f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf

Analysis

user interaction
yes
max time kernel
299s
max time network
304s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/05/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSTeams_680.msi
Size 22.1MB
Sample260511-1p8phaex3q
SHA256 f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf
MD5 b848c1d883bc210453286fc3d967e745
SHA1 79a18e6d14db69a56f87708c3d14cb3baa83ee98
SHA512 b4f1e624fe65815d21925f6dd8fe6742e5e3fc6f5efb97d6470ca530e7901dd663c3ee13b4236c55db38777c953b602d9beacda450a77c6157524b65ca08f046
SSDEEP 393216:/A4EQoVqkO+fFgTOfPPNiv1P8z1FhO350N+54Ktq6UWP3knuptZgNFRdu/vqIWB3:qPO+fFgTOf3Nih83wp0N+KqMuptW/du6
TLSH
T19C37333E2A889325ED83DBFBD8F4C42CC4D733435D161067E99EDC6992E2A089DE591C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4720	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
1624	hyBpXlX.exe
5984	hBeRqKUUTm.exe
1532	Update.exe
5988	ev2f79.exe
3472	ev2c34.exe

Loads dropped DLL 20 IoCs

pid	Process
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5984	hBeRqKUUTm.exe
5776	MsiExec.exe
5776	MsiExec.exe
5776	MsiExec.exe
5776	MsiExec.exe
5776	MsiExec.exe
5776	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\vss_tmp.txt	vssvc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vssvc.exe.log	vssvc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
6032	tasklist.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-nl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-pa.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-et.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-sq.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_1915923921\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_322928547\Microsoft.CognitiveServices.Speech.core.dll	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-da.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-el.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-es.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-pt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_322928547\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_42464911\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-be.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-hy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_322928547\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_42464911\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-lv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-mn-cyrl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-mul-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-or.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-as.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-cu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-gu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-hu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-lt.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-tk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-uk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_42464911\protocols.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-bg.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-ml.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-ru.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_1915923921\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files (x86)\Community\Facebook Installer.exe	hBeRqKUUTm.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-ga.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-sk.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_997453959\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-af.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-cy.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-mr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-it.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-nb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-cs.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-en-us.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-fr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-la.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\manifest.json	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-gl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-ka.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-sl.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-te.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_997453959\crl-set	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_997453959\manifest.fingerprint	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-de-ch-1901.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-en-gb.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-hi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-hr.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-kn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-bn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-eu.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-und-ethi.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-de-1996.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-nn.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-sv.hyb	msedgewebview2.exe
File created	C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-ta.hyb	msedgewebview2.exe

Drops file in Windows directory 17 IoCs

description	ioc	Process
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C6B05020-75C0-43BE-97BB-1C2A0F20B71A}	msiexec.exe
File created	C:\Windows\Installer\e58a308.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI45C.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIC80A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSICCDD.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFE21.tmp	msiexec.exe
File created	C:\Windows\Installer\e58a301.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA459.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID3E3.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a301.msi	msiexec.exe
File created	C:\Windows\Installer\e58a303.msi	msiexec.exe
File created	C:\Windows\Installer\e58a304.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a304.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5448	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hBeRqKUUTm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hyBpXlX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000f6f843118761a0680000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000f6f843110000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900f6f84311000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1af6f84311000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1df6f84311000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230099580323968"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.Connect\CurVer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Runtime = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.Connect	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\msteams\shell\open\command	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect\CurVer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect\CurVer\Description = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID\ = "{EABAE40C-B27C-455A-B672-F234DD780948}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.Connect\CurVer\ = "TeamsAddin.Connect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect\CurVer\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\TeamsAddin.FastConnect.1\CLSID\ = "{19A6E644-14E6-4A60-B8D7-DD20610A871D}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-312252282-3884318443-358092420-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Codebase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4952	msiexec.exe
4952	msiexec.exe
4720	powershell.exe
4720	powershell.exe
5988	ev2f79.exe
5988	ev2f79.exe
3980	vssvc.exe
3980	vssvc.exe
5988	ev2f79.exe
5988	ev2f79.exe
3980	vssvc.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe
3540	ms-teams.exe
3540	ms-teams.exe
3540	ms-teams.exe
3540	ms-teams.exe
3540	ms-teams.exe
3784	UserAccountBroker.exe
3784	UserAccountBroker.exe
4952	msiexec.exe
4952	msiexec.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
5896	msedgewebview2.exe
5896	msedgewebview2.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe
3944	edpnotify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3784	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
5988	ev2f79.exe
3980	vssvc.exe
5988	ev2f79.exe
3472	ev2c34.exe
3472	ev2c34.exe
3472	ev2c34.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
864	msedgewebview2.exe
864	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5448	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5448	msiexec.exe
Token: SeSecurityPrivilege	4952	msiexec.exe
Token: SeCreateTokenPrivilege	5448	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5448	msiexec.exe
Token: SeLockMemoryPrivilege	5448	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5448	msiexec.exe
Token: SeMachineAccountPrivilege	5448	msiexec.exe
Token: SeTcbPrivilege	5448	msiexec.exe
Token: SeSecurityPrivilege	5448	msiexec.exe
Token: SeTakeOwnershipPrivilege	5448	msiexec.exe
Token: SeLoadDriverPrivilege	5448	msiexec.exe
Token: SeSystemProfilePrivilege	5448	msiexec.exe
Token: SeSystemtimePrivilege	5448	msiexec.exe
Token: SeProfSingleProcessPrivilege	5448	msiexec.exe
Token: SeIncBasePriorityPrivilege	5448	msiexec.exe
Token: SeCreatePagefilePrivilege	5448	msiexec.exe
Token: SeCreatePermanentPrivilege	5448	msiexec.exe
Token: SeBackupPrivilege	5448	msiexec.exe
Token: SeRestorePrivilege	5448	msiexec.exe
Token: SeShutdownPrivilege	5448	msiexec.exe
Token: SeDebugPrivilege	5448	msiexec.exe
Token: SeAuditPrivilege	5448	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5448	msiexec.exe
Token: SeChangeNotifyPrivilege	5448	msiexec.exe
Token: SeRemoteShutdownPrivilege	5448	msiexec.exe
Token: SeUndockPrivilege	5448	msiexec.exe
Token: SeSyncAgentPrivilege	5448	msiexec.exe
Token: SeEnableDelegationPrivilege	5448	msiexec.exe
Token: SeManageVolumePrivilege	5448	msiexec.exe
Token: SeImpersonatePrivilege	5448	msiexec.exe
Token: SeCreateGlobalPrivilege	5448	msiexec.exe
Token: SeBackupPrivilege	3980	vssvc.exe
Token: SeRestorePrivilege	3980	vssvc.exe
Token: SeAuditPrivilege	3980	vssvc.exe
Token: SeBackupPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe
Token: SeTakeOwnershipPrivilege	4952	msiexec.exe
Token: SeRestorePrivilege	4952	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5448	msiexec.exe
5448	msiexec.exe
1532	Update.exe
3540	ms-teams.exe
3540	ms-teams.exe
3540	ms-teams.exe
3540	ms-teams.exe
3540	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3540	ms-teams.exe
3540	ms-teams.exe
3540	ms-teams.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 5828	4952	msiexec.exe	91
PID 4952 wrote to memory of 1624	4952	msiexec.exe	93
PID 4952 wrote to memory of 5984	4952	msiexec.exe	94
PID 1624 wrote to memory of 1532	1624	hyBpXlX.exe	95
PID 5984 wrote to memory of 5592	5984	hBeRqKUUTm.exe	97
PID 5592 wrote to memory of 6032	5592	cmd.exe	99
PID 5592 wrote to memory of 5392	5592	cmd.exe	100
PID 5984 wrote to memory of 5284	5984	hBeRqKUUTm.exe	101
PID 5284 wrote to memory of 3096	5284	cmd.exe	103
PID 3096 wrote to memory of 4720	3096	cmd.exe	104
PID 5984 wrote to memory of 5988	5984	hBeRqKUUTm.exe	110
PID 5984 wrote to memory of 3472	5984	hBeRqKUUTm.exe	113
PID 3540 wrote to memory of 864	3540	ms-teams.exe	121
PID 864 wrote to memory of 4568	864	msedgewebview2.exe	122
PID 864 wrote to memory of 748	864	msedgewebview2.exe	125
PID 864 wrote to memory of 748	864	msedgewebview2.exe	125
PID 864 wrote to memory of 748	864	msedgewebview2.exe	125
PID 864 wrote to memory of 4980	864	msedgewebview2.exe	126
PID 864 wrote to memory of 892	864	msedgewebview2.exe	127
PID 864 wrote to memory of 892	864	msedgewebview2.exe	127
PID 864 wrote to memory of 4396	864	msedgewebview2.exe	128
PID 864 wrote to memory of 4396	864	msedgewebview2.exe	128
PID 864 wrote to memory of 4396	864	msedgewebview2.exe	128
PID 864 wrote to memory of 1252	864	msedgewebview2.exe	131
PID 864 wrote to memory of 1252	864	msedgewebview2.exe	131
PID 864 wrote to memory of 1252	864	msedgewebview2.exe	131
PID 4952 wrote to memory of 5776	4952	msiexec.exe	133
PID 864 wrote to memory of 4676	864	msedgewebview2.exe	138
PID 864 wrote to memory of 4676	864	msedgewebview2.exe	138
PID 864 wrote to memory of 3032	864	msedgewebview2.exe	139
PID 864 wrote to memory of 3032	864	msedgewebview2.exe	139
PID 864 wrote to memory of 4688	864	msedgewebview2.exe	140
PID 864 wrote to memory of 4688	864	msedgewebview2.exe	140
PID 864 wrote to memory of 5896	864	msedgewebview2.exe	141
PID 864 wrote to memory of 3032	864	msedgewebview2.exe	142
PID 864 wrote to memory of 3032	864	msedgewebview2.exe	142
PID 864 wrote to memory of 5728	864	msedgewebview2.exe	143
PID 864 wrote to memory of 5728	864	msedgewebview2.exe	143

