672	msiexec.exe
Token: SeShutdownPrivilege	3672	msiexec.exe
Token: SeDebugPrivilege	3672	msiexec.exe
Token: SeAuditPrivilege	3672	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3672	msiexec.exe
Token: SeChangeNotifyPrivilege	3672	msiexec.exe
Token: SeRemoteShutdownPrivilege	3672	msiexec.exe
Token: SeUndockPrivilege	3672	msiexec.exe
Token: SeSyncAgentPrivilege	3672	msiexec.exe
Token: SeEnableDelegationPrivilege	3672	msiexec.exe
Token: SeManageVolumePrivilege	3672	msiexec.exe
Token: SeImpersonatePrivilege	3672	msiexec.exe
Token: SeCreateGlobalPrivilege	3672	msiexec.exe
Token: SeBackupPrivilege	1144	vssvc.exe
Token: SeRestorePrivilege	1144	vssvc.exe
Token: SeAuditPrivilege	1144	vssvc.exe
Token: SeBackupPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe
Token: SeTakeOwnershipPrivilege	4320	msiexec.exe
Token: SeRestorePrivilege	4320	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3672	msiexec.exe
3672	msiexec.exe
3680	Update.exe
3024	ms-teams.exe
3024	ms-teams.exe
3024	ms-teams.exe
3024	ms-teams.exe
3024	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3024	ms-teams.exe
3024	ms-teams.exe
3024	ms-teams.exe

Suspicious use of WriteProcessMemory 27 IoCs

description	pid	Process	procid_target
PID 4320 wrote to memory of 4592	4320	msiexec.exe	83
PID 4320 wrote to memory of 3968	4320	msiexec.exe	85
PID 3968 wrote to memory of 3104	3968	cmd.exe	87
PID 3968 wrote to memory of 556	3968	cmd.exe	88
PID 3104 wrote to memory of 3680	3104	7BA4kZSxbZiE.exe	90
PID 556 wrote to memory of 2052	556	powershell.exe	92
PID 2052 wrote to memory of 1164	2052	powershell.exe	94
PID 1164 wrote to memory of 1616	1164	csc.exe	95
PID 2052 wrote to memory of 2100	2052	powershell.exe	97
PID 2100 wrote to memory of 1444	2100	csc.exe	98
PID 3024 wrote to memory of 4316	3024	ms-teams.exe	103
PID 4316 wrote to memory of 1064	4316	msedgewebview2.exe	104
PID 4316 wrote to memory of 4464	4316	msedgewebview2.exe	107
PID 4316 wrote to memory of 4464	4316	msedgewebview2.exe	107
PID 4316 wrote to memory of 4464	4316	msedgewebview2.exe	107
PID 4316 wrote to memory of 3980	4316	msedgewebview2.exe	108
PID 4316 wrote to memory of 5048	4316	msedgewebview2.exe	109
PID 4316 wrote to memory of 5048	4316	msedgewebview2.exe	109
PID 4316 wrote to memory of 3088	4316	msedgewebview2.exe	110
PID 4316 wrote to memory of 3088	4316	msedgewebview2.exe	110
PID 4316 wrote to memory of 3088	4316	msedgewebview2.exe	110
PID 4316 wrote to memory of 1276	4316	msedgewebview2.exe	111
PID 4316 wrote to memory of 1276	4316	msedgewebview2.exe	111
PID 4316 wrote to memory of 1276	4316	msedgewebview2.exe	111
PID 4320 wrote to memory of 5032	4320	msiexec.exe	114
PID 4316 wrote to memory of 916	4316	msedgewebview2.exe	117
PID 4316 wrote to memory of 916	4316	msedgewebview2.exe	117

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\SetupMT_V6_956.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3672

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4320
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4592
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\7BA4kZSxbZiE.exe" & start powershell.exe -NoProfile -WindowStyle Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\qw47xKGQUmfF.ps1" kDgjKQoatYnbVGLPelzhRF6gty6mF2eQWyWtjLPD4RdOcTCQA84= kDgjKQoap+opxi3JADSfF6Z7NYhL+w==
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:3968
- - C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\7BA4kZSxbZiE.exe
    "C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\7BA4kZSxbZiE.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3104
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=7BA4kZSxbZiE.exe --bootstrapperMode
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:3680
    - - C:\Program Files\WindowsApps\MSTeams_26043.2016.4478.2773_x64__8wekyb3d8bbwe\ms-teams.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26043.2016.4478.2773_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.7.15&instExecTime=1775072487880&launchSrc=t2installer
        5⤵
        Adds Run key to start application
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3024
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26043.2016.4478.2773 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,BlockCrossPartitionBlobUrlFetching,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=3024.2248.9669812746968295301
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:4316
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffee345b078,0x7ffee345b084,0x7ffee345b090
        7⤵
        
        PID:1064
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26043.2016.4478.2773 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1696,i,13948064274864871093,5910157181909636953,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1708 /prefetch:2
        7⤵
        
        PID:4464
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26043.2016.4478.2773 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1868,i,13948064274864871093,5910157181909636953,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
        7⤵
        
        PID:3980
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26043.2016.4478.2773 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2284,i,13948064274864871093,5910157181909636953,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:13
        7⤵
        
        PID:5048
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26043.2016.4478.2773 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3804,i,13948064274864871093,5910157181909636953,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
        7⤵
        
        PID:3088
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26043.2016.4478.2773 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=4108,i,13948064274864871093,5910157181909636953,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
        7⤵
        
        PID:1276
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26043.2016.4478.2773 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2148,i,13948064274864871093,5910157181909636953,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
        7⤵
        
        PID:916
      - C:\Program Files\WindowsApps\MSTeams_26043.2016.4478.2773_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26043.2016.4478.2773_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID 2059cf7d-08b4-4706-8f81-46bc9f0ddec7 -Trigger SchedulerDirectLaunch -BgTaskDelay 6900
        6⤵
        Checks processor information in registry
        
        PID:2692
      - C:\Program Files\WindowsApps\MSTeams_26043.2016.4478.2773_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26043.2016.4478.2773_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 2059cf7d-08b4-4706-8f81-46bc9f0ddec7 -Trigger EnsureTmaAtStartup
        6⤵
        Checks processor information in registry
        
        PID:3356
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\qw47xKGQUmfF.ps1" kDgjKQoatYnbVGLPelzhRF6gty6mF2eQWyWtjLPD4RdOcTCQA84= kDgjKQoap+opxi3JADSfF6Z7NYhL+w==
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -WindowStyle Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\qw47xKGQUmfF.ps1" kDgjKQoatYnbVGLPelzhRF6gty6mF2eQWyWtjLPD4RdOcTCQA84= kDgjKQoap+opxi3JADSfF6Z7NYhL+w== oEhMxOXpu5K28kKn
      4⤵
      Badlisted process makes network request
      Command and Scripting Interpreter: PowerShell
      Adds Run key to start application
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2052
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\wacn1xfi\wacn1xfi.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:1164
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES720E.tmp" "c:\Users\Admin\AppData\Local\Temp\wacn1xfi\CSC54E20EA8AFBE41498FB7C1B12A72DB4D.TMP"
        6⤵
        
        PID:1616
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
        
        "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\23tm5rzm\23tm5rzm.cmdline"
        5⤵
        Suspicious use of WriteProcessMemory
        
        PID:2100
      - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8C1E.tmp" "c:\Users\Admin\AppData\Local\Temp\23tm5rzm\CSC8CB2A1E4D1904AFDA0BD3DE567F9DB.TMP"
        6⤵
        
        PID:1444
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 76DAFD376B89CBD7322794E8CB60EFFD
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1144

C:\Program Files\WindowsApps\MSTeams_26043.2016.4478.2773_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586907.rbs

Path C:\Config.Msi\e586907.rbs
Size 7KB
SHA256 8f61950ab86b48381407ba2843ee4593659fdee096b0b2b528a2dcdeaf55f795
MD5 8cf99ff827b0dbdfbb10cb4c76be527c
SHA1 d2c36e17a5e5eb8d5f841fe4a7c92189efc14aa4
SHA512 4c4e54e96369b8437c1356cbe0bdb0b91c09ac1743e4bddc4fb47cc2d2a4ebd752a120815c6dcbf1ba9a2dda9de4329e9614c898b14875ad1cbe0ac4d049db99
SSDEEP 96:n1A/qWLB7CXprpk5Urew4COThq8Urew4CgjpRoDplpXkThqhHfQX5psnWpPpmpzz:n1YC4yrpPGurpP4xpAiVpv/4
TLSH
T1CFF11F423621C5F3E8A90734C74B5BA53BB3E3CC6714234B1ACD84645F6378C2ED959A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58690c.rbs

