f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20251017-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20251017-enlocale:en-usos:windows10-ltsc_2021-x64system
submitted
11/05/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSTeams_680.msi
Size 22.1MB
Sample260511-1p8phaex3q
SHA256 f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf
MD5 b848c1d883bc210453286fc3d967e745
SHA1 79a18e6d14db69a56f87708c3d14cb3baa83ee98
SHA512 b4f1e624fe65815d21925f6dd8fe6742e5e3fc6f5efb97d6470ca530e7901dd663c3ee13b4236c55db38777c953b602d9beacda450a77c6157524b65ca08f046
SSDEEP 393216:/A4EQoVqkO+fFgTOfPPNiv1P8z1FhO350N+54Ktq6UWP3knuptZgNFRdu/vqIWB3:qPO+fFgTOf3Nih83wp0N+KqMuptW/du6
TLSH
T19C37333E2A889325ED83DBFBD8F4C42CC4D733435D161067E99EDC6992E2A089DE591C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1268	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
1660	hyBpXlX.exe
5652	hBeRqKUUTm.exe
4280	Update.exe
6088	ev2f79.exe
5964	ev2c34.exe

Loads dropped DLL 20 IoCs

pid	Process
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
5652	hBeRqKUUTm.exe
1096	MsiExec.exe
1096	MsiExec.exe
1096	MsiExec.exe
1096	MsiExec.exe
1096	MsiExec.exe
1096	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\vss_tmp.txt	vssvc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vssvc.exe.log	vssvc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
5736	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Community\Facebook Installer.exe	hBeRqKUUTm.exe

Drops file in Windows directory 43 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\english_wikipedia.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI96A2.tmp	msiexec.exe
File created	C:\Windows\Installer\e5794b0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7F6E.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1640186749\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2139782298\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\female_names.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e5794ae.msi	msiexec.exe
File created	C:\Windows\Installer\e5794b5.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA7D9.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1178944502\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\e5794ae.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5794b1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\surnames.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\us_tv_and_film.txt	msedgewebview2.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI7E06.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA40F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_347022303\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1178944502\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1640186749\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_347022303\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_347022303\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\Installer\SourceHash{C6B05020-75C0-43BE-97BB-1C2A0F20B71A}	msiexec.exe
File opened for modification	C:\Windows\Installer\e5794b1.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1640186749\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1640186749\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\male_names.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8347.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1640186749\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_1640186749\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2139782298\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2139782298\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping3692_2121562398\manifest.json	msedgewebview2.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5792	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hyBpXlX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hBeRqKUUTm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000b855f0a74ac2f9870000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000ffffffff000000002701010000883801b855f0a70000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d083020000000000c050e1000000ffffffff000000000700010000e84101b855f0a7000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090d4e30000000000000005000000ffffffff00000000070001000048ea71b855f0a700000000000090d4e300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000b855f0a700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230099423389571"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.FastConnect.1\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\msteams\shell	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID\ = "{EABAE40C-B27C-455A-B672-F234DD780948}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.Connect\CurVer	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.FastConnect\CurVer\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\msteams\shell\open\command	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.FastConnect.1	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.Connect	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.Connect\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.FastConnect\CurVer\Description = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ = "FastConnect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-91097763-3532418941-3477313924-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1616	msiexec.exe
1616	msiexec.exe
1268	powershell.exe
1268	powershell.exe
1268	powershell.exe
6088	ev2f79.exe
6088	ev2f79.exe
2908	vssvc.exe
2908	vssvc.exe
6088	ev2f79.exe
6088	ev2f79.exe
2908	vssvc.exe
2908	vssvc.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe
5112	ms-teams.exe
5112	ms-teams.exe
5112	ms-teams.exe
5112	ms-teams.exe
4052	UserAccountBroker.exe
4052	UserAccountBroker.exe
1616	msiexec.exe
1616	msiexec.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
6020	msedgewebview2.exe
6020	msedgewebview2.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe
4440	edpnotify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4052	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
6088	ev2f79.exe
2908	vssvc.exe
6088	ev2f79.exe
5964	ev2c34.exe
5964	ev2c34.exe
5964	ev2c34.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3692	msedgewebview2.exe
3692	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5792	msiexec.exe
Token: SeSecurityPrivilege	1616	msiexec.exe
Token: SeCreateTokenPrivilege	5792	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5792	msiexec.exe
Token: SeLockMemoryPrivilege	5792	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5792	msiexec.exe
Token: SeMachineAccountPrivilege	5792	msiexec.exe
Token: SeTcbPrivilege	5792	msiexec.exe
Token: SeSecurityPrivilege	5792	msiexec.exe
Token: SeTakeOwnershipPrivilege	5792	msiexec.exe
Token: SeLoadDriverPrivilege	5792	msiexec.exe
Token: SeSystemProfilePrivilege	5792	msiexec.exe
Token: SeSystemtimePrivilege	5792	msiexec.exe
Token: SeProfSingleProcessPrivilege	5792	msiexec.exe
Token: SeIncBasePriorityPrivilege	5792	msiexec.exe
Token: SeCreatePagefilePrivilege	5792	msiexec.exe
Token: SeCreatePermanentPrivilege	5792	msiexec.exe
Token: SeBackupPrivilege	5792	msiexec.exe
Token: SeRestorePrivilege	5792	msiexec.exe
Token: SeShutdownPrivilege	5792	msiexec.exe
Token: SeDebugPrivilege	5792	msiexec.exe
Token: SeAuditPrivilege	5792	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5792	msiexec.exe
Token: SeChangeNotifyPrivilege	5792	msiexec.exe
Token: SeRemoteShutdownPrivilege	5792	msiexec.exe
Token: SeUndockPrivilege	5792	msiexec.exe
Token: SeSyncAgentPrivilege	5792	msiexec.exe
Token: SeEnableDelegationPrivilege	5792	msiexec.exe
Token: SeManageVolumePrivilege	5792	msiexec.exe
Token: SeImpersonatePrivilege	5792	msiexec.exe
Token: SeCreateGlobalPrivilege	5792	msiexec.exe
Token: SeBackupPrivilege	2908	vssvc.exe
Token: SeRestorePrivilege	2908	vssvc.exe
Token: SeAuditPrivilege	2908	vssvc.exe
Token: SeBackupPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe
Token: SeTakeOwnershipPrivilege	1616	msiexec.exe
Token: SeRestorePrivilege	1616	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
5792	msiexec.exe
5792	msiexec.exe
4280	Update.exe
5112	ms-teams.exe
5112	ms-teams.exe
5112	ms-teams.exe
5112	ms-teams.exe
5112	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5112	ms-teams.exe
5112	ms-teams.exe
5112	ms-teams.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 5852	1616	msiexec.exe	94
PID 1616 wrote to memory of 1660	1616	msiexec.exe	96
PID 1616 wrote to memory of 5652	1616	msiexec.exe	97
PID 1660 wrote to memory of 4280	1660	hyBpXlX.exe	98
PID 5652 wrote to memory of 5372	5652	hBeRqKUUTm.exe	100
PID 5372 wrote to memory of 5736	5372	cmd.exe	102
PID 5372 wrote to memory of 3388	5372	cmd.exe	103
PID 5652 wrote to memory of 3496	5652	hBeRqKUUTm.exe	104
PID 3496 wrote to memory of 4400	3496	cmd.exe	106
PID 4400 wrote to memory of 1268	4400	cmd.exe	107
PID 5652 wrote to memory of 6088	5652	hBeRqKUUTm.exe	110
PID 5652 wrote to memory of 5964	5652	hBeRqKUUTm.exe	111
PID 5112 wrote to memory of 3692	5112	ms-teams.exe	120
PID 3692 wrote to memory of 3388	3692	msedgewebview2.exe	121
PID 3692 wrote to memory of 956	3692	msedgewebview2.exe	122
PID 3692 wrote to memory of 956	3692	msedgewebview2.exe	122
PID 3692 wrote to memory of 956	3692	msedgewebview2.exe	122
PID 3692 wrote to memory of 2108	3692	msedgewebview2.exe	123
PID 3692 wrote to memory of 2008	3692	msedgewebview2.exe	124
PID 3692 wrote to memory of 2008	3692	msedgewebview2.exe	124
PID 3692 wrote to memory of 2636	3692	msedgewebview2.exe	125
PID 3692 wrote to memory of 2636	3692	msedgewebview2.exe	125
PID 3692 wrote to memory of 2636	3692	msedgewebview2.exe	125
PID 3692 wrote to memory of 3148	3692	msedgewebview2.exe	128
PID 3692 wrote to memory of 3148	3692	msedgewebview2.exe	128
PID 3692 wrote to memory of 3148	3692	msedgewebview2.exe	128
PID 1616 wrote to memory of 1096	1616	msiexec.exe	132
PID 3692 wrote to memory of 5908	3692	msedgewebview2.exe	136
PID 3692 wrote to memory of 5908	3692	msedgewebview2.exe	136
PID 3692 wrote to memory of 5116	3692	msedgewebview2.exe	137
PID 3692 wrote to memory of 5116	3692	msedgewebview2.exe	137
PID 3692 wrote to memory of 6020	3692	msedgewebview2.exe	138
PID 3692 wrote to memory of 2556	3692	msedgewebview2.exe	139
PID 3692 wrote to memory of 2556	3692	msedgewebview2.exe	139
PID 3692 wrote to memory of 2844	3692	msedgewebview2.exe	140
PID 3692 wrote to memory of 2844	3692	msedgewebview2.exe	140
PID 3692 wrote to memory of 1808	3692	msedgewebview2.exe	141
PID 3692 wrote to memory of 1808	3692	msedgewebview2.exe	141