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MSTeams_680.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5448

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5828
- C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe
  "C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=hyBpXlX.exe --bootstrapperMode
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:1532
  - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe
      "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.4.0.0&instExecTime=1778536345397&launchSrc=t2installer
      4⤵
      Adds Run key to start application
      Checks processor information in registry
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:3540
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,BlockCrossPartitionBlobUrlFetching,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=3540.1008.15026567404851584626
        5⤵
        Drops file in Program Files directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:864
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x158,0x15c,0x160,0x134,0x168,0x7ff94017b078,0x7ff94017b084,0x7ff94017b090
        6⤵
        
        PID:4568
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1680,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1388 /prefetch:2
        6⤵
        
        PID:748
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2068,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2076 /prefetch:3
        6⤵
        
        PID:4980
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2384,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
        6⤵
        
        PID:892
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3792,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3796 /prefetch:1
        6⤵
        
        PID:4396
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=4312,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4020 /prefetch:1
        6⤵
        
        PID:1252
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=3964,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
        6⤵
        
        PID:4676
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5100,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:8
        6⤵
        
        PID:3032
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4892,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:8
        6⤵
        
        PID:4688
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5052,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5896
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4412,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4408 /prefetch:8
        6⤵
        
        PID:3032
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4020,i,18420659010121593354,15502588153781250881,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=780 /prefetch:8
        6⤵
        
        PID:5728
    - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID d4a4a0cc-de8b-40b6-96de-adadc32108fd -Trigger EnsureTmaAtStartup
        5⤵
        Checks processor information in registry
        
        PID:3916
    - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID d4a4a0cc-de8b-40b6-96de-adadc32108fd -Trigger SchedulerDirectLaunch -BgTaskDelay 2160
        5⤵
        Checks processor information in registry
        
        PID:2108
- C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe
  "C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5984
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5592
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:6032
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5392
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5284
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3096
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:4720
- - C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
    "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:5988
- - C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
    "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:3472
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2F0C894DF4B7DD3CFC1758A6B0CE1220
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5776

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3980

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:3784

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3944

C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:5408

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a302.rbs

Path C:\Config.Msi\e58a302.rbs
Size 8KB
SHA256 ca21bf0565a2e2dfdd0ecac516e0430e7850358a9fb59ee71ab008192cc9d18f
MD5 5eb5d1af3e05d4b0e9f80817eaf1f27f
SHA1 39afbdafe6aa205e764b647a00b9938b0912289e
SHA512 9c796db9e55d6db8f8795b5938633a0db6e806334e5a0ffcbe59f0855f12755da60bbae6ea018349b51cb225b87d4c9e5cf3c3de6ee7de7c05183b7e79f0c03e
SSDEEP 96:/h2hRczuBI0IzItghSnU4MKCsThqPU4MKC6jFTpxThqIHgu1yshIl62QRCipeBVD:/QhRsvREtzUVZI3VZWSipy
TLSH
T1450224067241C9D2E5A61331C70B1B5477AAE3FB9200671F1B8FE5348F1BF989E2D58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a307.rbs

Path C:\Config.Msi\e58a307.rbs
Size 357KB
SHA256 7af88bccd01995a3d29fe772df1b87ee99496753f3a6beeec1f55d2b67b4c550
MD5 a4cac2963ade73a6a2e45681f20ed4e1
SHA1 38257786d2b8fd1ace163be5b7ed6d2c764c037a
SHA512 8c2813fec828168a832b16213af590a424ca2f3e26692e9acee2d528cfd5042a0b3125590e2ea9c22739bcd099b5a3f3c6713161feabd2903b949bd75b387f88
SSDEEP 3072:pe0zxXTS8SgMq+jVrrb1MMBBMolzaDhI31YS8SgMq+jVrrb1MMBBMolzaDhI312d:pe0z5pkp11ex7pkp11exp
TLSH
T17C744C12AB41DDB6D47C353602717A8E703DFA6319C0BE5E8B40DA784F5A7E8E718E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_1915923921\manifest.json
Size 43B
SHA256 81bd82ac27612a58be30a72dd8956b13f883e32ffb54a58076bd6a42b8afaeea
MD5 af3a9104ca46f35bb5f6123d89c25966
SHA1 1ffb1b0aa9f44bdbc57bdf4b98d26d3be0207ee8
SHA512 6a7a543fa2d1ead3574b4897d2fc714bb218c60a04a70a7e92ecfd2ea59d67028f91b6a2094313f606560087336c619093f1d38d66a3c63a1d1d235ca03d36d1
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_322928547\manifest.json
Size 76B
SHA256 0d664bc422a696452111b9a48e7da9043c03786c8d5401282cff9d77bcc34b11
MD5 ba25fcf816a017558d3434583e9746b8
SHA1 be05c87f7adf6b21273a4e94b3592618b6a4a624
SHA512 3763bd77675221e323faa5502023dc677c08911a673db038e4108a2d4d71b1a6c0727a65128898bb5dfab275e399f4b7ed19ca2194a8a286e8f9171b3536546f
TLSH
T170A022833A0EC03B008283B0202383C08BBCAA28380E080E082338C0CAC2BB80000B28
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_42464911\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_42464911\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-as.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-as.hyb
Size 703B
SHA256 c2784e33158a807135850f7125a7eaabe472b3cfc7afb82c74f02da69ea250fe
MD5 8961fdd3db036dd43002659a4e4a7365
SHA1 7b2fa321d50d5417e6c8d48145e86d15b7ff8321
SHA512 531ecec11d296a1ab3faeb2c7ac619da9d80c1054a2ccee8a5a0cd996346fea2a2fee159ac5a8d79b46a764a2aa8e542d6a79d86b3d7dda461e41b19c9bebe92
TLSH
T13001E1B0B7014F4BC635EDB0117A4A6D9664C43553BE051D84B1F9634F19714E70A8A8
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-hi.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-hi.hyb
Size 687B
SHA256 f4df224d459fd111698dd5a13613c5bbf0ed11f04278d60230d028010eac0c42
MD5 0807cf29fc4c5d7d87c1689eb2e0baaa
SHA1 d0914fb069469d47a36d339ca70164253fccf022
SHA512 5324fd47c94f5804bfa1aa6df952949915896a3fc77dccaed0eeffeafe995ce087faef035aecea6b4c864a16ad32de00055f55260af974f2c41afff14dce00f3
TLSH
T14801E178BE13888BC6784DB1054115AA0320F90EF296021B4262B13ACB18FD61C95484
MD5 SHA1 SHA512 TLSH