Path C:\Config.Msi\e58690c.rbs
Size 344KB
SHA256 78b02988a5197e941beed6646153c75305470fb3afb7ecc30fa657b0eb9da978
MD5 d180cf56487e92520f7cc537227e6265
SHA1 14e043761796c79f9479a156c4f4a79cf78c6910
SHA512 821da6e72579df2915121ba6a95efc6770d237e1bd0fea89a1116389e89c38c3eb6c16e8e1d9d8576d4035f8cf0eb919f4af36a41737f872e3f94d77231c73d3
SSDEEP 3072:SeDzL+LRQH8vtCJfhX2mSrx2KHq4TTXM/gZ9RQH8vtCJfhX2mSrx2KHq4TTXM/gJ:SeDzmwfhHkLqa+gnwfhHkLqa+gJ
TLSH
T172744B12AB41DDB5D07C353202E17B9D743EB6630AC2BE6F8700DA680F567E8F719A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

117308CCCD9C93758827D7CC85BB135E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E
Size 913B
SHA256 c29acc834d3544f1755c29180dec553e56414b75324c001b304a785d4180c902
MD5 34b11e80d455a6480555a14f7eae9dae
SHA1 9809552a1cd33126fe363361f9b0e48246522932
SHA512 fbc98a83c10544b230afe0e31ad34b399be1575c3809084b032279f4561c31001de1be337fa226324618e2976956b5be1b48c4b224197b168e5d6c2acbfe6323
TLSH
T19811B716095451668D446FE4DF84CA8FECB813921700D67EC0DA69E71837F71CB0008F
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A
Size 2KB
SHA256 c32b050710dfa4183bc0d48181128ce1266d5498ee0eaaf63c34ce807074da76
MD5 dec172292ee59b823420010e93cfc70c
SHA1 6e1a9df6bc36f7c7bdab6eb42187b261e129c581
SHA512 c4e770992a73dee1d7d8ff666edabc45cf9bb85ed93be45aaabca2cd268b9e746c98368e291297dac17a1cac0ad31fb7b537bdcfb8f717ef93a395049ee5bb11
TLSH
T17F513DCE5365308388138D52CBF8EA7EBDB807523A969117507DB30D04A7FDFA718899
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8A7891822FCFF127E4EADADE9757112B
Size 1KB
SHA256 f913d903b23dfecbc9754f1ddd9054ff5e4494a78f3efd860788fab8b6bbd3dc
MD5 542ed9532b0b60744697fe7ac853075e
SHA1 26ed15e25cdfd07edf4d0be61da90ff0c8ff0926
SHA512 0495d61bdda53134e99371b7b4776b431c6d5a02f4750173eae3477e5c938889735d258d4697f93faa86d25f82a3c025a6d4326a20724109f5f469d72eab2600
TLSH
T1FE2186591D8C2553B8483E35D8C66E578EF0D1901BC0C88ECA508A465872FDD9FDA4FA
MD5 SHA1 SHA512 TLSH

Submit Download

94D97B1EC1F43DD6ED4FE7AB95E144BC_8B3A641C7B54B7B627ACE91D11602468

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94D97B1EC1F43DD6ED4FE7AB95E144BC_8B3A641C7B54B7B627ACE91D11602468
Size 2KB
SHA256 1dd210b79bdc2a884982db680b501c13c463015d227bac28efd8ead4c9b90d33
MD5 da97879c60ca7b2d0f4a16aa0676e139
SHA1 7f0df699e4c535415a2425705b3c043e5176df49
SHA512 8de125b7761898bcb180bfa82590b37c4f6c7b76d8a42112f59593b0b8126aecc58394fb9521b76e59819d780750e25cfa3ab5832041d32cf906237e29658d5b
TLSH
T1D641C9D90D105481FD01AF4BC4E4CDD7286406C755E88486E8B4B2AA30C9FEDAF46016
MD5 SHA1 SHA512 TLSH

Submit Download

117308CCCD9C93758827D7CC85BB135E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E
Size 348B
SHA256 70c0430b53fed8b1c856a63edce49adb9f68fb556347d548073a2f27dfe98930
MD5 ada8b8b03de99316efd4e165a32807e5
SHA1 41467211a4f894eba2f71dc1d4541ab4abc08a07
SHA512 aac0bb2b0fb17ee0662394918769fd520d3a7e511c1de83108f0fc44d907a4918a3c9d849d2a4eb80a763d027b2c45b0b5ff36ffc0255a05be7bb6e0a0cbee76
TLSH
T144E0EC09E3FD4A13E999C67A58E53913A9767D11B925C28912F9970C7524E117C30713
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 6320b8dc15e45197e609ee004f88ddfc74a46b1184f2d209ccb84c78e308aaf6
MD5 deafc4afa6cff9169ac8fba06614f365
SHA1 b44cc0b1cc058ed81f79f09512e383218f8d83d9
SHA512 5ea90862b3afa3df07420c9b87aec229867869728fae3a1fbd86d7ce6ed793855a572c3d9a26998acd3a460a74576ac6814007310653b03ae3bafdccd20ef11e
TLSH
T15DE0C2113FE80314F6330A3C7973A444A9BBB727AE50CADD0275208C0C24F91883731E
MD5 SHA1 SHA512 TLSH

Submit Download

86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_44AD5D0C299F1D4EE038B125B5E5863A
Size 560B
SHA256 d33234493fd09c001a8e22d01d3dde3f252b9aeea1fa84d38d6dd37e79d5bde4
MD5 ba91c30e549c174dc2571e457a55d5e1
SHA1 aee62e44442120d12ba17ed8c37a66fe109179a5
SHA512 b6409532ceac17193a8459e86fd92e93e643650164a8b4b455cd3b9c28405246d7e7cfe24740f390b486a95f4e0ca83e6ceea843ffd9e43876dea9b656371c6a
TLSH
T15BF09E3829FF020AE3759974CBFD5F8EAC2DB01378156A1C009527665803F83AE9232E
MD5 SHA1 SHA512 TLSH

Submit Download

8A7891822FCFF127E4EADADE9757112B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8A7891822FCFF127E4EADADE9757112B
Size 246B
SHA256 4cf5c6da1a4d6404cb43159bec0d5e3ba951a5b959027b0cc8cc1cd79ef64cfe
MD5 b996a6464b1ff62850f7fc5d64c415a5
SHA1 c7ce09448644a60f20a498940cfe5f736e701f8d
SHA512 1f91dc59a55cf38ccf9f6e15ec06936a0e1d669cc5eb391c7c8dbfcc15fb06190a7662c1e4de80b978761d787da096c158304a40c4670f8b0e8e4ce73519b149
TLSH
T101D0A960AF785216F1902B3A1C308780FBB4BB21A102CB0901A9068A4830F000C6292F
MD5 SHA1 SHA512 TLSH

Submit Download

94D97B1EC1F43DD6ED4FE7AB95E144BC_8B3A641C7B54B7B627ACE91D11602468

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94D97B1EC1F43DD6ED4FE7AB95E144BC_8B3A641C7B54B7B627ACE91D11602468
Size 556B
SHA256 d25525b0d82cfb05c7683dbd2ea0207e7b7b9a832e12c12f2fce7ec0a9e9af51
MD5 60d1f7f85224450b11e02ccfb2cdd7e9
SHA1 b592e461957548ecf2d34b1029c3d846607a22d3
SHA512 6089894294d2def643ab460a2a041588042bbe1251890f63f165c9d56684ad1554c5cb99652fa06bb6d5cc3b7e7fbac8e5acad6de61e87c42653d11a3ff5541c
TLSH
T12CF09E383AFD857AE1719E39C3DA57BBACAEF12130464B74629007411D53F025E0222E
MD5 SHA1 SHA512 TLSH

Submit Download

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 3KB
SHA256 3c6653b1c284b476d60cf77477c9f34967cd5c1dfe79ac68e657a79e38238f69
MD5 777f5ea087846574f07a8074e955253b
SHA1 9f97f8110c2d74e1ecd4fa037554778547073b7c
SHA512 d7175bf01b3c5069b15b8107a3cb6860eb7ce35ce7380ee9a7e9ce37c9875ad5c6321c349a93ef62d1ebaa08346a31ae7d40009199f16ebde46f6dfa2e939028
TLSH
T17971DE313275B1D8C9167F07192C19C423BF8356EA94AF4CB658624ED92744B9F232F7
MD5 SHA1 SHA512 TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.02603\AddinInstaller.dll
Size 35KB
SHA256 b64410209f74a4907050eba51aa7beae7d44181833c1188707e12b7f35b21f5f
MD5 70cf2a27795789ca87601d78d6e92381
SHA1 00826d7646f7252a815a3e47bdb939cbf0e4c6c0
SHA512 f89592e124bdca6a469b78dc174eaec8b219e11774550945ab3abcf275a02cb19cc573cf3fdff8841db9255d1ef1bda865ceba519947425ead610dd906f36a5f
SSDEEP 768:FJLGIDER3wlJ0JFVbde6oM7N9zdfF9zUiy:DtARglJEVc61vzd/zFy
TLSH
T117F21790A7E84107FAFB6F706AB4D5422DB9BFD76C70D92E1588A14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.02603\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.02603\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftTeamsMeetingAddinInstaller.msi