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MSTeams_680.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:5792

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5852
- C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe
  "C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1660
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=hyBpXlX.exe --bootstrapperMode
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of FindShellTrayWindow
    PID:4280
  - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe
      "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.4.0.0&instExecTime=1778536332206&launchSrc=t2installer
      4⤵
      Adds Run key to start application
      Checks processor information in registry
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:5112
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,BlockCrossPartitionBlobUrlFetching,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=5112.1884.9835022831687799532
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3692
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x180,0x184,0x188,0x15c,0x190,0x7ffefae1b078,0x7ffefae1b084,0x7ffefae1b090
        6⤵
        
        PID:3388
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1832,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1828 /prefetch:2
        6⤵
        
        PID:956
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=456 /prefetch:3
        6⤵
        
        PID:2108
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2404,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:8
        6⤵
        
        PID:2008
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3524,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
        6⤵
        
        PID:2636
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=4472,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:1
        6⤵
        
        PID:3148
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4516,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
        6⤵
        
        PID:5908
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5124,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=836 /prefetch:8
        6⤵
        
        PID:5116
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=5160,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:6020
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4808,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1072 /prefetch:8
        6⤵
        
        PID:2556
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5436,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
        6⤵
        
        PID:2844
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=5244,i,8162887984934577238,12540096069515592281,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
        6⤵
        
        PID:1808
    - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID bc45cff8-91eb-4fdf-8f60-feb3a7aa4505 -Trigger SchedulerDirectLaunch -BgTaskDelay 4785
        5⤵
        Checks processor information in registry
        
        PID:6100
    - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID bc45cff8-91eb-4fdf-8f60-feb3a7aa4505 -Trigger EnsureTmaAtStartup
        5⤵
        Checks processor information in registry
        
        PID:4284
- C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe
  "C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5652
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5372
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:5736
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4400
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1268
- - C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
    "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:6088
- - C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
    "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:5964
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 90877E5E9106C7E8BA49E1AA0743BA0C
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1096

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2908

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4052

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:4440

C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:3864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5794af.rbs

Path C:\Config.Msi\e5794af.rbs
Size 8KB
SHA256 42f292e361ac068f0102f9cb5a4ba1a245c772254da6a5ff23413b72d4dbede5
MD5 35599065e3b1d7faa1706b53d1f767da
SHA1 1b1eb254814dd300c84d6c633ec0cf8644f53e6a
SHA512 89d8f57123d13bdf253e99155da112b20987cdcd174915bfb51709ad15b5c49c9cec8e07830028f6ea74500be33bf197d56b5d831b5ead94f3909bc0ca40c70f
SSDEEP 96:Ah2hRczuBI0IzItcLnnU4MKCsThqPU4MKC6jFGOxThqIHg513sgBy1RQRCippBeY:AQhRsvREtQUVZI3VZw5ipr
TLSH
T1D602FE05738DC9D2F9A62332DB1B27657377E2E69200630F0A4AD2188F23BD5AE1D5C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5794b4.rbs

Path C:\Config.Msi\e5794b4.rbs
Size 357KB
SHA256 12a8c2bac62877f77bcdb08ea0b8deb2f06e24ac11b28d6fc45076b731c48122
MD5 7648b54fa1ffeb4b2e133331b1f92154
SHA1 78016103163f0e64ff704d853d0f971ccb86a60c
SHA512 c8375c6355fb4785d7ec2c8c1880762528586e903fa6d8d94beab54650fc754d76ec96c9638ad95ca5798342e1a0a416f22fa2c8c4e2e15e23d4122807b845c0
SSDEEP 3072:Be0zxXLS8SgMq+jVrrb1MMBBMolzaDhI316S8SgMq+jVrrb1MMBBMolzaDhI31hw:Be0zRpkp11ex1pkp11ex/
TLSH
T13D745C12AB41DDB5D87C357742717A9EB03EF6630AC0BE5E8700D6684F5A7E8E318E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\AddinInstaller.dll
Size 35KB
SHA256 c0306045119da6aa284f77f5ae57e9a35ae473294ef6b983db909902ef860b65
MD5 077c50b05317268a4e84b0d8e18b7e25
SHA1 4e4320e74fb1d2ca46e38b7a5554547f8c0ea57f
SHA512 e61171028a7faef3e4545ddc1a6a0e9a0ba618c20db82d4cb32eae379710497b30fee3f165400ed93c2760e04c102889686a14d7f996b3664026c881e93024ed
SSDEEP 768:CJLtIDER3wlQ0Tkjb6PO59zeTzlU+9zZU:myARglQ7jQ4zeTm6zW
TLSH
T1E0F21891A7F84102FAFB6F706AB4E5422DB9BF875C70D92D1989E14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 19e284740e7fd1c9db1aae0d7f503b572ae69d18f0b09d32ff2bcb7cf56668f7
MD5 98ed0a6996fffbc4b48138cdd461838c
SHA1 7d40d137ac3d3606fe95b402a5495935ccf4f729
SHA512 c00976feab45f402371e3c9c4320a097b8005fc6549f6454da6aaedd823126e52e15c3f3efca973b76e1dd55ccf75a1f03b0b704e0b9f991fcea36bb7564ed5a
TLSH
T1D1413758B6E91148B3B72F5A9BF6A46D887E79332F0AD0AD10120E4F0663E40CD61737
MD5 SHA1 SHA512 TLSH

Submit Download

a50487ef016e1ce77b3875402e952e331c9e410a.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a50487ef016e1ce77b3875402e952e331c9e410a.tbres
Size 2KB
SHA256 accc5fbb18d8eecd941cdb8965214c143f66afd458f9bc3a56de3db3b31b5c03
MD5 e35a57284923b0095da46f5409295b51
SHA1 e3eca0c1eb2b5a448920c4e8ca17fd43ad201a6c
SHA512 41cf4c8744cf0f663bab03e50b8ab55308501282a6b5d78f4d4093182bb62271b49c92493329a823bfaf4071a03c12b79f63e8ee2e1831e02b0d1ff55aec94ac
TLSH
T1D5411A58A6E91144B3B77F2A9BF6A86D597F79373E0AD05E10110E4F0A62B41C861733
MD5 SHA1 SHA512 TLSH