Submit Download

hyph-nb.hyb

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\hyph-nb.hyb
Size 141KB
SHA256 c2771fbb1bfff7db5e267dc7a4505a9675c6b98cfe7a8f7ae5686d7a5a2b3dd0
MD5 677edd1a17d50f0bd11783f58725d0e7
SHA1 98fedc5862c78f3b03daed1ff9efbe5e31c205ee
SHA512 c368f6687fa8a2ef110fcb2b65df13f6a67feac7106014bd9ea9315f16e4d7f5cbc8b4a67ba2169c6909d49642d88ae2a0a9cd3f1eb889af326f29b379cfd3ff
SSDEEP 3072:pPTHXHEm69FrOP8d4hRLiinKL4Qshbv2fuOQXCxj+60EoM8WC5zgk:p73HEUP8dsiinTThjy90VKk
TLSH
T1CCE319F3A3394AC29420A8A4DF593B7E4044FA944D80E197B5EC2038E667CBC76D579F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_536479746\manifest.json
Size 82B
SHA256 d571ef33b0e707571f10bb37b99a607d6f43afe33f53d15b4395b16ef3fda665
MD5 2617c38bed67a4190fc499142b6f2867
SHA1 a37f0251cd6be0a6983d9a04193b773f86d31da1
SHA512 b08053050692765f172142bad7afbcd038235275c923f3cd089d556251482b1081e53c4ad7367a1fb11ca927f2ad183dc63d31ccfbf85b0160cf76a31343a6d0
TLSH
T137A022A0BC0880333E8803A8023E83E3C3BE3E0A20003C0002A33C8022EC33B3038E2C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Program Files\chrome_Unpacker_BeginUnzipping864_997453959\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\AddinInstaller.dll
Size 35KB
SHA256 c0306045119da6aa284f77f5ae57e9a35ae473294ef6b983db909902ef860b65
MD5 077c50b05317268a4e84b0d8e18b7e25
SHA1 4e4320e74fb1d2ca46e38b7a5554547f8c0ea57f
SHA512 e61171028a7faef3e4545ddc1a6a0e9a0ba618c20db82d4cb32eae379710497b30fee3f165400ed93c2760e04c102889686a14d7f996b3664026c881e93024ed
SSDEEP 768:CJLtIDER3wlQ0Tkjb6PO59zeTzlU+9zZU:myARglQ7jQ4zeTm6zW
TLSH
T1E0F21891A7F84102FAFB6F706AB4E5422DB9BF875C70D92D1989E14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a50487ef016e1ce77b3875402e952e331c9e410a.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a50487ef016e1ce77b3875402e952e331c9e410a.tbres
Size 2KB
SHA256 d42e84ca36df24d689ce60564224c6972373892b55def6c8abcc4b41bb1f423c
MD5 4f22ba21ee7e4d0757b2ad2ba73b7b87
SHA1 b52cf29dbc614e8191b82fad734b3b073dc3fbdd
SHA512 0d69367b1fe40027a805fba0d22f0067d496161adf48afdbe4ed2c9a1a26a7d910ae51700c66a5a1191bebca30b211c92cb98d0c71240ea2f3ca0df50227b7cb
TLSH
T1B841095CA6E91108B3B36E9A9BF6A86E487FBC772E47D45D00110E4F0A72A40D862737
MD5 SHA1 SHA512 TLSH

Submit Download

a7e624d3a800058467350735a3c9b4df6502fd79.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a7e624d3a800058467350735a3c9b4df6502fd79.tbres
Size 2KB
SHA256 998ab477f5b19c11897c98500ebbf27ffd19ac6651f7ff2529822e80a20978a9
MD5 076e9e15c359ec0eaefc63916dcab454
SHA1 2cd8ddb17dc1756d0c2ac2d664e56a603e72114c
SHA512 13c9b413a4361698e5b9dea1d5295b834db8e72a26756933a24cc90d22a37c7bde0de0e9b19b18c0a4ecde906ddc6bdd317649cd7fc8682548b47f8bea247fd5
TLSH
T14E414D98A6EA1148B3B77F569BF7686D857EBC332E06D09E00520E4F0A23B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