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddinMsis\1.26.02603\MicrosoftTeamsMeetingAddinInstaller.msi
Size 14.0MB
SHA256 6e9c6a401e1ee620844c4de70039eaf5a742d6135116d7cb0da68aba7ab6bdff
MD5 5136a4b24881d82b14b6ad90c0998407
SHA1 5099feaa8e8ed73d0fad70d9640a15faa69d107e
SHA512 df31a891fb349791f27b82665c4e23808687cc0dd650c7bffecc342fa7f17090f6db83226eb9f4234fd3263577c1893fa61256b28eef6b92d20b2c746751e8b2
SSDEEP 393216:aHsT1t8fDI8HT0qCT3r3dbB05DERdWOqzRTirUg:T1q0Zr3zOmdWOwi
TLSH
T16BE633833A8BC533C12F09341AB9874A5F3E7E715EA18487A365B64D2C722D113B9B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 2112d4a2f4e2969b5fcb05bf01410499cf39b969c39ce427a4d776db4281c107
MD5 a4177caee531c798b1e2f9d3d1982d4b
SHA1 70d2567468c4396e5aed4865c4b41896fea8e4f2
SHA512 8f3b0723e17becccc49a10db17814dd26e91c347047bb32bd421010f37a5582f08b26564a7aea969278cab11f427d8abee5d41ca70197e3e983f75f3bd35dc0a
TLSH
T1C9218437B3ACC139C89911BA208CAD11B1B1C7C7449E8E8B6A84D508E17F99ADB641E4
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 116092aa076f95d68593cbed44d46597a77dcbaa628b9395c6930a6dcd498c4a
MD5 29a0a8a1aad2fa6614e27b7bf12b4330
SHA1 0451bec9b41c1d6337545ac51158c7b7d2927685
SHA512 4d8e897cb5fe10b777c8fd59374c52cc6c7360b4b7a68dd1ba1883554b1a2c04d8a4f84ba2e236efb1dd4a4127f7af89a013dd1d57bb8f0dd0700912ba543129
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 e0a4d77eb2809d7725e6da0e0573df5b8f35c4b7cf5a3441f64d21e5d990c301
MD5 e1ee92f89cca5558d388b8a0d3f74a82
SHA1 c5dfd90c85f338810de68c0547834239786ffc91
SHA512 d6c0b83074e189f4d1880dda530ab8d70256827468d7c1cabf3c755360fe86322311389da69fd4a64ae8ac4a9afde3ad141093b391595725cce6661eeedbbf35
TLSH
T109D0121236420174C41139731452614849C0C60B4209804C7C2D95AD1BC80541B12855
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 8d549e530b29c383b96b5b677f9f77a8de7a05972723eea56264391404a6681d
MD5 1bb6b2661a9e02702e3f72ecfd2d812f
SHA1 589f039385b77070c59aac428529370c80bfdb20
SHA512 8e832af6f8ec3ba1513d9804b7b900cf9d6153f261ebc11c8e5425c87bedc7a915d9daa56271f91adfd00a86e7cf4a9ea04f1d5624989136aa8d23dcb6bad384
TLSH
T12B51A733B85877B748D39748B94A7F13AE35506589922FA4A9ED0B1C05EB69D1307C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 88ababea6bb9ffaee307fdc240568e885ee95436edf9f06e239ea832117588ed
MD5 1720767edfefa687eb383981d88c9bd7
SHA1 13cf185ed84570194d13104bf5c1f7cf7902964e
SHA512 ec3bf0d65ab0c559f9866002cd71d2ab760f6ce67d6b037104d4c3d597523ff1d286b46a0e5ba7fdc7b7bd089f649ba7de5933f076d84e56ed9dfc7fac7253d5
TLSH
T1B3717336A568A6774DE3DA44B8863B03BA655127D5953FA8D9EC0F1C05EB7981302C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 8a973ec50476731ab2f9c328bc53f3aab44d22fd2a4c15752619a384aaafd3d9
MD5 eb3f03a60b482c53bce553042c59ed3e
SHA1 a36a1c90fcf03b5c6db9c79713ab45108c09efd6
SHA512 8b1680c8d3ab470e2c67b3600ad83e693bdd521868ff237de07a042925f4baa368d56f8f4160ac7e769741f789e1dca6356fddba9c983ffe5f1a962f3e354314
SSDEEP 384:zAgfRE5BdEZfr0kuh9Rt/nP9yxNbJKahqs/ZVuZQz:MERkurqhNscnshcQz
TLSH
T1E3729D238634A96B6CE7850A79096B06B5F8805A95D23FACA8ED1F1D0BD77D50353C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 1KB
SHA256 25656898b0abdbb0fbcf9c3947e798364f46e6de4cbbe1a01f0ee12404ee4f04
MD5 597928904db395b81bf675fc7542c303
SHA1 22444e67a05fba29e6891357b7951375b7a4e7e5
SHA512 f4b5782be0090f0219a38815ee259ada31fa825c81a3d547c411abab3dbb8ffcb6e9debc299e74f7167765128bda1f780f8012d817ab3488cb168d714966a7c6
TLSH
T198316573E0A43BB76CC2A795B556BB533E20506A81515F88A4ED4B1C06EB6CD922BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe58e104.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe58e104.TMP
Size 1KB
SHA256 36a9df19c7e89ab7faca0c72280c32bb84cef13306bece92e9f996f8d34119e9
MD5 9e5ab9303e00f54b67d00c353f553603
SHA1 0bd796e9ad14bf5bb820ac810d8f0c9e38db3130
SHA512 74793331a30f340a4c869dbe88db08c06d2cce5d01f05c2dd5f53bbe20de8f90de0eb05da3ca1f4e368187ae3cf9263f682f51faac74f67f924811606f6c8c56
TLSH
T1D7216273D0A83BB76CC29695F552BB833E20506A45519F5CE0ED472C06EB5DD822BC73
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 baa71e8310824b17a99045d66c92dd8a04997a4665ceecf14f4da12f8ddc0a80
MD5 9d8f04e15d2bea9ad4443ee7c063ece1
SHA1 c7de09feb9c54456d5ea2e9802bdad38d0fc5106
SHA512 6f1f72a214b567dec2d1be3dc77d57b31702a20e12ee4fe0c62513529485bb6961c8c03e086b62aa862f0ef904385e9290795731a2491550fbb69932b3a0b125
TLSH
T1D841B8A6D1DC0449CFD1267362A3DC302B1969983DCA174F4795271D052BED6BACF90F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594462.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index~RFe594462.TMP
Size 48B
SHA256 6ae2d622ca9bd6f3c394faa3b86bec0916b92e53dd27adfaaad48598f5a1b205
MD5 118805b6bacef10e85952bc9aa71395e
SHA1 440f2840db6480be2d1299005987ca19b6a178ba
SHA512 07b05e2546436eabb4b515763108e7455a7b4c015b5efc9ddf470bae3eb493340091a4a05349d5ff86c551c440de9543cb16c404254d3fd6f4cd53798d5446d1
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnGraphiteCache\index
Size 256KB
SHA256 403877e1823888aeb9fb9a88006f8caedd44a3adb0674992071f3060575f22d6
MD5 603a10753c233c221efd07497ad09d70
SHA1 cb2b9ad3e6b8b96c22b710c08ecdd24594870f82
SHA512 c25db971636213ebd26379c80c7364d9f45eb87f3aad676f141d9780135bcb6c2068cad472b2d8cbdf4b4de232d7cdd1745e8369991f3bf8c8d1f90d67160440
SSDEEP 3:LsOllllkll/lE/:LsUlEt
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 537B
SHA256 4cb55adbc78eb41b1dc7150038bc426a2ffa6e9be616dabebca90ef2aab9d268
MD5 322fb4ad2c30665453b428370c583468
SHA1 3f9074f85923e9f97cc259c0e05da9b31feb746b
SHA512 031e004907ee24bda86a9fdfcdc3d43fb566f21d6850a74b7f6ef8cc2cabddd4412ebe007eea0de64109d82333f8908954da7b232107ce8dfd837f743297be2e
TLSH
T1F9F046B7073018AE8A4482E41A18DE1BEE6C0153030C68788684BE73D273062E006647
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences
Size 6KB
SHA256 6923479c7be68002b7f2ea14b390555bcba5334d6d40caa43ed861bd94fc9294
MD5 138f43ee47f445b92c5f729bb5ea2284
SHA1 f5e6545bd2676016e4193d2501a1e1d84cc8496a
SHA512 69b91ebd6e34277a22e339eb9880177f03829d919728e108f5f9efe40295ab37fe3ec832d31feaa71a4abb41607bc09ee2891a61fb4f12548ff6292abf45d1d9
SSDEEP 192:stjpHo/OfUZ8padU/S+WiF63c9wd7GpOMC:sttI2zn/VTweC
TLSH
T120E195079E7879B78CC7E219BA25FA16E2F5502255C00D98EFFCC61C08E76DD620785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe597f0a.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences~RFe597f0a.TMP
Size 6KB
SHA256 0c0d265372cc6882ae7e54b83a037e712daea9cf876e9dd7fdae613cfc6f0544
MD5 800ec8f6071aac8a94adefe90eb71988
SHA1 d4917025be9a3ff0ede39faccaf85e11ceb5db9f
SHA512 dbffb8fde7c6fb40e444c7fcfbe1c65b1637c7073ef009c9bdfe07a9079bd0daf4d61239a092b2bea953d56f59ec4736e4952f4bb504110892ab24bc297bc1bb
SSDEEP 192:stjpHh/OfUZ8padU/S+WiF63c9wd7G7OM8:sttB2zn/VTwW8
TLSH
T1B2D1A5079E7879B74CC7E219BA25F606D1F6502265D00D98EFFCC61C08E76DD620785B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7983e424-0f3f-4bd4-95d0-7b0fa0b1b681\index-dir\the-real-index
Size 96B
SHA256 e88aeb3737d3bfc221311336c550c372d607f3e7172cfd960390b97413d098a8
MD5 e0a2a216b2dd48ef514de361a02b5712
SHA1 48661aa032221d237edb8c8a952771ab2126181d
SHA512 9656b57dab0f3bb9cdad0eb89069246e0d8ee151f2939db3194c625a99685dea8ade6a59e233ab63b6463d6d117dbe6566e6e2571da857ba86ec2627c39ac34d
TLSH
T130B0120402204126C00403BD00C642D4623C0F5682A202025050A364FC541214001154
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593e09.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7983e424-0f3f-4bd4-95d0-7b0fa0b1b681\index-dir\the-real-index~RFe593e09.TMP
Size 48B
SHA256 916d02645b7d0b63591aaee367d95033f285d7d8524327fddc58a20595454fb2
MD5 a627d9724dcc0b1924e6a9d14192a480
SHA1 993aad8bf9e9da6fc6f6296c36002ac73220319b
SHA512 ae0b03ff1e9bb04e6dece0840073f3b93421a4d7402c05ecd768b5f99db364edb9ddd6dfe14c42be4721ce6c1136b24689c57efd25fd56285435319141b78f4b
MD5 SHA1 SHA512