Submit Download

a7e624d3a800058467350735a3c9b4df6502fd79.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a7e624d3a800058467350735a3c9b4df6502fd79.tbres
Size 2KB
SHA256 988348917428d797dfed2a391232b94c54fdc539929853c8a4788b14d5e32402
MD5 f9b937534337d4b8fcdcf8021c530220
SHA1 d7335a362a575bc208a12a931f1d81f54c6c6265
SHA512 24293a655a1f0e27cf98a308a7780c0fff23839010b7c5dd8d8eff7c1e078ba03d512df88ab7dbf86441ba3799c96738c698968921e7862f53d13a9a48690ea4
TLSH
T1BF412758A6EA1149B3B76F4A9BF7A86E447FBC332F0B945E10110E4F0A62B44C861733
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 587be350bd7c01414006bfb4bfca4b9449fc0cfdb5d53a9b274540e00e737834
MD5 b206ac7684f2139bb2caee469cafa980
SHA1 6003f7ae1909e3fc5ad17ac9a1da5e66e7d9ae81
SHA512 b0eded6902d6b64b9ed0e6c5bd8c36ff243fcdd7d20e0b8b426addb237cdc997b1f82e31a0432f0204e4d9e6e6260760e8548aec6cd4f5e656f5c8d66e9389ad
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 03df4008b303564c9d25bc0a412b0141b7d2181880f06a7868f2faff9df03c9b
MD5 bb573de55d60fbb1c39a76e3d4441135
SHA1 c39addb8e42799349e9aa5501be7f4d27de001b0
SHA512 2e75015207954da53dcb0cfa3dd8aedd7ebc38ebf0949b7da6b67dc98d597be4fd8cf48b706335eb28a2c04295d3844e740f5a8263cfd933aa8e5f05c89136b4
TLSH
T1F9D0122332210134C83026B30023FA0C1840C10B814940006429852D9E440700D02852
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GrShaderCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GrShaderCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GrShaderCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GrShaderCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 f741ca29a2a198953603863d78f7be17c36091c7c15c5e1b7c32a5fa8f2f8794
MD5 eac1e55ec82964a0efa94e3e090eb871
SHA1 36c2ff35f3d7df990cd2ff5b4db141e426ba3d7c
SHA512 033c93b7894f3aaf269d85926f029578f6a815a328a29982a8ac2a746b709ffddc17aed6c038a55db2274d1b7653ec2e7b00d6e6d3d1d9ee54fada0188335c59
TLSH
T1F5517333F8445A3789F28B88B9093F12BB7612619FA22FA495DD0B0C11DB15C3316C37
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 4c6d9a9eed15a26f2e84c61a384797a88d62002ca03d3839d14967600a302b8f
MD5 3c2f31b318cb95b70c038d6f9195a78d
SHA1 c80dacf93ca4331f3bdc133f14ff6fb3e6ee602d
SHA512 54e1b124c1d9aeac8c40a8bf07281b5cffaf1333736e96183363ba352c8767108ec08666d2e86dd04e1c1a99396928bd426d3318fba116a0e8644e7e5bbc9cd7
TLSH
T16D717533E9A499374DF29E44B9853B06B7A61137EAD13FA8D5EC0F0C11DB2982352C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 ac48f899ecc6026ef940b292958f12ae31995b961fb3a0029576384887056781
MD5 fba96f215218323505385fa7806c0feb
SHA1 1a6203a1120822c4990a1d99e09a57a5501af6ec
SHA512 05a0c9c0ac047a355898f80f4fc863cbcf45f5b5b2ef02a1450bc24bb8e074854853cd990d66496bda8fb5619e7370c8002a74001755dc62a87ea04ec69e426c
SSDEEP 384:zqvsrvyOiyp4+IWA1eUVWGfvvL9NbLYRug9W/tsuGX:u0raxyp4sQe6WGfv3YRFWlG
TLSH
T1AB72AE714A7459379DF2AD4ABC0A3A0A7BD94577DDD12F98E0E86F0E028B2CC1306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe586a0f.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe586a0f.TMP
Size 1KB
SHA256 f82bca0d4820a4ea8d37f70bc76cb6cd27bf1d961e4003f8b0f5be5ad639c8e1
MD5 8d67b7ed661ad88064b703358ec386b6
SHA1 eeb554aef123d381abfc7ca1aaaa2723f76bf0d2
SHA512 849b9bd73230eead93c6984174a2f707240445333321ace4a25f14bd2bfdc07919d3afb9f44c970863bf1f056ed42ac81bb5e9803cc9f7a48977efa4b4b3d621
TLSH
T192216533E4C41E72A8A18699B1057F0A3F61153697615F58E1DC470D12DF19CA12AC33
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 3f3f8088f85642cf3bb5a9b0b1081f9b75ac596febd444a09a048553a4cf37d6
MD5 9561aa2895389609ef597e02f53a1390
SHA1 d32f0dfe76f22bc14da148082170eb24967d8f60
SHA512 d3cf23581eb1913d4b66a84a8218cd0f1488bb305899b1828064941707bd7a246bb75d4cff75c15704469835e906bf66b3880da8f10a9ae2529b46fa1f778d5c
TLSH
T1F241207899E7713EDF81E67C01904C83501D052781552F93FA5BF2A60337FF1AD9948A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 72b8e57724188f11bda4949b0c28f500dbaca7d9b5b4c5fe049af54026bc6d4d
MD5 70e9b73654461323c5565475d026a56d
SHA1 118158d83341963f4f736497cab34cf00d29daf1
SHA512 0f0da4d98fb34532164a2454ab7732bcce2614a5b7f8a3410569ca9973ea61cd108990ffbfeb23483352193672fb0872dd093b1b75417e17707b3c427341deac
TLSH
T15241407899E7713EDF81E63C11944C83501D0527C1552F93EA9BF2A20337FF1AC9948A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dd2c.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index~RFe58dd2c.TMP
Size 48B
SHA256 bb5e11d4195083f1ba73bc9f1511b82933815f3e517609cd113ffa72a59af9a7
MD5 253f8a793e7c1431e17b77d36b55fbd8
SHA1 651cca4e9708c1c69eba9b3f44cc1146a07f2f9c
SHA512 a54c128f9cb9beedad03e0f8c4d65cb049d9c344706790ccb590c4155a069128a8da37486bd1912649c6eabd49439495175e735ebccc37941fbd1c0e800c8aa6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 537B
SHA256 4cb55adbc78eb41b1dc7150038bc426a2ffa6e9be616dabebca90ef2aab9d268
MD5 322fb4ad2c30665453b428370c583468
SHA1 3f9074f85923e9f97cc259c0e05da9b31feb746b
SHA512 031e004907ee24bda86a9fdfcdc3d43fb566f21d6850a74b7f6ef8cc2cabddd4412ebe007eea0de64109d82333f8908954da7b232107ce8dfd837f743297be2e
TLSH
T1F9F046B7073018AE8A4482E41A18DE1BEE6C0153030C68788684BE73D273062E006647
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity
Size 517B
SHA256 147c8809c7621f87346d759cd20644d4bc6f71e7e73f88edbac6b7e87c341f8e
MD5 e15ddbcefe9bf9fee416f1eb5a9b61d0
SHA1 bffaf33df800004ff8138b1f52445545e429e318
SHA512 cde5536dc7b5b4f813cdaf6c353cbad4190ccb645663f2fab26a8f6d5b58871cf8d9b59d40fcbf7a6c69db474012f018b110c003a34666b85e67c0a92814dc9b
TLSH