baeae54df3400d002e036f586e0c785624c9121a.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\baeae54df3400d002e036f586e0c785624c9121a.tbres
Size 2KB
SHA256 308c68ac58b78b243137041a02a904335eaaf18a6b9e1e85b15aba3e0d418e9d
MD5 1a2de5d8b96b3b20d4be762ab4fc2e7e
SHA1 70552a5457c1d1b2091240e5aeae9bfa37a28e82
SHA512 b8b5a05ba6eb6cc6b40ae6188fb913244d9fd450061056654215316935f0f90d27e5ccee77a85ce06dd18313245c028920c76484599eaa9f854ffed913cda88b
TLSH
T1B2514C68A6FA1148F3777E5A9FF6A86E447FB8733F06D55D10110E8E0A22A41C8B1737
MD5 SHA1 SHA512 TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 dd2bf67a3c2eda4ccb472d5914da4cb8c5957e8a83b1d57ac3bf02a21e2efbb5
MD5 3ea15f1e09df29cf603ed5b2b6c4338d
SHA1 31eb60ab51fa7e003968325668f0edfbb9aac57e
SHA512 201e74711282628d1e9c9f1ed4f752f62488234816768fb3694f0fab965fa2de19dc3621e31825a28c1c1bc8234fba6ab86b5eeecb53b47480a9824502b130e6
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 d99645f10db4a2d41b5b33f95bdd9b2e9fa952979f8338d059c7d4060c69dbb0
MD5 7dc0c2672ad13bff3236979607ceab5b
SHA1 2070877c95c5519293a90ad405f8b3f1bae43e21
SHA512 b964d54d5ae11f80b90a3529f64a6904486535a413c9150d45701b5cff4e071a2d2ada94c1056d0e57f0454ab43a03808e46b9db34ed6e895563bdf697f8da67
TLSH
T157D02417F7410334C0113D73000371CC0400D50FC1454044D43FD51D1F045700D074C1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 1KB
SHA256 49a44556cf3c96072acd73faba5912877d6a09dc120f5d616cc2962746a932cb
MD5 bdac9cc2f616514fcb9fbf7e13d38d2b
SHA1 09eb147f4bd0a4f42a31030574733357db657c9e
SHA512 02d6f93e3fc48a28e9d6bf0744cd725ce55d8ddaf012d0b402720472fbc4578b53297648d43b8dde609b2f4cc87c23e22813b26afe24b4092a18bf76134f4167
TLSH
T1753162B3E4A06F326C92969AF145AB976F2121BA82100F8465CD470913EB2ECA536C32
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 501f116c522168a9aca4c129faae2bfe5b3cefd6cf5edbd2fe3b76ca50f6dfbd
MD5 0cd14cf06c81d5f1657c1e9d9ea3c3fd
SHA1 9752e55db830b529fd5f3ce41393efbfe83883f4
SHA512 b4b64f5dc292b62406cbf966891dc94d501ee2fcca6c224f7b3d89c377bfae51292e3de1c3a5296fefa2758107284e95be84f20691216841284019fe027dff2d
TLSH
T134519773E8149A7749A3C759F8497F52AF3521E59B511F50A9DC0B0C02DB69C2322C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 d5073f10efba8179797704408431e35a6abd52e8801053a3ae66b046919f6569
MD5 1b122789b7d734ccfb28ad5371fe78a6
SHA1 8e24f684570fb46c71180c3acf63fb3a37aa696b
SHA512 52e926444568c0873fcbc8b7a3c71e4664d18750137b5b9b9a382edd966c4a9a56be8e4dfef574597ec3ccdd894839bc9c0bd9ed00f80c690501b13417d502bd
TLSH
T1DE718573A864A9374DA3DA49F8852B16BB651177D6943F94D9DC0F0C02DB3D81322C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 41f12c62a6b164ef74d7969006177b639e30b3fed962bccca38e8380ae770baf
MD5 b0371d8e763771b54fe3605f3b1bc769
SHA1 e7be02327aad83ce65f2e737ff91e26638cfd129
SHA512 6ddb284a4ea618b93f69bcb720ff754c1929fefc21e184718aefe9e7d960c2a50da4fc2a7a3818de8fb392a518990e9b0568bcfdb73299fd4974c94405a83223
SSDEEP 384:zvvsrvyOiyp4+IWA1eUVWGfvvLhNbL1pnV3//rnuMa:j0raxyp4sQe6WGfvL1pZ/D0
TLSH
T166729E720A7499379DE6AD4AFC4A3A1A7FD95577C9C12F88E4D85F0E028B2CC1706C23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59b3e5.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe59b3e5.TMP
Size 1KB
SHA256 eff3c3eb458f3747a4e7b9d4cc33b1fe03e1aa48a664c4db91f7d9d43e4d895b
MD5 80f079f11a0d27d8bd4070925d359bb4
SHA1 0c3714a3fb34d2c655a4b4f9708a0ba41bc44218
SHA512 018f4724efb78c73f2b35133b225c4b1348af5216ce4a5966934c2a3f1999465298f53d4f6cba3f30c2ecab570f50a3d5309372e0cf63d6c52080636a1cfc9c2
TLSH
T16E216573D090AE765C5286A9F141FBDA3E6031FA82140F44A0CD430913EB2ECD636C33
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 82cf94629343fdbbee06996ce71e3b71b0cc1e4e7984b5f6e34709cb354f746e
MD5 e49217f03541a4eb43e8cff5624fa9b9
SHA1 fae902401b0554df20b459e743bb89f8d1a06405
SHA512 0ba2e03e9bdfe3af300e1a13331cb3a22ab9bd778f7fe820d7ee765d78a1fd692dfae8db1770764dc8d6de993bbe0c94f3046edda7a7bafc209fe321666f7cfa
TLSH
T10441D66914EB772EDF00D7BC39E95C49A1C50B26048C0773CD13E2170977FE3A90AA85
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 48ccf91a7adb80082a0afe8e1254be0fcd50b94e84a703ad101005482555452f
MD5 a1e8252789c8e69dd96401bd7e43c32f
SHA1 7a5c4628e5585bb175a1d278acc2941ce445e2d5
SHA512 05da70d8704d18806de70c1924a46c8529cf54cbd0eca2940befbee8d2fe7881e72780d3584953b4341d47e1292d30a9ac59116de24074f0ccc19bfee616b41e
TLSH
T13541D85904EB772EDF00D7BC29E85C49A1C50B2A054C0773CD13E217097BFE3A94A685
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1c05.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index~RFe5a1c05.TMP
Size 48B
SHA256 057749752e0827885bd1e5557bd4f853518cd101ef99ae6d54155ac5d7c4e2d3
MD5 f6a459bc6dd261e47b857906597063be
SHA1 5d8c8ba2c9be1fef93e1435bba49ecd5a7c8eb4d
SHA512 b4c08f3d11bac5b4128281415e081ad3f6c695ff07d9e10e53527ffe129541f67e169061037f2a1d4368d36021448072166900d398d3ee1bbe4ca1f1ab814598
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\GPUCache\data_1
Size 264KB
SHA256 b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec
MD5 f50f89a0a91564d0b8a211f8921aa7de
SHA1 112403a17dd69d5b9018b8cede023cb3b54eab7d
SHA512 bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58
SSDEEP 3:MsEllllkEthXllkl2zE:/M/xT02z
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 874B
SHA256 dff95e2afcb3d5bbe23e8a4e27e270845a3cd7fd66a1a4bb2a22e128d3fb62c7
MD5 633427e0c84bd0cf4133cb769ffab308
SHA1 b56d185db49be42af0785038ec36df8095120d51
SHA512 e4e5b936fb2a02d7d1ddb321e93a0a78da2a82a3e8e6682641a9cf5dc012ad2255961bdc31fbc58dffdb3102f130dc5ff7cbe623f1b9908efa69f8f140bf5213
TLSH
T11A11C0B387A444AECE5506F01624ED2BEE2D0606431C3824C6D4FF67D7E3072F10215B
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity
Size 523B
SHA256 ff112f53a6f274850e3c0aa952ff433ed776f9930e8ecab7571797f750498ef2
MD5 4f38fa2350f5f9a5e3ad0e1808ba4af5
SHA1 051d6b01676cfb090552d92d190d74d666d1ab49
SHA512 8299e1abaf08e29aa395831497f1faad803433d641ca7e562b52012b1cda4baf42c27896fcc71e49120ebc9374138d3712fdb38a9930512d7f8e81bf74f26166
TLSH
T1D7F0249341BAB86A227C0EB76C00BD062E76B0310192F0F6D67680BC61845F35717073
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a6ad1.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity~RFe5a6ad1.TMP
Size 523B
SHA256 a1205a2460f901812b714cdfe8cf90cd8bff2b2a38e2065959b4ab219d7debec
MD5 ea8fef6096f68e5b8cde7f6f9503ea14
SHA1 9ec1d479b92f4bb6dd8562340e68b15849b85bb0
SHA512 6261a7076c55e4f8db83c166bcd23f3b452036bc1f9e4f907931f9b8928b774cd7a99d4f32c6db1b3704ddfa8819defab48b8b26da2d321332b1eecca4faeb59
TLSH
T16FF0245341FAB86A227C4EB76C00BD062E76F1390192F0F4D67680BC61845F35717473
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences
Size 6KB
SHA256 b0b90124fd3f5ca059db05999eb9f00ad13f8917c3050e0c5c408160395d2fd5
MD5 4300c988f8bea3a04b7a6a63732051dd
SHA1 0e2753d70e4aae0c4d05c69a8e1f9ffc41d7e13a
SHA512 7917674c7a177d23ff57109c32bedc99bd345e8537958f0374db150116ea98d387ed476703fad4787d84aec5392f7820bdd59b28483c7c128a5ddad34c1b9fcd
SSDEEP 96:stt0Mtdb9NffAZ8i0vhEgk3jnm/7qx+WVHMb+49+4Am+uec0+45G1idQjy+4H+gW:sttNbf4Z8paNm/S+WiFfW5Gwd7HXoMC
TLSH
T119E175539E286D778CCBE21A7525FB12E3F6112266D10E98ABFD870C19E66CC6207817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a52a5.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences~RFe5a52a5.TMP
Size 6KB
SHA256 6745afe9b7da9fc9f77ef4c8e8bb39c146e434198eedbaa3227b21f9b82a007a
MD5 7fe87098d712cf98d1f66bb0b21bc12a
SHA1 9725dc3c94160e0b95a193aa00d2258e36b5f761
SHA512 9409de483186369e9765ac57c9af62efb9865ff1ec2475b99b1c52599e2f33d23a79a0658203b495d57d9af76a66d358b69f1e6ae92b4d0ac278391a3f71decb
SSDEEP 96:stt0Mtdb92ffAZ8i0vhEgk3jnm/7qx+WVHMb+49+4Am+uec0+45G1idQjy+4H+gV:sttNsf4Z8paNm/S+WiFfW5Gwd7HUoM8
TLSH
T109D186439E2869774CCBE21A7935FB13D3F6102266D14D98EFFD861C08D66DC621781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\5c9e28a1-35d0-43e5-b1eb-ae6dd1273d10\index-dir\the-real-index
Size 96B
SHA256 c9ec3ea5b3c581c307bea6d363b0f7d45994533bb5970d55d3bd3a5903e463b6
MD5 8762cfeda42c5a0837478cfb2bde2faa
SHA1 d9d3c2b19528bca6f59599c3a2755bdcb8e21a51
SHA512 1f9111c4336689877ed6a74fbbe8c0253443fad17dcb466a5770b77e75881a376ae382e6c5cc934f63377756f9d7a8afa82c62e6d1328902a0f3031196511f28
TLSH
T17AB022F02A080002C02203F3CAC202C03B3C0FBA030B033C2AC002338CF23C00300220