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\d3673a31-7a41-4b9f-ae5a-c1862bda9325\73cb100cf1fe8262_0
Size 2KB
SHA256 cbaac86af181e2ad850a0086f1ba3768ee39d1d8713ca6bc13c06d36663ed66d
MD5 3de528b8f542b6c6cedb81db90089d50
SHA1 b0ec4f7bfbb7f08561ad7075f2ec5d35fdceea10
SHA512 5b9110d886faf04accab0be42fb5153d2022a5e710cab4f386944cccc1727d5809db7f98e3eb54a0035655814c4249e97e52330d6c3adb668f20dec312693748
TLSH
T16441E91744000C5FDD829D78500E1B7476EEAB31E9CDFCDBCDED0D38492A4DA652E821
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\d3673a31-7a41-4b9f-ae5a-c1862bda9325\73cb100cf1fe8262_0
Size 2KB
SHA256 6e65156274102a054d86263af4e6db410251aeffa6d07d6aceb1fb617acedfeb
MD5 c3394ba10552cbc1543624a3db2ba107
SHA1 f4641bca6219fbb35c5c5b8cfec0c08a82733d87
SHA512 5205d7b8df282fb68ac3fb541075e7cd350f34ac1ef4df2bd3df7861e64abb5285c74f0ad28907003b1ce0b2e44a86889f5207602024684956e818d11d70ae00
TLSH
T15941B65745000C5FDD829D78500A1B7476EEAB31EACDFCDBCEED4D38492A4DAA52E821
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\d3673a31-7a41-4b9f-ae5a-c1862bda9325\index-dir\the-real-index
Size 96B
SHA256 76c75e06c1cc520f8bb5568d989e89e61b0a7c9c4010d5ad3bc8c891d928f84f
MD5 efd29fb69a43e83485acbe8994f98e05
SHA1 03ffec2a03cfabb0b3422deb9c4093af0570136b
SHA512 fd1243c3b37342031cab6bdd46522bcc41c5aff7857122ff6865dce5e4c6485ec58ec3c7b262893c8b7396824ae9abf77d865969af9394299438cda73a401885
TLSH
T174B011B0A800822AC00002B3808202A0333C0BBA020302280AC00222C8322800200020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe593f22.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\d3673a31-7a41-4b9f-ae5a-c1862bda9325\index-dir\the-real-index~RFe593f22.TMP
Size 48B
SHA256 1cd1e0641a7e2734110bec0ba07047a503feadfca9d15403da7a3ec2a2c88bfe
MD5 a050864e97a4e7ac05c898c54c595483
SHA1 ef63c70520ab5b1d7df5ba202ced377f2999656d
SHA512 f603c332fbbce5656472c48b51377550ce176950e0a81fe4b215217ba6d4015ca08a5b4fa4c90384407ff3f1f940aa3193c7b6fe0563d94fea448a6ca92e7ebc
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 79d142488b2187f50f3f16c7fde10248dc901d770a8d43f7396a68885cf9c2d7
MD5 55f5dc247a1f4c7da6310a09d5a98c96
SHA1 056c0b10ecdb52198612155be60b349242b13a7d
SHA512 afdbbaae26f3f674fa406b323bc192555e74f896adb09ca361c3710ce474dcd335b77087cf8fe86b54fccf364df489d117131103477fa32f5ec1945094cd89b8
TLSH
T1BED0A72E829055255F4D9293A0C0F05350684C17DAD9F184EE8B7455347F6D257034F4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 dd6d6576e72ca6302af5c7a1e5e63e90a1fdbc0add5c6ff58c90999b6f33877f
MD5 3ddf990699ff94bff2b968b6d5362faa
SHA1 7dd8243d02fd27719f81a5b95d45064343fefdfa
SHA512 1c5b56794382af2ae54e2c0718995a04d6ed607644cb6737e19cf4c4d1dcf6333b5045082bb5b91f431f83353cadc9c99419ec490a97283f493e25c48b24f43e
TLSH
T185E07D1F424005355F4D9246A4C0F19340288D1BC5C5F140AA5A74443C3F6D15B034E2
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 8f262218bc97720e3b3c8c25f1a8ee248e4d3856efe0e5e197c32ebb1d852a46
MD5 c149511cdbb8fbc8685da5d7a38fc484
SHA1 25cdba62c5c400f731066c3322134193706aff98
SHA512 aeb22733df962c7956c390f6387e62256d8e031415d509c00bc16c4e45939aa5e8f68174fc8a4e6d44de902e18a7fed3c49cfa93571f4721d20d295a682f2019
TLSH
T1FED0EB1F8640093A0F8E934678C0F1A75168CA1BC2D5F180EEAE48082C3FAD12B034F3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58e6f0.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe58e6f0.TMP
Size 141B
SHA256 7ce990e2db7b499cd0a794e87ecdc296cb6823d966a6bf1afde67c41e72c73be
MD5 515ffae8776ca209a93f832b8cfe0551
SHA1 8258543fd5f0e0590d0c65c4d64175f21761ef8b
SHA512 efbe305e837828146e701a0192b1cee1c47b07f7fae045b675fade01403abca736ae7657435194c54958058d9347114bbf8db7dfbaddc95e6208ed96202aaceb
TLSH
T16EC02B2F42000C021B05629290C0F163905CCD7FCC41F084918E3045243F3E7A7031F5
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-04-01_20-41-45.00.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-04-01_20-41-45.00.log
Size 2KB
SHA256 05021aa81fd57830867e43cf2ed4284ee87c0b49d9d3f03f17080ed777e6f11b
MD5 e73d4a5ae3572f089412a668bc960ea8
SHA1 b4e068d30544cd6462fbb21cf9533dd543c34451
SHA512 4c2cba5629642900c9d4adf67a7cf4ca5a422646902bcdd2f8e636cb8a74d1eef4b2f1a6936a9d8642b16db76f8761ad59c3c79048b0df33d25e402428df2f0e
TLSH
T1AB515960229E44A4E00A2546D8253E98CF6FB14EF7E43076BFB2BF5643453247BBD61A
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 10e1cda2b663a7df7623e6abe486288c5da61e8186688bac07985ae7affde72d
MD5 dd2e3bf8a979f06cc7b15577381c1ef6
SHA1 aaf69ce67b3caed0fa41a0d01a59572c38703fdb
SHA512 286ca7e3ab0552f9328f38c7474e799b6e76e6382dc3c637bd61933eb87f1b21bf72ba190c578dd5ba32a656bf08ebaa87aa7b4b813da615d0938f1010edfbd1
TLSH
T19C51D42C0514A1BEDDC7864BB54F3E238AE701A4EFA67BD6ECAC1C1C15821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe58de16.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe58de16.TMP
Size 2KB
SHA256 d0288462f0cdb0be8ea78f3e0146d237523f4cf5044a74a7678363fbb5562c9d
MD5 5e1837db8fe3c5189f8b1f869b8da558
SHA1 aa6912f04df3228f4db7cddaf9eae8200ce07624
SHA512 6615068ab2d3a909ae2cb52cb3695cdca4d23405ea123046b152581f5ba33252985aef2026d2929e8ffc23ccb4b9acb996716f3dba4822e44ffb665649064cd0
TLSH
T16451D22C0614A2BEDD87864BB54F3E238AE701A4EFA67BD6E8AC5C1C15821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 4408162ee6c3c344891b75d58aef7424b8b9382009e8ab05ec3d266e8d7edeee
MD5 8210ea3dc55c614ab1209cc0c77ccde2
SHA1 2182bfbc0e7e4ec91fc08d21bdb2b9310b1c096e
SHA512 7eb1d203fd354f770335ddac59b0d1549104a42fe61697d30afaf7dc1f301279ba2b74f17921a8badb32581e2d2649f1424c3facd66b6441a5cc3e5843885589
SSDEEP 1536:r6ZSZI3IvfEqLfPVBUBYDureFi7YDarePrHdhloCp:wUV1l
TLSH
T15FA550A41845B6FEDB8AC2F967381F18B5FC4DB78C815028DACDE60D706746673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 a15d8d06b3492a37d0275415bcb1e63d308c047c50875be5c1352c27404c389a
MD5 71c261db3b0a570b6912a2846cab4987
SHA1 3ce6daefaec83ac10968d5aa7263da9a03e07e39
SHA512 186ce8363adb19e7fa03f0602255636810e0fa3bb6778216a765e9c9b841de08e0f4c758056b05c3f945c1d7e66a873b53d9583e1447d4efee06e192d48ee44c
SSDEEP 1536:2rZSZa3IvfEqLfPLUBYDureFi7YDareUrHdhlosp:QUsF
TLSH
T1CBA550A41845B6FDDB8AC2B9673C1F18B5FC4DB78C815028DACEE60D706746673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe58f596.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe58f596.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 4KB
SHA256 70de54757510156256662b3a0f3a0aab4411851c8baf50b31adc199459e8bd32
MD5 89f220526c0289b3b1aab682e26a6a71