T1E1F059E3427BB82B69790E7A5D84BD262E7FF13500A6B8F4D5B6443CB0405F72213453
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe59260c.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity~RFe59260c.TMP
Size 517B
SHA256 c54b7183a053570d945e97f3b8421b01306a3fb549fff553f74bf2196c01154c
MD5 f5d48ffb697ff85f730ac65e5c37fb99
SHA1 b987683b0494ad7c0ab1040a1d37ca1492788bce
SHA512 3b3f74d85b628bc863d16eaf89f463074f5de3b0771536e841a46040cde506a530548ecb5bf13410e4846cdacb9ba6655e3e059ca2a5b72838bb0a79c20ce41a
TLSH
T141F05973427BB86B287D4EAA5D007A3A2EBAF0350192A0F9D576843CA1405F76223423
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences
Size 6KB
SHA256 0a0ec8087380a08c3e268151bc9a9ecc538a918a9aa245c1c39132c4213c87f5
MD5 afab27f857315367d1f59b621820359f
SHA1 5c2b5d8113f9f71770230fb94e4e0b3bd826e656
SHA512 4b7226e515dc45512f1c9a461f476543feecfc6782d200698722142349cb842d157d30e687dd32092e088f2e842e9e33d730ca1c9e87319cb7ba3715a266f16b
SSDEEP 192:stf2IfsZ8pa/I/S+WiF3OB5wd7joxYGMC:steIb1/Vgwt9C
TLSH
T1C8E1B7039E2869778CC7E6197625FB12E3F510636BD11E98ABFCC60C18DA6DC720781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe59071a.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences~RFe59071a.TMP
Size 6KB
SHA256 87f20edfce830287325c9c59228f383dc0661e51033ad7a587bfbeff97ae4f37
MD5 e1267b711e7d246c85312dbde48c7c1b
SHA1 de9aeee60646ba5ac63ab0993eaea536b3789c0c
SHA512 17067108af0e85048d131676883cb5858daabfc82e3661e20e6bcb06c4389da2ec85f7648d47a4bbd5be97a3ae875ffd914e23d0ebef4ba7534a4965354a64b7
SSDEEP 192:stf2zfsZ8pa/I/S+WiF3OB5wd7joxnGM8:stezb1/Vgwt88
TLSH
T1EBD197039E2869774CC7E619BA25FB12E3F510636BD01D98ABFC861C08DA6DC720781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ad7a6a70-a0c3-4908-b19f-edb2e8d4fc2b\index-dir\the-real-index
Size 96B
SHA256 5698b1b9ffdfcfb737f1b91ba63a78926b68186f27a32c89aea7c0715847a9a0
MD5 82f7e5817082d03bb11616ceea552ae7
SHA1 6f3b622e1c6a25f4ba1dfb511c30a64160ee69a8
SHA512 ff551d162d2c8e9c62d6b8e958080f4780cad63016015c116a4661084d65f99b722afa66bf22d2ce59808373a69b766c72df8700b8e1f14963374ad4023d2636
TLSH
T155B011E02800822AC0200AB382A20A8033380BA80A030A2882C00A2A882A3C00200820
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c9c3.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ad7a6a70-a0c3-4908-b19f-edb2e8d4fc2b\index-dir\the-real-index~RFe58c9c3.TMP
Size 48B
SHA256 6b59db38da55b512b553272c38df7bbf9e451726ba0a7d62519429783065d5a6
MD5 f32ddd4a4f1d7141f1cc1e7e64bfd7bf
SHA1 b38c5a060aedaef928a51cab03afc3b8e1d37a58
SHA512 6e4e98b63dd458f5fbeb2e4560928a4c1a005b5da48605314543bc588c6ab805abebad1ba114f50454d3721e4d8744defdbcb357135c25ef2c9ad82cbc1851de
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ceb8046b-5003-46de-ad5e-959bb0de70fb\index-dir\the-real-index
Size 96B
SHA256 0c04a21a33ae50a88d77a2cf963be10b7646ae21d467d2fe8f07b2bf1b412070
MD5 515acdf00c265b6a1b67e1159aa15e75
SHA1 0dd26dbc9f2557a17828c47e6d8069f70333378b
SHA512 da9fe12067c64e62cebd6bc54b9482de2dcc3814d6d62d014d28539bdabda2cd7a16f1dccf755ded0a7677a75db0df32badefff4aab5c9a3b060f277bcaa1bf6
TLSH
T16DB001180221426AD02047B921CA9AE1A23D6E5AE2960361A1A0E6A8FC6EA62A5411A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c88b.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ceb8046b-5003-46de-ad5e-959bb0de70fb\index-dir\the-real-index~RFe58c88b.TMP
Size 48B
SHA256 446adc2f17329ae0a6adb29017b4497413594035ef39fc728f092c74658e43bd
MD5 52d00c782907c7f696c74c4b76e068d1
SHA1 0f910f74d569c18278b729dc01bc5dd80b4fbc16
SHA512 c6b48fba81d02d5a4c82c628ea9dc0187a7769a5e1bdf9e61111a5f1a5a9035a0ff9b067ccc410074e3e52dbc102206256454b99bafb6d0cd4b2e4228f5b8d28
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 5ebcd627b3835a51fb803458e2d111421a1daf20f3f6dc3347e9fa93f00095dc
MD5 c2da3378b96bfdeae2f44c5b0fa0439b
SHA1 11469be00213d5b0ff12228ff3e049a169d87381
SHA512 8d71fdfc22255d8b4e43e2e47570ce67cc7e1ab90a6c67f3529447701b65bf11a36d4721e212bb4dd9a142aea86e4b4efe21ea912478f4efe9dd768403e1d107
TLSH
T122D0EBAFC8109C372F0D428260C0F08F110E830BA696F0D18EE78C88782F8FA57010FA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 82e6f47782dabb42b2f05179c0c508f9ade657e34111c6f87db7644ceff3535d
MD5 7e0c703453bd77d846b76b76e4868a6c
SHA1 d8d6bac09223dbffc6829341468cd61780654cd8
SHA512 f2005fb70ff586125085b53027da229ca48788884f6ad83a06c50efaf391368696e7376f8c5b2a89add4e1cb6de38167919742985e170604b783d1dce1a9d46a
TLSH
T1A4D0A75E80108D732F4D45C260C0F457500A4E0B5D46E094DFEBA484F83F4BD97014F5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 4aa1cc88120b75785ae8c40345fa5e7fd9e45b0c21861b8f86c8a1454b48e19b
MD5 8e6dd9014226f81424aced2d90841bc0
SHA1 fc023d283caf1c6e51874f2c08f87c45389889ea
SHA512 c1c832938810764b8c392e857ca82c9656ff898b9ed6f68465bcc4cd0e507b8be50b2cd6706773c9a54827cc7345b255e468a1051ab0c4d31756ca17b9759de2
TLSH
T148E0C26B84109D332F4D4586A4C0F09B51098A0B9996E1A59EE7BC88B83F4FA96114E9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58700b.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe58700b.TMP
Size 141B
SHA256 8eb55d028d824f1d76ec3246d7d55d248a96c920b85cf3b8e672bcc57c291da3
MD5 9b75a9cfb3ff777bd98ead605040d754
SHA1 a9220118871875e633efe94f166af2e1cbf1940a
SHA512 ee8665b500b8a012e5a23ff27def5a30d58d5d179614ae6b88198810ba908452ea95b85482062c1ef7e5d23007399c409b8919452377a97bc9191b97ed911411
TLSH
T140C08C9E80200C226F0A12836080E403A00A0F4B4801F0D4C18BB080243F4BDE2028B9
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Sync Data\LevelDB\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