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a1435.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\5c9e28a1-35d0-43e5-b1eb-ae6dd1273d10\index-dir\the-real-index~RFe5a1435.TMP
Size 48B
SHA256 caf15472752301eac7f0c486cbe2c43f86fb06bc18a3a77818d6ea979dee4251
MD5 8059e7208e3655796881a663256a5887
SHA1 bc0ac017f422410376953732bd77386366b3b07a
SHA512 ac0d6d9b6f8264f44c50a18a58a4da2d21feb6645b66c77250350b7c2e7e6325ba4ffd70826e069c5423e5490c803a8f4db80bd5da7d330f6955471678e6b4c7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\71abee82-fea8-484e-bd55-866cd19bd5e9\index-dir\the-real-index
Size 96B
SHA256 e992f0ef29a159d306946f2bb8d96591e8faf361a037333f6cb3cf4f63fd39e5
MD5 969e00cc05d9c799b23348998ffcf6aa
SHA1 ec2441f8cf1f557871f3f5b6e830df042aaae6c8
SHA512 2f146da65862831ea79aef1ce6034997bb5d65c567e261484f32146bce9d8c668a904224ada738c5b556f0d5567f1044af7279118c0ca5f82add2e3a02cba2d2
TLSH
T154B011080230820AC0000BB820C28AE2A3AC2E0AC3820320A0A0EAA8FC2CA2280000A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a132b.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\71abee82-fea8-484e-bd55-866cd19bd5e9\index-dir\the-real-index~RFe5a132b.TMP
Size 48B
SHA256 e3f3842922208d483e234f9cca67c259bc6d18dc6f18cb620f2d7005f363144c
MD5 3f87fe3e259e97e0a05e4f235fba2778
SHA1 9f5d670f71e8529c540047d3f523328f17d11635
SHA512 9a856c69b0e31bdb1cc801e4f6375e2a851787927697a2554e3948068d4f0299c97bbe00d8045041263b58cf6fcee701e5133ca36be5c80401496176e6d57128
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 3b5e05f92b38b2265a0439fc9c8766b768a8ca8eaffda04d20904a94aaf5330c
MD5 a2ed3fc5d45feb1cf1faf019da32dd37
SHA1 54bc1f65e173f2b384a0c1aedf57bd01e0cd19ef
SHA512 ca054bde2f5d896efe2cbfb77ad5dc49635b69ed542640889285198a13b32aaae1170180252f87fb2ab98fc1d6d47be082e69d689b71f65b27239e0ef04e5da2
TLSH
T1A6D0A72E420448351BCA84C0A480E052411D4E179A46E052BD5AB442783F0A9D9075A9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 79559a5286648f604720024ed5cde5192f8b1f0596f17420b1f3bd30015c4b33
MD5 57fe4534fcecc2f042a25e90701181fc
SHA1 6692094bc8b084d0b91e62562f14c4b123d58e6a
SHA512 ca4482c3e962a235f37ed369acf7e1d087626abf36726eb833c5722d462b3b730c6e86a6794e82b2737518af5311c049d9f3d697d6c3df558739b0b0636367fd
TLSH
T1A6E0EB2F82004C3A4BCE88C0E480F015401D4D2B5A82F062B86BB4457C3F2EDCA031EA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 6b4615703bdd9a29029da94d7eb5c9fc7748ceafd8b44ca7dc0349576bf252f3
MD5 94b61e7de905e331e569374d0b5d8c6f
SHA1 ec61ca45b0bb27e8fad18e20d37f4c57e1142be3
SHA512 ce8ebfa84fcb92984fe7f99c3ff07046ba44b880ef26bf9ec18ed7b07eadeda5ab12e1bdd265691e987df9306af160bd23b0bd4fdf075a9b6f2dae90b31aba3d
TLSH
T19BD0275FC1044C3D4FCD49C0B440F155411D45575681F456B86A8445782F5DD96075FB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59baea.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe59baea.TMP
Size 141B
SHA256 a2365735c4c1f5d7c65033a52e7b2e989e579cfb655906de65db0dfec41a8a8b
MD5 b0484448dc724ce01440c11083662fa7
SHA1 c7b4a7e6384fc6bb57a9163b037bcbd001ca40e4
SHA512 195f5719b8a41b11d2ac25b5bc7fdf5eb53db01865e5a34c746ddbf4acfe686c4137cc16658bf2c46cabe75cc2f25e99e0edc18591c726ef056049a6a7b28481
TLSH
T12DC02B6F420008215B8A90C14280F047911D4F0B8882F0A4D48E3042343F1EAE9070FD
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-05-11_22-52-30.01.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-05-11_22-52-30.01.log
Size 3KB
SHA256 6b008518705fa63b7d1e35bfdaa786880f345783a5fd5ec53f30584cf997204b
MD5 ee69c6c03c3fe7fca4312e1d6943c3fe
SHA1 4c2c997b6b27ff4ba0277840840a967ef61c1370
SHA512 08b09666c4bd2de2304c4038ac2ec1b7ff1e1548014832b69544c04591c43e4c5490e065ef91c542a7b80f529f1c8d9b4276603396c2af64eab22ee1b6f51577
TLSH
T184615E8555DA2475E28E1C4A91213F18876DB28BB3FD34687FB0FB4A558E12C4E3C1AE
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 a31a22fd34ea2a8e759e0fe916ce57ff983a57361335b92a309ca1c926615522
MD5 6a9b924a681c5e1be67e82959aa8f816
SHA1 53d5dc80aa81345075fbdc7195243c61d37c96c2
SHA512 7fecb89460958726a4a93a9b8e2ff0d942180246d442cdeffffdad4c006c336cbd651b992d1c597d1e7f7fa1bf42d855c1993fbaad7556d981ac4178477da8f9
TLSH
T1CF51C42C0514A2BEDDC7864BB55F3E234AE741A4EFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe59b03b.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe59b03b.TMP
Size 2KB
SHA256 9059aedae41985c3bea5574bb24bdfc779a81a7950b8e3d391c3b6c2486c5888
MD5 1dfd4312dabffb5d401c38fffe675cc2
SHA1 1aa7fe1743482b829a660e74791fddd811f2c5f3
SHA512 e10fb1041d771a8d79b900cb2ec7c226f1487b78c9909d53e91c512cf53332672c7a16108797ba3b3e280fb747ce2cc9594c6deb653a321d70f4642521d515ec
TLSH
T13C51D52C0614A2BEDDC7864FB54F3E238AE701A4DFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 c000aba975c503453a519873cab91cee02373c45e8b80263bd0fd924ab2714fc
MD5 59721d3fbf3d294edb5f57ac5f8ad1fe
SHA1 c42612cfd197ad3685c77cc4d4800443abcf2b9b
SHA512 2d4fc63f6cf08c8cf74ffc7e423c770fe15d2d0c8692831cd1d3817ac6c25f2f4b3fbc79d2e762a5217a54fa94351b08e562a4767291014dd705e2f7035c86d5
SSDEEP 1536:4/kSvkXoP16CjLJV9UBYDireji7YDerearHdkv6KR:biVGA
TLSH
T1C4A561A11845B6FEDB8AC2B8673C2F18B5FC4DB78C415024DADDE61D70A346A73138A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe59cd39.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe59cd39.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 4KB
SHA256 2f66be2fc2e400a194d166ac60d24f1190c7c0a51894fef0218b4e0079cc7e03
MD5 dab4ce0290bbeb3d1601afcc7f3de428
SHA1 e4e5fa2d591136ae9d5cd23f0fc0d1e73fd7ec10
SHA512 0452c5581c475095044f8b74f5503c19971c4d2da98eba24d24ebf98426fee2dee388f2e5cbd14010074ad61907a90dfc407217c8f2212d2a0b9c5f7c724b85e
SSDEEP 12:KbrCyPC/qtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbf:KbGyPSqt8VtbDBtDi4kZERDf
TLSH
T1B281E1C176787171E0AA61BBC8F313A717799269043392A32DF25492DCC19CAA42A1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 6e6845c6879792e087c916eb7e52294aac1d886af5f8c31f2c096e29d5e1ee22
MD5 20048a1e7830653004635342c6f8edb5
SHA1 a2ab8b58d7b160bb69124c07bf4b74d7432a3253
SHA512 4fd90250abaf3b48c51a9f388c4659a876db649812fef2dfa138577d77f7a86799eba4b1e9b2690907bcb6a8794112d9f351890b5fe5e1b56ffa869865e778ba
TLSH
T134C02B030E1762330B500E00C6BBBEC2C5887D87013018604539C04C0B286FEB00010A
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 360B
SHA256 8779ec4cffe7d4e4a40cab2ae4ed37ad9700a0b909b70d05aa1ad488faa64fda
MD5 fd47854f8ea716415d81d4d6d2f1ed4b
SHA1 fdc9fdcbb785639221c000a79bd9a0c74aa1b9bf
SHA512 4a9a8c834de4cdeacaef55cda908339362449135d923804191107e9bad25e57f3424cd746b73ea3c748d9ebc6c91922f66859270b9dafff2ef19b22b1a67ef1a
TLSH
T1B2E0C01B0D2D463757500300CE756F40C9B4B887C390D86452BFC34A0A147D8B001356
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 360B
SHA256 371b4f043af5169c09d6fe90dd73e7a7243f169b1a858fd61df5a06954d79fda
MD5 cab9a7272248941a6f80cc3ba5f0bcda
SHA1 ec2911b75360e53aa82cbfbeec9877d4033772c6
SHA512 840b1c25bc1a83e3d4cc4dd9bae4c5c2110d021f83cc84e05aff7c0382e22abbe6ae13455287f54c423efbcdd6b9d9c6c03f719e197e2bc4c1e62ddba7626d2e
TLSH
T1ABE0C01B1D2D463757544300CE756F40CDB5B887C390DC6452BFC34A0A147D8B001356
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe59af32.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe59af32.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.5MB
SHA256 1f2a34f84b7f4171bcd0d40c80acee8aef0d9dc3529deb3e372bae180f571c14
MD5 b690b2420b21107e633b4e325768c1d0
SHA1 8f3faaab9eb83af7eb1c9963230e5980642c1dfb
SHA512 64b900fb5cefb8dec747c768061ea95d4ae2202127ae41cad46a59ab5e5cdfaaa78743d6383241a124e3ee4e2015566eb8f05285e16c12669745e23d293c90f6
SSDEEP 24576:DsOJ4Ly3kFbfr19RGKrestu44wKOwVuJaua9Y4RL/Tfrls4ON80gzl+BWRUAQg7/:4Lyijr1PGKltY7ls4Om0gz3UFoZ3x
TLSH
T1C5C54A10A7E88E2AE5BE1B76E170126117F2F9896772F78F560C60BC3AA33544D513B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 8KB
SHA256 c3fa333fdbce95d504aee31912993dc17ab31324428f557ac774f7e98b049b99
MD5 3488a1749b859e969c01ba981036fab6
SHA1 a65b72461fa14c89fce0d025e43454830a1f7972
SHA512 7363003422bdaabb7943439ee1e846867f0f3d0baed3456424544a81989bd2d142a411cf982d90e4158314d410cd1a1a4ee33d8707219b4274cd2841705bcecc
SSDEEP 192:BSHYMeY9ayCss7Db0cvhlCZMNvgKiMKEl7eJ1XDw65pz:obBlCsyDb0cvbCSmEo1XDvz
TLSH
T1CC127D8FB85F4F9651593087F2C409051B0FECA9F990A6A7AB309BFC31614CACD24F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