SHA1 56c9fedb7e79275583ba6fe28c8cfd80c2f6da95
SHA512 4db6a415251ac8434fd9806ca3fc447538c652b76f389be4719e8fc413a354ef8f4dd8b87aee1fb7e528a77bff8b440720ad44658012b56c4b461037631462a1
TLSH
T152810241464000E3D05807B654D113182B1791D497530B1365010201C8417484860A44
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 48KB
SHA256 0e5609bf054b4482aea5171c2f50bc66d3f5331536113e35e73f1d959d1bb437
MD5 9fb1821c2a2f63a7a6d2d5bc22fbdf4d
SHA1 7a162cbcf75e3b76ab50126858fcc3993b6a5229
SHA512 b9fcd5d230b2519443044c1138dacb52afd2480a5df7e4d4b45dba6afdc13519db40acb6e6489a2e0448cb38afd62ed48ace0b14a1a2c21b54c74c0f68fec275
SSDEEP 48:urxr5kQkFhp7axll7DYMF6xCO8VFDYMFZLiASO8VFDYML:uPvshp7gll4k6MjVGkZEjVGC
TLSH
T16123C0C567F82891D49D12BB88B313AB133ED1E518339353BFA154A2DCC198A68256FE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 7e7ea7fc6c81d7708956f86149b2ff1037b4926db32737551717f5241d657f64
MD5 e04eeb9c5072f914336ae329ced4dd7a
SHA1 c364f5d2ccbf4c321336e124e9b7586ff4487c70
SHA512 59284cc3b1d52209363064069f4a8788a85cefafad9a462452b1f12a51ce2771513324bbbcaaaabe0475080ccac8351dfa6a04ce33c9b5f7bb27be393bdcdeee
TLSH
T1C7C02B020D27A2731F500A00C5BBBCC2C6883C8B056018A14A3AC14C0B182FE7000106
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 194cf7d284dd45ba21685b04505b3c1573a560047f9b042beed7e10db403b00c
MD5 1c30200c679fec9d2a11635c234989f2
SHA1 cc8b52ffe06c9457dd84aac7f7db74bbb156edc3
SHA512 570552f9fa5d29b46d918ef8c8770726f5c61a33e2d3b53fd879cbabfa1e39f64d286fe011c9dbf96765bf6595209fdf73adba4c7fb1d3e7d7fded842a71a669
TLSH
T14AE0C01B5E6B1F7711944300DDBA7E44C7EDB95BD79081D4763E010A171E19E3010133
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 524B
SHA256 03650c21c13de7237503ea979b5b16b44ce0a91f9af6be3707ec97a964b8704b
MD5 3c388f1e0a5cfaec1fde22d1615b6f09
SHA1 1bb88fc508aa11e7bced7ccbeec44cc63bac8f01
SHA512 cc2a988230a959b2445c960147314753cc2ba808ca212bab78e7d372bfc7b4ce47fe07540295559e9c58cd57ebd98773523a8b7305b3db452cc34b9462b3030d
TLSH
T1F4F0C01A46225F7325CA4205E9F71FC882EC781AC254919CB6FD0A261E1E55A3210122
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 7KB
SHA256 b66062f93daf9d2eff61fa5bd36fdad1661ca56e4504c6ae82690aeafe8b6043
MD5 fc8a84454c4cf41d03783e4774d38632
SHA1 9fa14e4e4ce4913d535038bc4d08dcf1635f68bd
SHA512 5e9a72b15ed2c88354e1922c492ed842fc8f04fd6bb2147e96a63941135b602dd3558a33efed9d15280c064b50e8a00653686c80c69258247c962b172e170fe1
SSDEEP 96:wAPj/c+RWDR8pmM+ojh4xmyRWqE4962pBPufH++DP2V0OCnmr407sAYTLcpZyRQL:wCHeR8DlUrJ96GPGH72VRlYsDyRQa7hk
TLSH
T166F1DAB54C093D3D929E82E9B4546F0DCAF9C833D4906039EF4AC709A4EF59A732681F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 8240e3fcbe1620e6c374caee47ed4da777f7a5e1a9846ce7952fc971773d79ba
MD5 f2f0c4e73e4b5bc89be6edeadb3646ac
SHA1 18d65c5c199167e00f351c02be209a9647976af1
SHA512 a1d3b7dce006e9b3230b601553444c4afb73ca6232124cef3594a452e308295f3e785f5ae8fc848c66f4715265a97803dcbded97a51b2f8beca8e9f772cf38cc
TLSH
T187E0C01B5E6B2F7711944300EDBA7E44C7EDB95BD75085D4763E010A171E19E3510133
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 524B
SHA256 069d3bf4c25c71c6b0fece7c36df8c83411c264790d2a475c38fe78a6182a4fd
MD5 5e59123dd3c84ea8d837dcd7deec0d50
SHA1 924b4856ac5c1cc418d4ff6a7cf6f2a9d71babf7
SHA512 81544d5a8de7bafaf0c21c10a60a8d1eee0ff25ade8ca5c51226696bd446f04596d88b067baf4f848c3bab9a764f71d9d7a295d1c20fe518d83d585e750a5b9d
TLSH
T1B1F0051746A66F7334C54701E8F52FC892EC741AD244919CB5BD0D261E0D75B3704173
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 524B
SHA256 6d67484f354816abb933a88407e9fb4adcc576729ecda1a7383ab5e4e305076f
MD5 a576172c04887a72e3a69cc2c8fbc1bf
SHA1 cc4b3834d178f0d6c90125861453da9d8c81b35a
SHA512 221f87e92ace41f0390e9cac547447fdb04c5efb580b5604b7a3ecf27b81e136a7f2d0fcf13436150d02d001015d12c030af0d2f488ba8d63250719dea6e7207
TLSH
T101F0C01A46225F7325CA4205E8F61FD882EC781AC254919CB6FD0A261E1E55A3210122
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 7KB
SHA256 a5609a264da8c09d3137f7bcee694333008b417980c26a7d0635c58750795386
MD5 7e90cf71e337f540e2c874701690dc80
SHA1 4a34df487cbc9be7be87a556007e366091fc2dc5
SHA512 70905d51a803c64e5920b7193031d661f30bcfe1b53ad3592ffcb5ef3e80740356ebaa3cf7a49fd3a06c1bbb8504e980afbf303da269a4d6fa36f803b143b0d9
SSDEEP 96:TAPj/c+RWDR8pmM+ojh4xmyRWqE4962pBPufH++DP2V0OCnmr407sAYTLcpZyRQL:TCHeR8DlUrJ96GPGH72VRlYsDyRQa7hk
TLSH
T1C9F1DAB54C093D3D929E82E9B4546F0DCAF9C833D4906039EF4AC709A4EF59A732681F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 524B
SHA256 a1cd063b8b80870886e3362fc96e7b3ee2118d4089736fd811f3fa91ddd37065
MD5 4bf1a71f0d430f7aa290fac0e74b346a
SHA1 4ab2e6451e25bec098eef2c7d673c96c2031ab97
SHA512 385dfbfe941363f1616c5cce8386ce5ff33f5de276e12cb6cc40e531b9b4e130719cb059969559575a95708777b098983cfb234a892fa56e58513309aa5c33d1
TLSH
T135F0051746A66F7334C54701E9F61FC892EC741AD254919DB5BD0D261E0E75B3704173
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe58dd99.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe58dd99.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.4MB
SHA256 2446b85a1c001c0920ff8e218e5aae69224af54c53fac4f64c5cc02abb60b879
MD5 dcd93307ee04f60891886906340dac01
SHA1 5c04aece7475f893eb4821997f4ad7e783db49e0
SHA512 69821539b930ddeffb329180286a9250e874d5fdba05d5005b9feabb061caac64e437ae329e814515d455a32bf2ebb3c7ed25ae329f6c59df238ca6375a91789
SSDEEP 49152:cwpN1pVhhlk9u7CXGtZxRz9DT0gzq8UdYb0UnE:cwpJhlk9u/7TzJpxUNUE
TLSH
T145B55A10ABE88E2BE4BF1BB6B57101510BF6F9866772F78F160C60782E933548D52763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 9KB
SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
MD5 18cf95269eab6519867f9c240ea57c6b
SHA1 7026775355daf1cf1a49d380d7cdd7785a6278e0
SHA512 873c83d15803396a636a09349313f90e2a1a9aa8e1a41b474f898ec0b6580b107f3e3763e8e1613f8cb9d7c611a21762ce712824b68de9ae48be73425f045096
SSDEEP 192:FTaPIYtYvIOnHW+pYt6wRpy6/WVkiS3s20AbCWGShWMeqf4:Fl8YQO2+pQDfykakiS3pb/1tw
TLSH
T14212AE53DBC9B884A0509FF7AD8C201A670381554D6458DBF9BA34AB350603A7B6E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 1e0de3934ae04e1aef36d83b3de73ca47b06fef9787ab9db93cd93411a1d04d7
MD5 fd122c999f89445d81caf714f5c3b82d
SHA1 4e76bfceec1743e5de243f1b5df1f5c5c6c253fa
SHA512 69dab77716d3d9dc5ddd451b5623fb1b1d2d431e3ded6f0eb0a09954e6fc46e166d757fbd23d07923b76f349cc840ae76232b67506fd4160ed8bd87f2dea0933
TLSH
T19C90023442360D3449151C753098419B986C484118B857A419605804504BB6715A6581
MD5 SHA1 SHA512 TLSH