b61f5fc6-5e30-4f4c-a60b-9b1972610890.tmp

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\b61f5fc6-5e30-4f4c-a60b-9b1972610890.tmp
Size 1KB
SHA256 97f9bf784758bc63a173144253b241a1cd64d2b9b3f83bd77fe7bce3c70d4df6
MD5 deb5ad1c9d89954060230143b19615d9
SHA1 253440dd958f2c30b75053fbb122f4638873f550
SHA512 4979e8407bcdd82a48da2f74f0fe256813612d5e34b2c4601d1860a688f8a1921bebabce2c5f715bd8400402eb90313f45e8d3acc716a6d60c44896679bd5175
TLSH
T106316573F5D41F3298A29799B1057F0B3F321136D7625F88A1DD4B0D26EB19CA12AC32
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 a31a22fd34ea2a8e759e0fe916ce57ff983a57361335b92a309ca1c926615522
MD5 6a9b924a681c5e1be67e82959aa8f816
SHA1 53d5dc80aa81345075fbdc7195243c61d37c96c2
SHA512 7fecb89460958726a4a93a9b8e2ff0d942180246d442cdeffffdad4c006c336cbd651b992d1c597d1e7f7fa1bf42d855c1993fbaad7556d981ac4178477da8f9
TLSH
T1CF51C42C0514A2BEDDC7864BB55F3E234AE741A4EFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe586666.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe586666.TMP
Size 2KB
SHA256 9059aedae41985c3bea5574bb24bdfc779a81a7950b8e3d391c3b6c2486c5888
MD5 1dfd4312dabffb5d401c38fffe675cc2
SHA1 1aa7fe1743482b829a660e74791fddd811f2c5f3
SHA512 e10fb1041d771a8d79b900cb2ec7c226f1487b78c9909d53e91c512cf53332672c7a16108797ba3b3e280fb747ce2cc9594c6deb653a321d70f4642521d515ec
TLSH
T13C51D52C0614A2BEDDC7864FB54F3E238AE701A4DFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 df8ed3196f28a289fc6fac48489a11b985b85f06fa1067fada7eb1f218b1d8b2
MD5 441f6b5fbbede61b019c63cdfe7691f1
SHA1 1c9f97fd3a287d06dc51f6cf530a51c780964816
SHA512 3e06a0a10927ae017205fe5afbf1c1b08fe99f4e5fcacb2aedfc0e0374e1ec2c22a16a2a5203439891bb1af1e51d3192cd27336a7335404fbe20d05c666ddc8c
SSDEEP 1536:OgkSvYXoP16CjLJV9UBYDireji7YDereUrHdkv6gj:+iVQk
TLSH
T141A561A01844B6FEDB8AC2B9673C6F28B5FC4DB78C415024EADDE61D706346673138A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 754861350424871855b42d47145f52875f1f71ebe7393b5defbc8b5f856d8e94
MD5 78fc032a6f250d8964a03859a204c5f8
SHA1 d3b461a08e96ff9f33a42c07e6a0007538633985
SHA512 d97a07332df472067ae5d0adb336490209eb3d9d6349686fdaf05d9722b9bf33fdd2bd0e961ada3944af141c19c9d5be339887a10ef6520ee5a3e90c239b73cc
SSDEEP 1536:igkSvYXoP16CjLJV9UBYDireji7YDerewrHdkv6gj:KiVkk
TLSH
T1B9A561A01844B6FEDB8AC2B9673C6F28B5FC4DB78C415024EADDE61D706346673138A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe588e7f.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe588e7f.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 4KB
SHA256 5c66726f27d1368728a4d3f7d7268912f46931746f7ee88e666b43f44617ebc1
MD5 76d2011a7ba9ab2d4beda3d8a2b8903e
SHA1 fad1910fb54f3ef402721734ec1ec9dfd26696bb
SHA512 1f56ce5770b6119185b50f1c18fb97c40e3c1c1a94e10b986ee5f66cfcaccd8cd78c89c2a82eb8e39a0a130190e55f8a708f52ca60f60b770bbd4a3a4eae3671
SSDEEP 12:KCoC/qtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbf:KCoSqt8VtbDBtDi4kZERDf
TLSH
T14481E1C176B8B161E49A62B7C9B3136B1B3A9169043382632DB254D2DCC19CAD8261FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 ff8396e84fde0f7e9ca0e545ec015e471d976a5f8437e7b6a58e4c51e1df6a99
MD5 4691f07aa11d48481ea01f939fb2384b
SHA1 3c1c124d4c80fad151107d00ec747800fb0042ad
SHA512 d54c4995ac428440f11e3c6868f4975294ee9607a3355a056e084249072758f930da7e8407d4b204a8c2f4952b80e5415fc7925fb5aff938da46b08654a87833
TLSH
T1D4C02B030D17A6330B500E00C7BBFEC3C5883D87053028604939C04C0B286FE700010B
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 360B
SHA256 9f607395e4b320f388ccff7d40254f6189e598839bb7a1327052c76fcfdd9383
MD5 059bc40dd137d1e9eaca2494f3e1cad3
SHA1 2121b1b57e4aa5dc635027150addabf57d858dc6
SHA512 893d45d8bc4eb9db8148239d968f8f361eb4d6ccdc50758f2248b9c351d04680f442f9d906b4208044c2fc5bb9f7e5dfd0516164f04d9cff4e069809f976e127
TLSH
T181E0C01B5D03253731684200CEB8DE90D8B5BD43829494E427BE93496318AEC5100613
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe58654d.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe58654d.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.5MB
SHA256 1f2a34f84b7f4171bcd0d40c80acee8aef0d9dc3529deb3e372bae180f571c14
MD5 b690b2420b21107e633b4e325768c1d0
SHA1 8f3faaab9eb83af7eb1c9963230e5980642c1dfb
SHA512 64b900fb5cefb8dec747c768061ea95d4ae2202127ae41cad46a59ab5e5cdfaaa78743d6383241a124e3ee4e2015566eb8f05285e16c12669745e23d293c90f6
SSDEEP 24576:DsOJ4Ly3kFbfr19RGKrestu44wKOwVuJaua9Y4RL/Tfrls4ON80gzl+BWRUAQg7/:4Lyijr1PGKltY7ls4Om0gz3UFoZ3x
TLSH
T1C5C54A10A7E88E2AE5BE1B76E170126117F2F9896772F78F560C60BC3AA33544D513B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 8KB
SHA256 c3fa333fdbce95d504aee31912993dc17ab31324428f557ac774f7e98b049b99
MD5 3488a1749b859e969c01ba981036fab6
SHA1 a65b72461fa14c89fce0d025e43454830a1f7972
SHA512 7363003422bdaabb7943439ee1e846867f0f3d0baed3456424544a81989bd2d142a411cf982d90e4158314d410cd1a1a4ee33d8707219b4274cd2841705bcecc
SSDEEP 192:BSHYMeY9ayCss7Db0cvhlCZMNvgKiMKEl7eJ1XDw65pz:obBlCsyDb0cvbCSmEo1XDvz
TLSH
T1CC127D8FB85F4F9651593087F2C409051B0FECA9F990A6A7AB309BFC31614CACD24F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

endpoint.json

Path C:\Users\Admin\AppData\Local\SquirrelTemp\endpoint.json
Size 610B
SHA256 1578d085af8165ef971cbb88d327e07c2b82c34eff379fcb2ab030a188b2981d
MD5 34b2a3afe7ae8ad113f54e64d2f62111
SHA1 c0afa4727bab161b777363fd49225d7ef084c16e
SHA512 d6a8a70603157f0cf4b4d2a2992b8082d30e35aab7e47f973e8bde5841dc5528f7a62a8d3889093343f0a806a1161965126140345ffcb4cb0dbd36e56f155720
TLSH
T1DBF0F97BC7C280115FA84383A64BAA6DB91B6A4F3CC8B559C0CC850922119B6D7425BC
MD5 SHA1 SHA512 TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 ed17d4ec4e9a802a6fc88d02591c26f5ae3e5c02ede58da6797aa566cfaa56a6
MD5 e9e8a80d60c702c352ebbc5f6ac3cef9
SHA1 1ad3dc1a9ef12f344c462c63e79fdd96ddffc945
SHA512 e86a20ff2f82e94ef187a473ca0f1e88b498e21b13e0ff3dbd02164fb9810257e530a818cb7ec6aee833bfb9aa6375d562df642ad81f059244b0fd3ec6a66f07
TLSH
T1FD900259C4E0629471A438955808C1D1059904415AA799669222049A0C9174495921B2
MD5 SHA1 SHA512 TLSH