endpoint.json

Path C:\Users\Admin\AppData\Local\SquirrelTemp\endpoint.json
Size 610B
SHA256 1578d085af8165ef971cbb88d327e07c2b82c34eff379fcb2ab030a188b2981d
MD5 34b2a3afe7ae8ad113f54e64d2f62111
SHA1 c0afa4727bab161b777363fd49225d7ef084c16e
SHA512 d6a8a70603157f0cf4b4d2a2992b8082d30e35aab7e47f973e8bde5841dc5528f7a62a8d3889093343f0a806a1161965126140345ffcb4cb0dbd36e56f155720
TLSH
T1DBF0F97BC7C280115FA84383A64BAA6DB91B6A4F3CC8B559C0CC850922119B6D7425BC
MD5 SHA1 SHA512 TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 1048ec1f4f0978e4f3d111c22a2db30bc557741a2eaade6fe4547045b87d3e9b
MD5 9d64aece6b302629c4809c6ca9ab0903
SHA1 c775fde2fb31eb76e6cde771b55579f55810da27
SHA512 e48afa3c08e3df2b3a01ab82fc0220f5167d1a6418b96e5ff2f4d590121a152406d2ad5a94c34c817940098ce00191cd7134465a4e56838e491b2f69b17d4fba
TLSH
T1F2900218084149956D39DCA29440E586E90470211D396010C0B1665C585174863829B1
MD5 SHA1 SHA512 TLSH

Submit Download

CFGCC4F.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFGCC4F.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 1KB
SHA256 beea286871522f2022ebd698bb76a2adefcc3751521cd8e33696c46a843ff00f
MD5 9dba61ce1a4e1def7c75bd20e624ae6e
SHA1 83c0a8ec670fec63b130788a7a11396757e5155d
SHA512 7e2e707360ac49575fa619f2214849d1d63daf801b870e74e059ba81550d212d236d06857e4622b320a00b97dba996d84729032b5718bfbf171f14bb7183b06b
TLSH
T18221F10359D45E5F4BA0224963B06F8F7A7E739322453605B7B4C28862024FFDBAE0CE
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_hbwldujg.bee.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hbwldujg.bee.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DcryptDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmAEAB.tmp\DcryptDll.dll
Size 20KB
SHA256 ad313f94da4ab0980173e60cbda7d1510e92fb49d2359224e0f89dc3ec0584e7
MD5 0a5e967b684d6f3db31cffb619cc0222
SHA1 2ed62db69f3ef5b0294805e326e3f41e5b3b0ac5
SHA512 9cf83f8827aafba394befe1a7c91cf6e12ccadc0767fd1934a823e951b6b6cb24ecf7ee56a4c012c162a41900de0c5f1820ca6fd6836bc474881d9f23e966954
SSDEEP 384:k3tsJOACduC6f6o14y5+UKjNLUtTQdCLXXCBwnp:k3tsJOhuDC44y5uLEeCLXSBwnp
TLSH
T1E492D750CAD10420E0B322BA7AF955129CF87E321836610FFEB7065B6D78AD76767732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsmAEAB.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\uk_tmp.txt
Size 1B
SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
MD5 9dd4e461268c8034f5c8564e155c67a6
SHA1 11f6ad8ec52a2984abaafd7c3b516503785c2072
SHA512 a4abd4448c49562d828115d13a1fccea927f52b4d5459297f8b43e42da89238bc13626e43dcb38ddb082488927ec904fb42057443983e88585179d50551afe62
MD5 SHA1 SHA512

Submit Download

hBeRqKUUTm.exe

Path C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe
Size 42.6MB
SHA256 0855861fc39342ca8009838782c39351be5da43e60809aa13322f11cd95d59ad
MD5 28827bb745df0e8f5ab4d809eba41ac0
SHA1 cfc0552b45b3f66969aa1eaffceb4c12e7636323
SHA512 6a907349ecfd72ab84c26e5ffc3ee8a57850c72f50f8c21557d2ca7db3b37f000968ebd4ac0f5bbb7fbbfec7bdd07880a0fbf07d96583fede26ca553b932aa66
SSDEEP 786432:W6q5OMGvRMbCubjuyCWwuMHIMtyOeZ4hYTpBrinrSER8e0TDGg8em:WjYMGvRM+YuyCWwuMHIMtyOeZ4hYTpBC
TLSH
T1BBA7AFF3B619C135F16D51B84D6457DB803D9C250BA121FBB2487BAA1A31ACB173AF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyBpXlX.exe

Path C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe
Size 1.4MB
SHA256 c8db62bed2305b35860ba601c926f664da5c49cb58db6e364f0ed2805af511f0
MD5 7ee6219d0f497752aa7f1c129ca50bc1
SHA1 68bec1b6c594b6bdaf74b4062e4b3c477aa6a1ad
SHA512 a91760aeb550d5683ce0222f40addb3507b79ccf10199c6c5a4773d3b3fc0bcf874360202bfcdca0871da5efe94b94b24fecb72dd5ebeca02939928c5a534094
SSDEEP 24576:E9Yu8GgnSf7uw7J8qyKD0OIqKT//pIgl6A5H2TuDWkd3WZZ7SuW42C7Z32o3:zGMo7NSK/Iqwp/6A5Wgz501SuWYZ3V
TLSH
T1F965E05026A0C176C6E20732C565B375377D6D2C4F3046DB63A4B2DDBA7B1809A32AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 e8b29a30cbb74f3d73e0815f2fd43f4c9c67fe658825b8269b56dcba3c77c363
MD5 fdf521b810372be57e20f42f5a5917f9
SHA1 9c96de6a467545de4a32e9f9e4671494c2316349
SHA512 c74f81f34acbbed2bb169f1c05a99b760793ccec6f9ec604bac962a46cc28abee893c0ead515295b6b71ff1cf12c39e0661d61665fcf664fae344acc1df2e745
TLSH
T19BD09526D334F773716E3E5C0C28507A1C10F7D2221746172C164961F331350D4C7168
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 403KB
SHA256 311f644a8cc871e9fde0dbf9126189f11cf14534d8aadd824954595b56dbe5d8
MD5 665dc9cb1017f75370dead01c35e5342
SHA1 92be12e735b77849181d94779fec0efcf26342b5
SHA512 072bc616feb46a3f297671bbef8c2cf7a15416b95d3cacb2bc87ba0db6269d02c95d3dd6c51dd941398d367b4aca8a948e3f5e73f276d52ba150d8fff2c002e9
SSDEEP 12288:h47eobnoU0GOxiz2QQIl8yrjroV9ueRvu:G7hUT3xiz+uLrfoV9ueRvu
TLSH
T12494BF6A2C3FAE681ABC41A7F94C11577DF21FD8ABEDC132C24DCD1917D10899AB8193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 533KB
SHA256 c56bba6fd6236e30d9b5bb7ffea33079a143819fe1f08db346ff7b96acc9cf00
MD5 202faa607d44d8350d8d5ab435a8e81e
SHA1 244389e040acd9798f1960135b4b37e7711356fc
SHA512 31fe7f1baf7ab2964ca468a686a00e724f5466daf949df5173e4bf3ed575c3651447f990e72f2c0465c8762d258f1238f80ee6948f09bf6d979bee62b66757af
SSDEEP 12288:hU43LGMwhDLctEYGzqIx+Tsj/KKKKXE49ckVd:K43LXwm38VEEckVd
TLSH
T1FFC47D57193E7D0D26E05293B81C49D37DF223809AEDD031D39D9E6816C6A2EA9F12F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 166KB
SHA256 32c1efcf15430df8e87207bde1916c807378edf6bd9552f02aeb6d50ac56f752
MD5 5b0756dc69ec9ed4b6dc5f4948d00c91
SHA1 e6938bbe27ba077f95b925c92c8c5e71875c76cb
SHA512 a16cfbbfec0311cded46376ca2d04bffbeb36c3f80e84ae2052671bf2bc6a8370d293a8df606b2f311914f90513cdbe393c99533284f5a6c4532b49b4bfb0c1d
SSDEEP 3072:hhIKRyikUOIya0rhMcnSfTSFqeSy4In48H0gFuHNJbmeqdyYV5gY:hh+ta09McS72+vI4dgOxigY
TLSH
T1D4F39EA7297D6FB839684183344C04975F651360AFEECD32C39ECF1409A66A726F817B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
Size 942KB
SHA256 bc1c0a2fc2b84a938fae034baf88c6cc43857b67b6814c5eb56824fa2835fd68
MD5 5af667ddc81dd731948caa2d64ebff6c
SHA1 327a0f7ce09a3f6b1574b27d8f69067895d691c4
SHA512 b367ec266fe7877f6e9343f9f7a1a4f3dd822543c544c44ba976f09dd827cb5c4febc358c663ab3363464e89e5df2f032d8f6e3e4c200c9264b930ecac4eebe5
SSDEEP 24576:FGp/QoLvjfJVdmHLfU9rKqeyV851Kmv6Gd0xnL8Sh:sp/QoLvlmHQdvVGv21gSh
TLSH
T10625E0227390D077D7E301324A4687A961BBAED159EF8E4377D43F8D8E3029D9A36B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 180KB
SHA256 4846e03250931965df77d4fb897fb3d100d451b72a7910a2840630195cfe1246
MD5 30806c3b99d158af70ad6448bfdd7716
SHA1 d557aac16144b0ff77759b7562aeef6c346ab110
SHA512 04e1e86c842870f02401cd42668095a81bb6c1b3e8c47bebf7d333453453a6ce65442339ff5ce1f51317b471c0f31e0afa7d877aaa861535273c8f944bd4aac9
SSDEEP 3072:Xhhg05n4/1J42BVXU9w9x32R68wJZzjz+Ifwaa65LjI2ccF6SarDEFzjqF3:Rhge4tJ4UEG9xZfIaaAjI29narDEY3
TLSH
T1B104BEA4434BEF34AD5E41E3B0611D9AA3E9308CF2DC6354AB9B8D2104D857F67F9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 56KB
SHA256 2ede6fc732c291281f5e51563a4239e38bc9cc57c42719836d51690edf46c525
MD5 02fd4fd8807ff36f506029f6d161c6ea
SHA1 725066f05fb2dcdb6d50b398beb5556ce817cf70
SHA512 71714a3696a1e4ddfa55fbadee60727efcf246a53c6ac2f2fc112e14d562f61b231dca120cc67bc665d510bee2d136df1937ba7c76da9dc7bebbb67c6ffc5ae8
SSDEEP 1536:+2xNv/qrXz0t8NADTop9ObO7BqTfHw+gPRRwZB1p04:+2xNSgt8N7wb4qT3gMNpB
TLSH
T19143CF440289AFA2F154C3737E59D98706D89F802FAA7537A3D8BD252C58F7B75F8022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 942KB
SHA256 7efd0f02d171b52f803c4793ee31070461f753387307d26d8ddc319fd129ef7d
MD5 6c4c052cfa3e24a05af2ddaa474685c9
SHA1 de88662a97db0c89c31aca744f3c89a57421c0fc
SHA512 a5577ed49d7a63e2b7eb2785c672c35c9856ff150e9baaf4a226c7797f030cd152d650aac8b9b4edfc62adeb0e3008b67208acbba0e56c9ae101f541f7701e4a
SSDEEP 24576:Fyp/LoLvjfJVdmHLfU9rKqeyV851Kmv6Gd0xnL8Sh:Ap/LoLvlmHQdvVGv21gSh
TLSH
T1A725E0227390D077D7E302324A4687A961BBAED159EF8E4377D43F8D8E3029D9A35B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrin.er