Submit Download

23tm5rzm.dll

Path C:\Users\Admin\AppData\Local\Temp\23tm5rzm\23tm5rzm.dll
Size 3KB
SHA256 07ab5988a79ed9b660e718a1faa61a66fd3499f4b80e24bd95748e5291d53302
MD5 a0447dcfdf010f1b9b21c3d2e1587cdd
SHA1 bc4aef301eb6d2000dd95fcbe16b457b8b74ed63
SHA512 42d6de9faf12f28bad0188e50ba8a4b1c84fdcfd3db20a8fd3562a15c5d2f779f65daacb74923c0d922c0926548c05469a33e5d5df246118b6c169e83839cce6
TLSH
T18751DB1A97EC466BF8B747346EF3435227B4F8509F669B1E1880026CBC613A06D22FB1
MD5 SHA1 SHA512 TLSH

Submit Download

7BA4kZSxbZiE.exe

Path C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\7BA4kZSxbZiE.exe
Size 1.3MB
SHA256 a574173f6f46428bfbf852c9b9da1ed6ab4bdf11064fe719040ffffb271511be
MD5 205182ce5e6ed46f2d839064ddf4c7dc
SHA1 7a2804a7c37f47384fd17db42cc1a39b23924cec
SHA512 a6074b2ffae3272e512c66d38026a563c3722685fae5d305dd7295da3f373912ad0ad061a0df896f53cbcd7b5ed35d5db10adf0ef7272b657fe174c1271bb419
SSDEEP 24576:YmPjS7HX11V1/hpz4yF+sxtigrZ4Psb0iK7GO6L361scQm1wUnDAnEoOqd:l+31bxAsxb40o9gTYkm1ZnEnEG
TLSH
T11E5512127782C472D6B229324A68C672967DB9211F248BDF53D8165CCEB42C1CB36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

qw47xKGQUmfF.ps1

Path C:\Users\Admin\AppData\Local\Temp\BsJjNHUzai8B\qw47xKGQUmfF.ps1
Size 58KB
SHA256 07f5968e2ef75fda1cf61729c5cb33a02888064289864317dd3d8bb4d5f0768e
MD5 5ec57e1355eb74e1bdbb5b28227b7da5
SHA1 f9f2630e0b4bf695cc9f64eff85084b6b6178321
SHA512 894f72408e4fa64d9ed30135a508efabb3b6f3ff608f35fef7e03db7886f0b731f6869112e413da3689a989a62098c384050e5f12e895c661c2fba45a752935d
SSDEEP 1536:IdF8YtHn3bsNEimhYhcu/FoCYJnO1sit+oSimMy6iGszx1:aF8YmNEi1/qLisapLqBzx1
TLSH
T15C43F1A62F834D6AE3B55AB85C56072CF1011E62011EE97CF3CC809D9B98F145573FAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFG21C7.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFG21C7.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 726B
SHA256 1967b258399413940d3af5e83d13c4589632840db80adf3d480de3e039881cb0
MD5 62b702444c50aeebbfbe7e098502428e
SHA1 f763a43c14abd306cad68555c4c3759ead008518
SHA512 bc12fc22c6100bc3cd12bbc1af2af91361efd41b1b289ba67fd302ca0de348ff542f4cc3f5bf5e41c22dfa6d238d0f35fa57335940631f02e6eacc260aea45ab
TLSH
T1CF0168064E64067AA7522181A290D99F7BBEF28B22133246A6A4C7402A414F2BF7A481
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 1KB
SHA256 3ef69b773ad87e430a5af8708560e2517e9b5412aa6418a8add76b64a9f72209
MD5 b3ce2a755d274c4af8a1fabd77141972
SHA1 d2b7678462ed18f7fa49715564415ce2737a5513
SHA512 b09299a5590a1e7a2b063f2b36388225783ce8d1f667b070eccdd1bb6295f93392a5358546f50af10a1f3aca3596e04f0ff25ada7fc3d6c8cf30692a0127753a
TLSH
T10721D2028FB45A7965212189A3D0AD8F7B7DF2CB22073746E794CB0826024F5BFF7442
MD5 SHA1 SHA512 TLSH

Submit Download

RES720E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES720E.tmp
Size 1KB
SHA256 e6e20c43ab810d5cb56722d0d810a60cbc8d90cb24517dd5dd6841f7f2a48aaa
MD5 f9ccbde88c2362b0ba5fa6b54c59ed9f
SHA1 0b02957a6da9f517d39af496135c5edac63625d2
SHA512 1d0a4df7ad4b7c71ac6e2ca7697b0dd20c530f2b3bccdf879277cf5c260ebdf444d38fc11cdb4c6535441eb3323f9c6c8582baca5f18ba2bce2dadfa6c6d1936
TLSH
T1F9218C0697E9470EF0B7573269F6572F9274FE58EFB2539B854042282C51904DEA0E72
MD5 SHA1 SHA512 TLSH