Submit Download

CFG7F3D.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFG7F3D.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 1KB
SHA256 578e3427e0b4e11c8d02a01b08e1f01ed998975d12e05415eca5c43e377dcf28
MD5 1adc91a24c03b63ecef84bd9100198ab
SHA1 56edd8989d1ea827ae167810a361b5f6934b2630
SHA512 b684197ba67cea7a9d47b6418bde214f81fd3ee96933d9b3cf0fa964da2c050f6dabf6bee4f4462b201b9814219cae10f3ab7d440c10e6f5edb36db5a624a78c
TLSH
T17C2192075994D21E4A94210DE3F07E6FAA7DF353120E3555F7B4C14821834BE99DE85A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_41rgfy5r.2mb.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_41rgfy5r.2mb.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DcryptDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA25B.tmp\DcryptDll.dll
Size 20KB
SHA256 ad313f94da4ab0980173e60cbda7d1510e92fb49d2359224e0f89dc3ec0584e7
MD5 0a5e967b684d6f3db31cffb619cc0222
SHA1 2ed62db69f3ef5b0294805e326e3f41e5b3b0ac5
SHA512 9cf83f8827aafba394befe1a7c91cf6e12ccadc0767fd1934a823e951b6b6cb24ecf7ee56a4c012c162a41900de0c5f1820ca6fd6836bc474881d9f23e966954
SSDEEP 384:k3tsJOACduC6f6o14y5+UKjNLUtTQdCLXXCBwnp:k3tsJOhuDC44y5uLEeCLXSBwnp
TLSH
T1E492D750CAD10420E0B322BA7AF955129CF87E321836610FFEB7065B6D78AD76767732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA25B.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\uk_tmp.txt
Size 1B
SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
MD5 9dd4e461268c8034f5c8564e155c67a6
SHA1 11f6ad8ec52a2984abaafd7c3b516503785c2072
SHA512 a4abd4448c49562d828115d13a1fccea927f52b4d5459297f8b43e42da89238bc13626e43dcb38ddb082488927ec904fb42057443983e88585179d50551afe62
MD5 SHA1 SHA512

Submit Download

hBeRqKUUTm.exe

Path C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe
Size 42.6MB
SHA256 0855861fc39342ca8009838782c39351be5da43e60809aa13322f11cd95d59ad
MD5 28827bb745df0e8f5ab4d809eba41ac0
SHA1 cfc0552b45b3f66969aa1eaffceb4c12e7636323
SHA512 6a907349ecfd72ab84c26e5ffc3ee8a57850c72f50f8c21557d2ca7db3b37f000968ebd4ac0f5bbb7fbbfec7bdd07880a0fbf07d96583fede26ca553b932aa66
SSDEEP 786432:W6q5OMGvRMbCubjuyCWwuMHIMtyOeZ4hYTpBrinrSER8e0TDGg8em:WjYMGvRM+YuyCWwuMHIMtyOeZ4hYTpBC
TLSH
T1BBA7AFF3B619C135F16D51B84D6457DB803D9C250BA121FBB2487BAA1A31ACB173AF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyBpXlX.exe

Path C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe
Size 1.4MB
SHA256 c8db62bed2305b35860ba601c926f664da5c49cb58db6e364f0ed2805af511f0
MD5 7ee6219d0f497752aa7f1c129ca50bc1
SHA1 68bec1b6c594b6bdaf74b4062e4b3c477aa6a1ad
SHA512 a91760aeb550d5683ce0222f40addb3507b79ccf10199c6c5a4773d3b3fc0bcf874360202bfcdca0871da5efe94b94b24fecb72dd5ebeca02939928c5a534094
SSDEEP 24576:E9Yu8GgnSf7uw7J8qyKD0OIqKT//pIgl6A5H2TuDWkd3WZZ7SuW42C7Z32o3:zGMo7NSK/Iqwp/6A5Wgz501SuWYZ3V
TLSH
T1F965E05026A0C176C6E20732C565B375377D6D2C4F3046DB63A4B2DDBA7B1809A32AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 e8b29a30cbb74f3d73e0815f2fd43f4c9c67fe658825b8269b56dcba3c77c363
MD5 fdf521b810372be57e20f42f5a5917f9
SHA1 9c96de6a467545de4a32e9f9e4671494c2316349
SHA512 c74f81f34acbbed2bb169f1c05a99b760793ccec6f9ec604bac962a46cc28abee893c0ead515295b6b71ff1cf12c39e0661d61665fcf664fae344acc1df2e745
TLSH
T19BD09526D334F773716E3E5C0C28507A1C10F7D2221746172C164961F331350D4C7168
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 403KB
SHA256 311f644a8cc871e9fde0dbf9126189f11cf14534d8aadd824954595b56dbe5d8
MD5 665dc9cb1017f75370dead01c35e5342
SHA1 92be12e735b77849181d94779fec0efcf26342b5
SHA512 072bc616feb46a3f297671bbef8c2cf7a15416b95d3cacb2bc87ba0db6269d02c95d3dd6c51dd941398d367b4aca8a948e3f5e73f276d52ba150d8fff2c002e9
SSDEEP 12288:h47eobnoU0GOxiz2QQIl8yrjroV9ueRvu:G7hUT3xiz+uLrfoV9ueRvu
TLSH
T12494BF6A2C3FAE681ABC41A7F94C11577DF21FD8ABEDC132C24DCD1917D10899AB8193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 533KB
SHA256 c56bba6fd6236e30d9b5bb7ffea33079a143819fe1f08db346ff7b96acc9cf00
MD5 202faa607d44d8350d8d5ab435a8e81e
SHA1 244389e040acd9798f1960135b4b37e7711356fc
SHA512 31fe7f1baf7ab2964ca468a686a00e724f5466daf949df5173e4bf3ed575c3651447f990e72f2c0465c8762d258f1238f80ee6948f09bf6d979bee62b66757af
SSDEEP 12288:hU43LGMwhDLctEYGzqIx+Tsj/KKKKXE49ckVd:K43LXwm38VEEckVd
TLSH
T1FFC47D57193E7D0D26E05293B81C49D37DF223809AEDD031D39D9E6816C6A2EA9F12F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 166KB
SHA256 32c1efcf15430df8e87207bde1916c807378edf6bd9552f02aeb6d50ac56f752
MD5 5b0756dc69ec9ed4b6dc5f4948d00c91
SHA1 e6938bbe27ba077f95b925c92c8c5e71875c76cb
SHA512 a16cfbbfec0311cded46376ca2d04bffbeb36c3f80e84ae2052671bf2bc6a8370d293a8df606b2f311914f90513cdbe393c99533284f5a6c4532b49b4bfb0c1d
SSDEEP 3072:hhIKRyikUOIya0rhMcnSfTSFqeSy4In48H0gFuHNJbmeqdyYV5gY:hh+ta09McS72+vI4dgOxigY
TLSH
T1D4F39EA7297D6FB839684183344C04975F651360AFEECD32C39ECF1409A66A726F817B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
Size 942KB
SHA256 bc1c0a2fc2b84a938fae034baf88c6cc43857b67b6814c5eb56824fa2835fd68
MD5 5af667ddc81dd731948caa2d64ebff6c
SHA1 327a0f7ce09a3f6b1574b27d8f69067895d691c4
SHA512 b367ec266fe7877f6e9343f9f7a1a4f3dd822543c544c44ba976f09dd827cb5c4febc358c663ab3363464e89e5df2f032d8f6e3e4c200c9264b930ecac4eebe5
SSDEEP 24576:FGp/QoLvjfJVdmHLfU9rKqeyV851Kmv6Gd0xnL8Sh:sp/QoLvlmHQdvVGv21gSh
TLSH
T10625E0227390D077D7E301324A4687A961BBAED159EF8E4377D43F8D8E3029D9A36B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 180KB
SHA256 4846e03250931965df77d4fb897fb3d100d451b72a7910a2840630195cfe1246
MD5 30806c3b99d158af70ad6448bfdd7716
SHA1 d557aac16144b0ff77759b7562aeef6c346ab110
SHA512 04e1e86c842870f02401cd42668095a81bb6c1b3e8c47bebf7d333453453a6ce65442339ff5ce1f51317b471c0f31e0afa7d877aaa861535273c8f944bd4aac9
SSDEEP 3072:Xhhg05n4/1J42BVXU9w9x32R68wJZzjz+Ifwaa65LjI2ccF6SarDEFzjqF3:Rhge4tJ4UEG9xZfIaaAjI29narDEY3
TLSH
T1B104BEA4434BEF34AD5E41E3B0611D9AA3E9308CF2DC6354AB9B8D2104D857F67F9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 56KB
SHA256 2ede6fc732c291281f5e51563a4239e38bc9cc57c42719836d51690edf46c525
MD5 02fd4fd8807ff36f506029f6d161c6ea
SHA1 725066f05fb2dcdb6d50b398beb5556ce817cf70
SHA512 71714a3696a1e4ddfa55fbadee60727efcf246a53c6ac2f2fc112e14d562f61b231dca120cc67bc665d510bee2d136df1937ba7c76da9dc7bebbb67c6ffc5ae8
SSDEEP 1536:+2xNv/qrXz0t8NADTop9ObO7BqTfHw+gPRRwZB1p04:+2xNSgt8N7wb4qT3gMNpB
TLSH
T19143CF440289AFA2F154C3737E59D98706D89F802FAA7537A3D8BD252C58F7B75F8022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 942KB
SHA256 7efd0f02d171b52f803c4793ee31070461f753387307d26d8ddc319fd129ef7d
MD5 6c4c052cfa3e24a05af2ddaa474685c9
SHA1 de88662a97db0c89c31aca744f3c89a57421c0fc
SHA512 a5577ed49d7a63e2b7eb2785c672c35c9856ff150e9baaf4a226c7797f030cd152d650aac8b9b4edfc62adeb0e3008b67208acbba0e56c9ae101f541f7701e4a
SSDEEP 24576:Fyp/LoLvjfJVdmHLfU9rKqeyV851Kmv6Gd0xnL8Sh:Ap/LoLvlmHQdvVGv21gSh
TLSH
T1A725E0227390D077D7E302324A4687A961BBAED159EF8E4377D43F8D8E3029D9A35B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrin.er