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ntrin.er
Size 168KB
SHA256 0250643af857245804b1836a240104cd8122c995d1e63f45c6ab6cb4d1065532
MD5 423ea290beb120f487d6831083dd1f87
SHA1 beec3f71d604ebbeef52bd03407b1fa52e68c2d9
SHA512 082915fe636a6bf88dee3eba9153b75542b049d82878b510cce7dd633b83b53cc8b81db513ed5a47f3d67b715f7e45c5c4182ffc14fcf36b89552e149721f553
SSDEEP 3072:kS4Cu9rV+QT6ZfRiflr3PQ1InKMzjVFPumXrA29hJ6QSxHPmbrF8vodrQOs+:keFRi7kIKMz7Bhs+
TLSH
T1BBF38DA32C6C9F78B9689183384C45930F641760AFEE9D33839ECF6505E65A762F412F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 163KB
SHA256 23b5d84ad8a53b77dbda0960d8423e558bcac4ed3fd6221b60370fc94452495c
MD5 bdfa1e1ac89f99fdcfa761182d745bd0
SHA1 536c22b1e037456b55ca27bb9ac87a0f664e3de6
SHA512 579ca037a0ed37f052011300f812469ce49d5c7111340ff33a2c4717e9ebd324b2ff468552da99f7755a6a49bab7d913bc1c577b95474386cb5ebd92a97f979a
SSDEEP 3072:qtH9dODPB564nXjtFCH0gVqsxCua4DwJ47PreIV6V2Cpbnhdd:k9dOrBU4nqWua40J47zeIVYpLZ
TLSH
T1A4F3AD4C421AAE74ED6E81F3F9600AE593D53140F2DEA3967F2AED5104A423F52F8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yinma.vc

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\yinma.vc
Size 478KB
SHA256 cc734def371a00e17d744833b7a61f030051d0149712fba9d63bb7400271b12a
MD5 cb2c7240e7b48f49f0f140a0ab5fcc51
SHA1 5732767b46198f321d73fb4a9395fb44de3803b3
SHA512 476651d071cdad81fc10ed4d23857b47cccb0a7d686fe94e8deee220d78d81d02532291f8c044c4965cec5d90734cfe9bfd35da61f961e316fec70d0a4d37b81
SSDEEP 12288:HCsJxcMXlPRu2/Awl6kdd2a+Ih9CTnRdzpo8:HCsJSMlJu2/Awl6kddf+ysRdzpo8
TLSH
T100A40919149AAF398180484F7A1DD121A977DB48D22FE23198A9EC1A7DE4F21DFFC1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIC80A.tmp

Path C:\Windows\Installer\MSIC80A.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFE21.tmp

Path C:\Windows\Installer\MSIFE21.tmp
Size 113KB
SHA256 cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36
MD5 8fa4088a730b967d85df562fd5ef7d5e
SHA1 629db9229f4a4a691e14f38f4dbffba157fa1ce9
SHA512 1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2
SSDEEP 1536:xS8CWyksWMcdMWBpjr+UsgtFmVrrXL1MgbIurgnIMolaeB8DhIm+uBSw:xS8SgMq+jVrrb1MMBBMolzaDhI31w
TLSH
T19AB39D41BA908432D5FF2D3C1578DA621E3E79701FE09DAF175851B90EB43D0AB38E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a301.msi

Path C:\Windows\Installer\e58a301.msi
Size 22.1MB
SHA256 f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf
MD5 b848c1d883bc210453286fc3d967e745
SHA1 79a18e6d14db69a56f87708c3d14cb3baa83ee98
SHA512 b4f1e624fe65815d21925f6dd8fe6742e5e3fc6f5efb97d6470ca530e7901dd663c3ee13b4236c55db38777c953b602d9beacda450a77c6157524b65ca08f046
SSDEEP 393216:/A4EQoVqkO+fFgTOfPPNiv1P8z1FhO350N+54Ktq6UWP3knuptZgNFRdu/vqIWB3:qPO+fFgTOf3Nih83wp0N+KqMuptW/du6
TLSH
T19C37333E2A889325ED83DBFBD8F4C42CC4D733435D161067E99EDC6992E2A089DE591C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a308.msi

Path C:\Windows\Installer\e58a308.msi
Size 13.9MB
SHA256 636115933ab2f678c8d9eaf50e79e47be094436d438565fa30b0f1ae3d7362f4
MD5 8444b913223f0ebe0d7eb0867ece55e4
SHA1 43028a51223cbea7b405b18be0a59b42f7777136
SHA512 a1617c7eab8ff2922e9ba1c4273db6917cca25d3ac886aa28ee59dee45f4dc0a406be0f5251a189fd589720635aeeba8781f0899fbd3cb080ed82ad3e7c7596b
SSDEEP 393216:PMyGsr31tl7C4WYe47SXsxbOLq5a38wnt9lTmr7:PM831jG47ZIsZOLq5a38wnFm
TLSH
T170E63353358AC932C2BA0A7826BB97556B7DBD254DF0CC0B5710BA4A2C723C01BB5F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 c121bc739a15f31916ac16a7e884af0a73d8e30916b011b422091ceba7da12d0
MD5 db906d753fce0cd970f71f85fb0d1bcf
SHA1 63a2f68d50e550b683bd90cdf6b2ab2c775487bb
SHA512 397c1428ec682534599c65234e44ad020eeabc3293ad7eefc60c4b056c408e54df4119b4d35547e1698bd2e6765d6f9467c690029afd6de956590402a057c833
SSDEEP 24576:Au8m+1zLdoO/vvTLbW0ORG6A1d0zMlUyYymt2r1VsUqVuzN54/19sSvBh:c
TLSH
T1D447B62436F92101E7F7AE3CB8F0AA234D3A7D579C19DE8D45411B4E0921BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e92b00e2-a6bb-4817-8d02-29926f1db4b5}_OnDiskSnapshotProp