Submit Download

RES8C1E.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES8C1E.tmp
Size 1KB
SHA256 bcb712191a22cea619dfb61af5a2fd1f251edb357dee0c400af3af0bba8102f6
MD5 e7ab9d622f6250b95d57ba6ef9b5d564
SHA1 85e764e6439d269806aa4b7a90a068c2bb80b4fc
SHA512 b527fe5a4c5b189858d8158a8bfc23771f930b9600438d7d7c80f6a6195a7ae4089b70e65ea6ac2a2e5bc9ad9803afe8da33e3aac6a45a3b8c6497a53e0e18e8
TLSH
T144216A0953EC471EF073573169F6472FD274FD94EF62935B858052281851504EEA0F72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_stoxhvnl.asd.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_stoxhvnl.asd.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

wacn1xfi.dll

Path C:\Users\Admin\AppData\Local\Temp\wacn1xfi\wacn1xfi.dll
Size 3KB
SHA256 af56de813d409c7e1ec440b186c54017092e037c9f5ac17bf78b3b1402cf711e
MD5 62d61a57a42dca61f4d506ead964d97e
SHA1 16d564c7b17df249470b13ceebb9ce786f9005cd
SHA512 f080ff6767e71ac882f0e0d4bcf2ee97d3c2e7b3faaf96830c099ad092fbd5f083ea162ea0ae2f4f5ea130acb21a8f8be446349082bcc8ff3837ad9bae3648d1
TLSH
T18E71AB1A97E80667E0A707396EF7472667B4FC109FB3976E5D80022DAC616600931BB1
MD5 SHA1 SHA512 TLSH

Submit Download

MSI216A.tmp

Path C:\Windows\Installer\MSI216A.tmp
Size 285KB
SHA256 f74c97b1a53541b059d3bfafe41a79005ce5065f8210d7de9f1b600dc4e28aa0
MD5 b77a2a2768b9cc78a71bbffb9812b978
SHA1 b70e27eb446fe1c3bc8ea03dabbee2739a782e04
SHA512 a8b16bc60f8559c78c64ca9e85cd7fd704bba1f55b362465b7accef1bb853d1c9616995a35f972256c57fbe877ce880398ba1fbceaa658604883aa12dcbc4f57
SSDEEP 6144:cAOfnUdzb4m26KFHF/jliAYktxjw0gCvo5VGWg6AZzGbasKHr45I:cRUFb4H6KJF/pDYkw0gCvoKWg6AZznX4
TLSH
T18B547C117AD5D432E1BE0530397DABA52ABEF8316DF0C68F9384566D2D712C0A728F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2A18.tmp

Path C:\Windows\Installer\MSI2A18.tmp
Size 106KB
SHA256 f9f945ef8cf84de18a4c2a5fabf14f425bec19225f99164684ef3f65e9eeadbd
MD5 77c9fc2bca8737f2de4d1d31ac0e385d
SHA1 4eb76332e4cfb9d217cd42b7a0a31fc1b092be98
SHA512 867b2d0b59c54b909076120f7a92bb7d1d3e86e098dfb0284d50592cf9ed6a03b5c9d24e6bba7d424c67a4b9c0564095a28f744af393fa276053073a7cdbb45f
SSDEEP 1536:HRC2vsWimcd8vtCJfDIeX2VVeSUVOFx2KCAq4r1hZjASXnJX38/guulVzQ:HRQH8vtCJfhX2mSrx2KHq4TTXM/gZs
TLSH
T14CB38C81B691C472D9BF5D3C4578C6661E3E39200FE09DAF275416BA1EB43D0AA34E3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586906.msi

Path C:\Windows\Installer\e586906.msi
Size 1.2MB
SHA256 a6fe48609e883ccedff1a74986a61fdf9f3bbf60340384ebba8e28a03bbbabc5
MD5 010847b9d43887efa305e74cb206d62c
SHA1 2b69a993f17f07c78d724cf7849d30cf19efd3c7
SHA512 1b3e1d5c7bd015a2ae7b63b1a07adc3284b19c6a271693d102a119b86d29256ce20cb362b9364c5c535f77f4550c237b2e53aa2319746ebbaf37b45fb7bf6d49
SSDEEP 24576:sYQcO9sadDt4Ip9A5ya0sLoSaVAcmrBLOUb96gMzbFtiAI9cim1xUnkxYCX:vQSadD+RwsLdaCPNj96gGKbBm1mndCX
TLSH
T17945339B16508160D94B0B30825AD2ABBD3D6E47285A4684A1EEB7C81DF7F4187FF0F6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_2090742316\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4316_2090742316\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 fce5faae267e38fcfbc09737631e4ceaa05e2dd804fa7189a6e8dc1b51a9d3c6
MD5 aae1b5117378e8584d3e22d9b99b941f
SHA1 fa163457c9e82469864ee3ae812926fe463d40e5
SHA512 230b83ff0c5fb9eae52164d21806320e759eb86b5f30588af55d3332157d836a03400d07a60fd3511bbda1195cf9578e3c013248bd7a577a6b18c5521cfc64ef
SSDEEP 24576:32gmSp1SdoO/vvTLEGveR0Xaf6pEQYrVWWMN3pkP2U64EjL6o0O47CFox:Q
TLSH
T11247D12432FD2240E7F79E3D6CF0AA27493A7D5B9C159E8D45421B4E0921BB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{329ef809-64fb-4634-959b-1df3dcc54bd0}_OnDiskSnapshotProp

Path \??\Volume{a37a13d3-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{329ef809-64fb-4634-959b-1df3dcc54bd0}_OnDiskSnapshotProp
Size 6KB
SHA256 3ae217571d4f6dd6b2d9e848ddf07efe1f621c0ff8761602f7ed70a960b93872
MD5 a6b87dceed86effce60e75457a2e4aa6
SHA1 836d4a2fc1b044895c9579e6a153e20199351893
SHA512 27d9b3a128da700cd02e1ae8d510ff0095cd462d2b30f9513b034f2379b1ed384ddb4adfd1fdb8d07b94cc5d9ab0c49fd645edca9364b3cf41c0aecf1fe084c0
SSDEEP 96:FessUvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:gkb++ZVmN
TLSH
T1D1D189185AF54711E2B3AB3229F14557A477B811EF33CB8E0298638E2670A10F936F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23tm5rzm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\23tm5rzm\23tm5rzm.0.cs
Size 55B
SHA256 47a106811e7b459b61c16d709bd4adcf3241186669c4e773c39d8fc6500de5f2
MD5 3a37d60b6d3a09500b9e7fcc64882feb
SHA1 3caa922790343c3406e293aee70b917b7d5d8db3
SHA512 51c9b9f9919d1ffb74c8b77d0c8f8e8801e57418f66ef35b076a5cb17565ceb5bf36c963f1010f559ac93cebb8802c230dbac31555e4706349a3c6cf1be59ad0
TLSH
T1FF9002558318406840E9490695A4D4075CF6612D1179F864184353005D8A0C0B175371
MD5 SHA1 SHA512 TLSH

Submit Download

23tm5rzm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\23tm5rzm\23tm5rzm.cmdline
Size 369B
SHA256 e6cd4231f6327d65ead463bdf46fe0abfa10bdc09cb8798a46e7f42abe84416a
MD5 74ae690e04b7307ed5cfdbb0de66247a
SHA1 a0cd574da2107fe398f2fccafc725c4e70c0cb20
SHA512 919d7408248e2adb7c4ac3b19be6b3d23fd1934b2825576fba3d477f1104702bb061e84e3c35336c0605b43cc9a4717d4e435ccf693954006d4ec6cf9e70133e
TLSH
T138E0202F52EEC67D79DD200725A9C5ACC37217472B817F845154845DD0270076BD3B57
MD5 SHA1 SHA512 TLSH