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ntrin.er
Size 168KB
SHA256 0250643af857245804b1836a240104cd8122c995d1e63f45c6ab6cb4d1065532
MD5 423ea290beb120f487d6831083dd1f87
SHA1 beec3f71d604ebbeef52bd03407b1fa52e68c2d9
SHA512 082915fe636a6bf88dee3eba9153b75542b049d82878b510cce7dd633b83b53cc8b81db513ed5a47f3d67b715f7e45c5c4182ffc14fcf36b89552e149721f553
SSDEEP 3072:kS4Cu9rV+QT6ZfRiflr3PQ1InKMzjVFPumXrA29hJ6QSxHPmbrF8vodrQOs+:keFRi7kIKMz7Bhs+
TLSH
T1BBF38DA32C6C9F78B9689183384C45930F641760AFEE9D33839ECF6505E65A762F412F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 163KB
SHA256 23b5d84ad8a53b77dbda0960d8423e558bcac4ed3fd6221b60370fc94452495c
MD5 bdfa1e1ac89f99fdcfa761182d745bd0
SHA1 536c22b1e037456b55ca27bb9ac87a0f664e3de6
SHA512 579ca037a0ed37f052011300f812469ce49d5c7111340ff33a2c4717e9ebd324b2ff468552da99f7755a6a49bab7d913bc1c577b95474386cb5ebd92a97f979a
SSDEEP 3072:qtH9dODPB564nXjtFCH0gVqsxCua4DwJ47PreIV6V2Cpbnhdd:k9dOrBU4nqWua40J47zeIVYpLZ
TLSH
T1A4F3AD4C421AAE74ED6E81F3F9600AE593D53140F2DEA3967F2AED5104A423F52F8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yinma.vc

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\yinma.vc
Size 478KB
SHA256 cc734def371a00e17d744833b7a61f030051d0149712fba9d63bb7400271b12a
MD5 cb2c7240e7b48f49f0f140a0ab5fcc51
SHA1 5732767b46198f321d73fb4a9395fb44de3803b3
SHA512 476651d071cdad81fc10ed4d23857b47cccb0a7d686fe94e8deee220d78d81d02532291f8c044c4965cec5d90734cfe9bfd35da61f961e316fec70d0a4d37b81
SSDEEP 12288:HCsJxcMXlPRu2/Awl6kdd2a+Ih9CTnRdzpo8:HCsJSMlJu2/Awl6kddf+ysRdzpo8
TLSH
T100A40919149AAF398180484F7A1DD121A977DB48D22FE23198A9EC1A7DE4F21DFFC1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI7E06.tmp

Path C:\Windows\Installer\MSI7E06.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA40F.tmp

Path C:\Windows\Installer\MSIA40F.tmp
Size 113KB
SHA256 cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36
MD5 8fa4088a730b967d85df562fd5ef7d5e
SHA1 629db9229f4a4a691e14f38f4dbffba157fa1ce9
SHA512 1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2
SSDEEP 1536:xS8CWyksWMcdMWBpjr+UsgtFmVrrXL1MgbIurgnIMolaeB8DhIm+uBSw:xS8SgMq+jVrrb1MMBBMolzaDhI31w
TLSH
T19AB39D41BA908432D5FF2D3C1578DA621E3E79701FE09DAF175851B90EB43D0AB38E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5794ae.msi

Path C:\Windows\Installer\e5794ae.msi
Size 22.1MB
SHA256 f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf
MD5 b848c1d883bc210453286fc3d967e745
SHA1 79a18e6d14db69a56f87708c3d14cb3baa83ee98
SHA512 b4f1e624fe65815d21925f6dd8fe6742e5e3fc6f5efb97d6470ca530e7901dd663c3ee13b4236c55db38777c953b602d9beacda450a77c6157524b65ca08f046
SSDEEP 393216:/A4EQoVqkO+fFgTOfPPNiv1P8z1FhO350N+54Ktq6UWP3knuptZgNFRdu/vqIWB3:qPO+fFgTOf3Nih83wp0N+KqMuptW/du6
TLSH
T19C37333E2A889325ED83DBFBD8F4C42CC4D733435D161067E99EDC6992E2A089DE591C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5794b1.msi

Path C:\Windows\Installer\e5794b1.msi
Size 13.9MB
SHA256 636115933ab2f678c8d9eaf50e79e47be094436d438565fa30b0f1ae3d7362f4
MD5 8444b913223f0ebe0d7eb0867ece55e4
SHA1 43028a51223cbea7b405b18be0a59b42f7777136
SHA512 a1617c7eab8ff2922e9ba1c4273db6917cca25d3ac886aa28ee59dee45f4dc0a406be0f5251a189fd589720635aeeba8781f0899fbd3cb080ed82ad3e7c7596b
SSDEEP 393216:PMyGsr31tl7C4WYe47SXsxbOLq5a38wnt9lTmr7:PM831jG47ZIsZOLq5a38wnFm
TLSH
T170E63353358AC932C2BA0A7826BB97556B7DBD254DF0CC0B5710BA4A2C723C01BB5F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.0MB
SHA256 fb65e79301e2b845be48ceb818ca52805340c6ebc7c195536186323dad97447e
MD5 85e6ee90d898eeb851567f290e25e3b1
SHA1 049c4bd079570c1efd31630dae5c62ac279329d1
SHA512 f58cca52a6b0d332f14196412e5a8e2a40ae15635781fc05315fc816aa6efcfd514d0ee69cb098cc263c7d2737759159b99dc3b9642de595ada6bfc89407c814
SSDEEP 24576:XDEmg3k1doO/vvTLT8ueUJmgG8HrD2xoy+IdIzSc8LaDSmA3Yrts76RVgf:Ta
TLSH
T13247C52436FD2140E7F79E7CA8F06A2389397D579C15DE8D05421B8E0922B71E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{9baf7322-3a87-469c-9144-1ec68c87f5ad}_OnDiskSnapshotProp

Path \??\Volume{a7f055b8-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{9baf7322-3a87-469c-9144-1ec68c87f5ad}_OnDiskSnapshotProp
Size 6KB
SHA256 68dd16f1a5607d70277d920a1728dd4889e5e6c6b602930ddf7f56eb920f4643
MD5 4aa84e8c8ec54790cd5ac98cc01a5088
SHA1 324382888526dfbeabe16b5e353bf4f36d23d943
SHA512 0856584dbd4c99379335657efe1e069138065ccf7c2111ec942e57ee9ed2ae005736489de113779c817e9c7cf752d6cc25bec3f0c410f00e7523e7f5d6cf4cd9
SSDEEP 96:FaSd3fKAXMFDD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:BdPKz1b++ZVmN
TLSH
T158D188185AE54711E2B3AB7128F18557A477B811FF33CB8E0198238E2670910F975FAF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/956-711-0x00007FFF24C10000-0x00007FFF24C11000-memory.dmp