Path \??\Volume{1143f8f6-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e92b00e2-a6bb-4817-8d02-29926f1db4b5}_OnDiskSnapshotProp
Size 6KB
SHA256 85ecd3253e2cf66ee63ac9302c08ef2b4191f6d09fae5763a7a21176d72868ea
MD5 f9c4f59f4edef911e0dbf90ed63f6c82
SHA1 778c30d71c185db4da083dbfb9cfbf93758067a5
SHA512 fa47ad6ba9d63d48a7682f6ca96e5c26c7032b95dd736a60e64d1ef6a947cb07c388da83b0bc4fbe210157e2b7be931a24460c35ed24d101bea1b637182f0664
SSDEEP 96:FRKB3qqvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:WLb++ZVmN
TLSH
T118D188085AF54711E2B3AB3128F14557A877B912EF33CB8E0198638E6670910F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/748-736-0x00007FF96A7B0000-0x00007FF96A7B1000-memory.dmp

Download

memory/864-1265-0x000001E7BB140000-0x000001E7BB16C000-memory.dmp

Download

memory/864-1266-0x000001E7BDEF0000-0x000001E7BDF17000-memory.dmp

Download

memory/864-1267-0x000001E7BDF20000-0x000001E7BDF5B000-memory.dmp

Download

memory/892-755-0x00007FF96AFE0000-0x00007FF96AFE1000-memory.dmp

Download

memory/892-754-0x00007FF96AB70000-0x00007FF96AB71000-memory.dmp

Download

memory/1532-72-0x000000000BC30000-0x000000000BC68000-memory.dmp

Download

memory/1532-641-0x0000000005850000-0x0000000005868000-memory.dmp

Download

memory/1532-33-0x00000000057B0000-0x00000000057CE000-memory.dmp

Download

memory/1532-42-0x0000000006720000-0x0000000006C4C000-memory.dmp

Download

memory/1532-70-0x0000000005610000-0x00000000056A6000-memory.dmp

Download

memory/1532-71-0x0000000005850000-0x0000000005868000-memory.dmp

Download

memory/1532-32-0x00000000056E0000-0x00000000056EA000-memory.dmp

Download

memory/1532-640-0x0000000005610000-0x00000000056A6000-memory.dmp

Download

memory/1532-35-0x0000000005F80000-0x0000000005FE6000-memory.dmp

Download

memory/1532-45-0x0000000006F30000-0x0000000006F56000-memory.dmp

Download

memory/1532-31-0x0000000000A90000-0x0000000000D0A000-memory.dmp

Download

memory/1532-73-0x000000000BC10000-0x000000000BC1E000-memory.dmp

Download

memory/1532-643-0x000000000BB80000-0x000000000BBA9000-memory.dmp

Download

memory/1532-644-0x0000000007060000-0x0000000007073000-memory.dmp

Download

memory/1532-101-0x000000000BB80000-0x000000000BBA9000-memory.dmp

Download

memory/1532-645-0x00000000016A0000-0x00000000016B0000-memory.dmp

Download

memory/1532-646-0x000000000CA00000-0x000000000CA10000-memory.dmp

Download

memory/1624-648-0x00000000011D0000-0x0000000001266000-memory.dmp

Download

memory/1624-65-0x00000000011D0000-0x0000000001266000-memory.dmp

Download

memory/3472-264-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/3472-624-0x00000000007E0000-0x0000000000876000-memory.dmp

Download

memory/3472-265-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/3472-263-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/3472-257-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/3472-580-0x00000000007E0000-0x0000000000876000-memory.dmp

Download

memory/3472-266-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/3472-623-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/3784-629-0x0000022325770000-0x0000022325840000-memory.dmp

Download

memory/3784-627-0x0000022325770000-0x0000022325840000-memory.dmp

Download

memory/3784-631-0x0000022325770000-0x0000022325840000-memory.dmp

Download

memory/3784-630-0x0000022325770000-0x0000022325840000-memory.dmp

Download

memory/3784-628-0x0000022325770000-0x0000022325840000-memory.dmp

Download

memory/3784-625-0x0000022325770000-0x0000022325840000-memory.dmp

Download

memory/3784-626-0x0000022325770000-0x0000022325840000-memory.dmp

Download

memory/3784-588-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/3944-609-0x0000000180000000-0x000000018008C000-memory.dmp

Download

memory/3980-198-0x000001FC7FB30000-0x000001FC7FB3A000-memory.dmp

Download

memory/3980-199-0x000001FC7FC10000-0x000001FC7FC2C000-memory.dmp

Download

memory/3980-159-0x0000000180000000-0x000000018007D000-memory.dmp

Download

memory/3980-197-0x000001FC19600000-0x000001FC196B5000-memory.dmp

Download

memory/3980-196-0x000001FC19330000-0x000001FC1934C000-memory.dmp

Download

memory/3980-188-0x000001FC7FC40000-0x000001FC7FC62000-memory.dmp

Download

memory/3980-178-0x000001FC00D30000-0x000001FC00D3C000-memory.dmp

Download

memory/4396-845-0x00007FF96A7B0000-0x00007FF96A7B1000-memory.dmp

Download

memory/4720-83-0x00000000068A0000-0x00000000068BE000-memory.dmp

Download

memory/4720-93-0x0000000007880000-0x0000000007888000-memory.dmp

Download

memory/4720-51-0x0000000004D20000-0x0000000004D56000-memory.dmp

Download

memory/4720-86-0x0000000007600000-0x000000000761A000-memory.dmp

Download

memory/4720-52-0x0000000005450000-0x0000000005A78000-memory.dmp

Download

memory/4720-53-0x00000000053F0000-0x0000000005412000-memory.dmp

Download

memory/4720-88-0x0000000007890000-0x0000000007926000-memory.dmp

Download

memory/4720-85-0x0000000007C50000-0x00000000082CA000-memory.dmp

Download

memory/4720-59-0x0000000005B80000-0x0000000005BE6000-memory.dmp

Download

memory/4720-96-0x0000000006150000-0x0000000006168000-memory.dmp

Download

memory/4720-84-0x00000000072E0000-0x0000000007383000-memory.dmp

Download

memory/4720-89-0x0000000007800000-0x0000000007811000-memory.dmp

Download

memory/4720-75-0x000000006D380000-0x000000006D3CC000-memory.dmp

Download

memory/4720-74-0x00000000072A0000-0x00000000072D2000-memory.dmp

Download

memory/4720-90-0x0000000007830000-0x000000000783E000-memory.dmp

Download

memory/4720-87-0x0000000007660000-0x000000000766A000-memory.dmp

Download

memory/4720-64-0x0000000005CD0000-0x0000000006024000-memory.dmp

Download

memory/4720-91-0x0000000007840000-0x0000000007854000-memory.dmp

Download

memory/4720-68-0x0000000006310000-0x000000000635C000-memory.dmp

Download

memory/4720-67-0x00000000062D0000-0x00000000062EE000-memory.dmp

Download

memory/4720-92-0x0000000007950000-0x000000000796A000-memory.dmp

Download

memory/5776-1487-0x0000000004C20000-0x0000000004C5C000-memory.dmp

Download

memory/5776-1472-0x0000000004B80000-0x0000000004B8A000-memory.dmp

Download

memory/5776-1297-0x00000000008C0000-0x0000000000956000-memory.dmp

Download

memory/5776-1509-0x00000000027F0000-0x0000000002804000-memory.dmp

Download

memory/5776-1508-0x00000000008C0000-0x0000000000956000-memory.dmp

Download

memory/5776-1485-0x0000000004BC0000-0x0000000004BD2000-memory.dmp

Download

memory/5896-1922-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1921-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1918-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1919-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1920-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1923-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1924-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1910-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1911-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5896-1909-0x000001A3868D0000-0x000001A3868D1000-memory.dmp

Download

memory/5984-66-0x00000000006E0000-0x0000000000776000-memory.dmp

Download

memory/5984-576-0x00000000006E0000-0x0000000000776000-memory.dmp

Download

memory/5988-153-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/5988-154-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/5988-155-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/5988-152-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/5988-146-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/5988-176-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/5988-177-0x0000000000570000-0x0000000000606000-memory.dmp

Download

memory/6032-47-0x00000000008A0000-0x0000000000936000-memory.dmp

Download