Submit Download

CSC8CB2A1E4D1904AFDA0BD3DE567F9DB.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\23tm5rzm\CSC8CB2A1E4D1904AFDA0BD3DE567F9DB.TMP
Size 652B
SHA256 82f7f27bf89cb16eb188915cb691eaafbb16ab25ba4163dde319d3296f5a94f1
MD5 7bc42daea5dcf3a961f0c97f932f81ca
SHA1 e6bf27e98d0914e0abe3bfaae06481c0c6ae359e
SHA512 97d01e31187e225a6e4f1c26db69c0e3c108c41e531551695da9f44ceef0fbeb728b1c99c52eb8f83b07fe068ae4dc63e127c1c92a96f056cd5e8f7566af019f
TLSH
T1DCF03A0963FC120EF4F34B30B9F6836391A8BC65DE32A3ED5480431D28749109962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSC54E20EA8AFBE41498FB7C1B12A72DB4D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\wacn1xfi\CSC54E20EA8AFBE41498FB7C1B12A72DB4D.TMP
Size 652B
SHA256 fb3db9b9dc4eca3a5288d01c73801b5d22bc1dc0f4f32374ee04e679daa79c4d
MD5 c3b5e062aacf13fce543c83d8de86795
SHA1 bca64b9be88c540be51e46b7b3de42c6da98b9e7
SHA512 5bfe47ec5311cd617d84c3da2d4b9c8850854b5fa4da0b2b21a75bc922748d18cfcd78a3bcc2749b0c0b397dc86978089a0441e67afb1d3ec9d794b3704c9a37
TLSH
T10CF0820A63F8020EF0F74F31BDF6936795A8BC64DE3293ED5440031D6C649108962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

wacn1xfi.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\wacn1xfi\wacn1xfi.0.cs
Size 571B
SHA256 cb2e610345ebe0a15a0399f07b7a919e5f77b1689a523c80e531539c965e4e0d
MD5 d9ba7429abb22c214518d431d33588d5
SHA1 2ace9c25bbc4ab5ee2ef641e86af4f8c51f4c561
SHA512 c33db25eff6d38e8dc97dbb518d25f16597df4d7c085b27a4946b0e3c91740cda4c49c9bb7c197c35cf3377048aa080e7da6569e1bd9dbf31bfb8bce0a972e55
TLSH
T1DAF0F63457CFED6518D24425AC99E49C457702291279BC50F6FF1322DE8720472722A5
MD5 SHA1 SHA512 TLSH

Submit Download

wacn1xfi.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\wacn1xfi\wacn1xfi.cmdline
Size 369B
SHA256 ffd84f8740d961854dbecdf7dddd5391655946ec94009d7f259dffc3e441cb43
MD5 e0a98407ecc92fa93d5e44fa7c3cadb2
SHA1 bb6ec810ca7a9c609734ecaace6c407dab13346e
SHA512 dd92228653542508be9594f27c55e8420d12a6d4decffa516f96bad092b92ee3f9bbf0145fd3de3eafbba77d76b98ef073cff1de42a910fbcc025197b9db03f2
TLSH
T1E7E06F6B8256C27D09ED100B236AC4AEC3720A9B29B83F849044848DE0BB0182BE2B81
MD5 SHA1 SHA512 TLSH

Submit Download

memory/556-73-0x000001F874FD0000-0x000001F874FE2000-memory.dmp

Download

memory/556-72-0x000001F874F30000-0x000001F874F38000-memory.dmp

Download

memory/556-71-0x000001F873740000-0x000001F87374C000-memory.dmp

Download

memory/556-74-0x000001F8756D0000-0x000001F87573F000-memory.dmp

Download

memory/556-53-0x000001F875570000-0x000001F875592000-memory.dmp

Download

memory/1164-99-0x000001BA88110000-0x000001BA88488000-memory.dmp

Download

memory/1164-100-0x000001BA885E0000-0x000001BA885EC000-memory.dmp

Download

memory/1444-114-0x0000019A925F0000-0x0000019A925FC000-memory.dmp

Download

memory/1616-95-0x000001E3ABA20000-0x000001E3ABA2C000-memory.dmp

Download

memory/2052-127-0x000001CE31730000-0x000001CE3173C000-memory.dmp

Download

memory/2052-148-0x000001CE49E60000-0x000001CE49ECF000-memory.dmp

Download

memory/2052-130-0x000001CE49E60000-0x000001CE49ECF000-memory.dmp

Download

memory/2052-564-0x000001CE49E60000-0x000001CE49ECF000-memory.dmp

Download

memory/2052-129-0x000001CE31BC0000-0x000001CE31BD2000-memory.dmp

Download

memory/2052-128-0x000001CE31B10000-0x000001CE31B18000-memory.dmp

Download

memory/2052-120-0x000001CE4A150000-0x000001CE4A158000-memory.dmp

Download

memory/2052-102-0x000001CE49E20000-0x000001CE49E28000-memory.dmp

Download

memory/2100-118-0x000001EF907A0000-0x000001EF907AC000-memory.dmp

Download

memory/2100-117-0x000001EF90990000-0x000001EF90D08000-memory.dmp

Download

memory/2692-852-0x000001FD78200000-0x000001FD78578000-memory.dmp

Download

memory/3024-755-0x0000024715200000-0x000002471526F000-memory.dmp

Download

memory/3024-1051-0x0000024715200000-0x000002471526F000-memory.dmp

Download

memory/3088-378-0x00007FFF0F3B0000-0x00007FFF0F3B1000-memory.dmp

Download

memory/3088-783-0x0000019E2E740000-0x0000019E2EAB8000-memory.dmp

Download

memory/3104-161-0x0000000001170000-0x00000000012BD000-memory.dmp

Download

memory/3104-124-0x0000000001170000-0x00000000012BD000-memory.dmp

Download

memory/3356-1074-0x000001FC52ED0000-0x000001FC53248000-memory.dmp

Download

memory/3672-1-0x0000029471320000-0x000002947132C000-memory.dmp

Download

memory/3672-48-0x000002946D9B0000-0x000002946DD28000-memory.dmp

Download

memory/3672-49-0x0000029471320000-0x000002947132C000-memory.dmp

Download

memory/3672-15-0x000002946D9B0000-0x000002946DD28000-memory.dmp

Download

memory/3672-0-0x000002946D9B0000-0x000002946DD28000-memory.dmp

Download

memory/3680-126-0x0000000005A70000-0x0000000005A76000-memory.dmp

Download

memory/3680-125-0x0000000004E10000-0x0000000004F5D000-memory.dmp

Download

memory/3680-143-0x0000000004E10000-0x0000000004F5D000-memory.dmp

Download

memory/3680-84-0x0000000005E80000-0x00000000063AC000-memory.dmp

Download

memory/3680-159-0x0000000004E10000-0x0000000004F5D000-memory.dmp

Download

memory/3680-134-0x000000000B7F0000-0x000000000B828000-memory.dmp

Download

memory/3680-64-0x00000000002F0000-0x0000000000552000-memory.dmp

Download

memory/3680-135-0x000000000B7B0000-0x000000000B7BE000-memory.dmp

Download

memory/3680-65-0x0000000004F90000-0x0000000004FAE000-memory.dmp

Download

memory/3680-67-0x00000000050F0000-0x00000000050FA000-memory.dmp

Download

memory/3680-70-0x0000000005780000-0x00000000057E6000-memory.dmp

Download

memory/3680-103-0x0000000006F40000-0x0000000006F66000-memory.dmp

Download

memory/3980-782-0x0000021791550000-0x00000217915BF000-memory.dmp

Download

memory/4316-756-0x0000024683360000-0x00000246833CF000-memory.dmp

Download

memory/4320-20-0x000002B03E160000-0x000002B03E4D8000-memory.dmp

Download

memory/4320-1049-0x000002B03E160000-0x000002B03E4D8000-memory.dmp

Download

memory/4320-122-0x000002B03ECE0000-0x000002B03ECEC000-memory.dmp

Download

memory/4320-121-0x000002B03E160000-0x000002B03E4D8000-memory.dmp

Download

memory/4320-1115-0x000002B03E160000-0x000002B03E4D8000-memory.dmp

Download

memory/4464-244-0x00007FFF0F3B0000-0x00007FFF0F3B1000-memory.dmp

Download

memory/4464-781-0x000002A81B4D0000-0x000002A81B848000-memory.dmp

Download

memory/4592-123-0x0000023211570000-0x00000232118E8000-memory.dmp

Download

memory/4592-163-0x0000023211570000-0x00000232118E8000-memory.dmp

Download

memory/4592-141-0x0000023211570000-0x00000232118E8000-memory.dmp

Download

memory/4744-224-0x000001EDDAA10000-0x000001EDDAA7F000-memory.dmp

Download

memory/5032-1027-0x0000000002BB0000-0x0000000002BCA000-memory.dmp

Download

memory/5032-1031-0x0000000002BE0000-0x0000000002BEA000-memory.dmp

Download

memory/5032-1044-0x0000000002C20000-0x0000000002C32000-memory.dmp

Download

memory/5032-1045-0x0000000002CA0000-0x0000000002CDC000-memory.dmp

Download

memory/5032-1070-0x00000000029A0000-0x00000000029B4000-memory.dmp

Download

memory/5032-1069-0x00000000021D0000-0x000000000231D000-memory.dmp

Download