Download

memory/956-1208-0x000002274E160000-0x000002274E18F000-memory.dmp

Download

memory/1096-1408-0x0000000004FD0000-0x000000000500C000-memory.dmp

Download

memory/1096-1431-0x0000000002B60000-0x0000000002B74000-memory.dmp

Download

memory/1096-1407-0x0000000002DF0000-0x0000000002E02000-memory.dmp

Download

memory/1096-1394-0x0000000002DB0000-0x0000000002DBA000-memory.dmp

Download

memory/1268-81-0x00000000070D0000-0x00000000070EA000-memory.dmp

Download

memory/1268-80-0x0000000007710000-0x0000000007D8A000-memory.dmp

Download

memory/1268-52-0x00000000023C0000-0x00000000023F6000-memory.dmp

Download

memory/1268-53-0x0000000004FD0000-0x000000000569A000-memory.dmp

Download

memory/1268-86-0x0000000005710000-0x000000000572B000-memory.dmp

Download

memory/1268-55-0x0000000004F00000-0x0000000004F22000-memory.dmp

Download

memory/1268-56-0x00000000056A0000-0x0000000005706000-memory.dmp

Download

memory/1268-64-0x00000000057F0000-0x0000000005B47000-memory.dmp

Download

memory/1268-67-0x0000000005D60000-0x0000000005D7E000-memory.dmp

Download

memory/1268-68-0x0000000005E10000-0x0000000005E5C000-memory.dmp

Download

memory/1268-69-0x0000000006360000-0x0000000006392000-memory.dmp

Download

memory/1268-83-0x0000000007330000-0x00000000073C6000-memory.dmp

Download

memory/1268-70-0x000000006B220000-0x000000006B26C000-memory.dmp

Download

memory/1268-78-0x0000000006F70000-0x0000000006F8E000-memory.dmp

Download

memory/1268-82-0x0000000007130000-0x000000000713A000-memory.dmp

Download

memory/1268-79-0x0000000006FA0000-0x0000000007043000-memory.dmp

Download

memory/1660-89-0x0000000000C10000-0x0000000000CCF000-memory.dmp

Download

memory/1660-633-0x0000000000C10000-0x0000000000CCF000-memory.dmp

Download

memory/2008-721-0x00007FFF23EF0000-0x00007FFF23EF1000-memory.dmp

Download

memory/2008-720-0x00007FFF24B40000-0x00007FFF24B41000-memory.dmp

Download

memory/2008-1210-0x000001854C7B0000-0x000001854C7DF000-memory.dmp

Download

memory/2108-1209-0x000001D227950000-0x000001D22797F000-memory.dmp

Download

memory/2636-724-0x00007FFF24C10000-0x00007FFF24C11000-memory.dmp

Download

memory/2908-153-0x0000000180000000-0x000000018007D000-memory.dmp

Download

memory/2908-190-0x000001DA2AE00000-0x000001DA2AEB5000-memory.dmp

Download

memory/2908-191-0x000001DA2AEC0000-0x000001DA2AECA000-memory.dmp

Download

memory/2908-189-0x000001DA2ADD0000-0x000001DA2ADEC000-memory.dmp

Download

memory/2908-199-0x000001DA2ABA0000-0x000001DA2ABAC000-memory.dmp

Download

memory/2908-181-0x000001DA2AC90000-0x000001DA2ACB2000-memory.dmp

Download

memory/2908-168-0x000001DA2ABC0000-0x000001DA2ABCC000-memory.dmp

Download

memory/2908-192-0x000001DA2C050000-0x000001DA2C06C000-memory.dmp

Download

memory/3388-1184-0x000001D4A6A00000-0x000001D4A6A2F000-memory.dmp

Download

memory/3692-1179-0x0000023D741D0000-0x0000023D741FF000-memory.dmp

Download

memory/3692-1181-0x0000023D02F40000-0x0000023D02F4C000-memory.dmp

Download

memory/3692-1180-0x0000023D02F00000-0x0000023D02F2E000-memory.dmp

Download

memory/3692-1182-0x0000023D04370000-0x0000023D04399000-memory.dmp

Download

memory/3692-1183-0x0000023D043A0000-0x0000023D043DB000-memory.dmp

Download

memory/3864-1048-0x0000025DF4090000-0x0000025DF40BF000-memory.dmp

Download

memory/4052-609-0x0000019AABC90000-0x0000019AABD60000-memory.dmp

Download

memory/4052-614-0x0000019AABC90000-0x0000019AABD60000-memory.dmp

Download

memory/4052-612-0x0000019AABC90000-0x0000019AABD60000-memory.dmp

Download

memory/4052-608-0x0000019AABC90000-0x0000019AABD60000-memory.dmp

Download

memory/4052-610-0x0000019AABC90000-0x0000019AABD60000-memory.dmp

Download

memory/4052-611-0x0000019AABC90000-0x0000019AABD60000-memory.dmp

Download

memory/4052-613-0x0000019AABC90000-0x0000019AABD60000-memory.dmp

Download

memory/4052-576-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/4052-618-0x0000019AAB7F0000-0x0000019AAB7FC000-memory.dmp

Download

memory/4052-617-0x0000019AAA1D0000-0x0000019AAA1FF000-memory.dmp

Download

memory/4280-630-0x0000000000BC0000-0x0000000000BD4000-memory.dmp

Download

memory/4280-40-0x00000000060B0000-0x00000000065DC000-memory.dmp

Download

memory/4280-90-0x00000000052B0000-0x00000000052CB000-memory.dmp

Download

memory/4280-627-0x00000000052B0000-0x00000000052CB000-memory.dmp

Download

memory/4280-628-0x00000000051C0000-0x00000000051C7000-memory.dmp

Download

memory/4280-629-0x000000000B940000-0x000000000B969000-memory.dmp

Download

memory/4280-91-0x00000000051C0000-0x00000000051C7000-memory.dmp

Download

memory/4280-631-0x0000000000BE0000-0x0000000000BF1000-memory.dmp

Download

memory/4280-65-0x000000000BC70000-0x000000000BCA8000-memory.dmp

Download

memory/4280-632-0x0000000001000000-0x0000000001010000-memory.dmp

Download

memory/4280-66-0x000000000BC50000-0x000000000BC5E000-memory.dmp

Download

memory/4280-43-0x0000000007230000-0x0000000007256000-memory.dmp

Download

memory/4280-92-0x000000000B940000-0x000000000B969000-memory.dmp

Download

memory/4280-37-0x0000000005A10000-0x0000000005A76000-memory.dmp

Download

memory/4280-35-0x0000000005210000-0x000000000522E000-memory.dmp

Download

memory/4280-33-0x0000000000580000-0x00000000007FA000-memory.dmp

Download

memory/4280-34-0x0000000005140000-0x000000000514A000-memory.dmp

Download

memory/4284-1211-0x0000020978BD0000-0x0000020978BFF000-memory.dmp

Download

memory/4284-1437-0x0000020978BD0000-0x0000020978BFF000-memory.dmp

Download

memory/4440-590-0x0000000180000000-0x000000018008C000-memory.dmp

Download

memory/4440-619-0x00000137D0740000-0x00000137D076F000-memory.dmp

Download

memory/5112-1137-0x000001CCEA600000-0x000001CCEA62F000-memory.dmp

Download

memory/5116-1712-0x0000025FBFF40000-0x0000025FBFF6F000-memory.dmp

Download

memory/5792-0-0x000002ECB61C0000-0x000002ECB61EF000-memory.dmp

Download

memory/5792-31-0x000002ECB61C0000-0x000002ECB61EF000-memory.dmp

Download

memory/5908-1638-0x000001BF02D30000-0x000001BF02D5F000-memory.dmp

Download

memory/5964-605-0x00000000008B0000-0x000000000096F000-memory.dmp

Download

memory/5964-251-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/5964-604-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/5964-257-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/5964-258-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/5964-259-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/5964-260-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/6020-1720-0x0000028ECA910000-0x0000028ECA911000-memory.dmp

Download

memory/6088-145-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/6088-173-0x0000000000930000-0x00000000009EF000-memory.dmp

Download

memory/6088-171-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/6088-144-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/6088-138-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/6088-146-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/6088-147-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/6100-1111-0x000001F1125C0000-0x000001F1125EF000-memory.dmp

Download