f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf

Analysis

user interaction
yes
max time kernel
298s
max time network
301s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MSTeams_680.msi
Size 22.1MB
Sample260511-1p8phaex3q
SHA256 f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf
MD5 b848c1d883bc210453286fc3d967e745
SHA1 79a18e6d14db69a56f87708c3d14cb3baa83ee98
SHA512 b4f1e624fe65815d21925f6dd8fe6742e5e3fc6f5efb97d6470ca530e7901dd663c3ee13b4236c55db38777c953b602d9beacda450a77c6157524b65ca08f046
SSDEEP 393216:/A4EQoVqkO+fFgTOfPPNiv1P8z1FhO350N+54Ktq6UWP3knuptZgNFRdu/vqIWB3:qPO+fFgTOf3Nih83wp0N+KqMuptW/du6
TLSH
T19C37333E2A889325ED83DBFBD8F4C42CC4D733435D161067E99EDC6992E2A089DE591C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1264	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 5 IoCs

pid	Process
4840	hyBpXlX.exe
4920	hBeRqKUUTm.exe
4752	Update.exe
4376	ev2f79.exe
1176	ev2c34.exe

Loads dropped DLL 20 IoCs

pid	Process
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
4920	hBeRqKUUTm.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe
5264	MsiExec.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\vss_tmp.txt	vssvc.exe
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\vssvc.exe.log	vssvc.exe

Enumerates processes with tasklist 1 TTPs 1 IoCs

discovery

Process Discovery

T1057

pid	Process
948	tasklist.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Community\Facebook Installer.exe	hBeRqKUUTm.exe

Drops file in Windows directory 54 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DFFC4298D9B793EDA7.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF1B0935822CD2FA65.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C6B05020-75C0-43BE-97BB-1C2A0F20B71A}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA1F7.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_664745653\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1788986642\crl-set	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1788986642\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1857080952\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1857080952\_platform_specific\win_x64\widevinecdm.dll	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\english_wikipedia.txt	msedgewebview2.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCE991AD1797C6F6A.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8FBAAB1A071C61D5.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC9C8228319106F68.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1857080952\LICENSE	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\us_tv_and_film.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1652333974\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1857080952\manifest.fingerprint	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\male_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\model.markov	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\passwords.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\ranked_dicts	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\test.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1652333974\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1652333974\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI8EBA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1857080952\_metadata\verified_contents.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\female_names.txt	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1652333974\manifest.json	msedgewebview2.exe
File created	C:\Windows\Installer\e5877ac.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8313B6D5A5C4EBD3.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI7896.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File created	C:\Windows\Installer\e5877af.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_664745653\protocols.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1788986642\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\~DF7E222AB9CA2AAE9E.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e5877af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI937F.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\surnames.txt	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e5877ac.msi	msiexec.exe
File created	C:\Windows\Installer\e5877ae.msi	msiexec.exe
File created	C:\Windows\Installer\e5877b3.msi	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1857080952\_platform_specific\win_x64\widevinecdm.dll.sig	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\manifest.json	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1652333974\crs.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_664745653\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8441DCC660D58581.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI8F48.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA340.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4816	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 12 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2f79.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hBeRqKUUTm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ev2c34.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	hyBpXlX.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000adcdd9a6d08c0ad30000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000adcdd9a60000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900adcdd9a6000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aadcdd9a6000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dadcdd9a6000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\user\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe

Modifies data under HKEY_USERS 48 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134230099436994434"	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	vssvc.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	vssvc.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	vssvc.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	vssvc.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\State = "2"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect\CurVer\Description = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID\ = "{EABAE40C-B27C-455A-B672-F234DD780948}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Codebase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.Connect\CurVer\ = "TeamsAddin.Connect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect.1\CLSID\ = "{19A6E644-14E6-4A60-B8D7-DD20610A871D}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.Connect	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.Connect.1\CLSID\ = "{CB965DF1-B8EA-49C7-BDAD-5457FDC1BF92}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect.1\CLSID	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\UserEnabledStartupOnce = "0"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Runtime = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\Registry\User\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\msteams\shell\open\command	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\msteams\shell	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\msteams\shell\open	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\msteams\shell\open\command\ = "\"ms-teams.exe\" \"%1\""	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect\CurVer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\TeamsAddin.FastConnect.1	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-3847269522-1618051987-1942096715-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4076	msiexec.exe
4076	msiexec.exe
1264	powershell.exe
1264	powershell.exe
4376	ev2f79.exe
4376	ev2f79.exe
2344	vssvc.exe
2344	vssvc.exe
4376	ev2f79.exe
4376	ev2f79.exe
2344	vssvc.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe
4012	UserAccountBroker.exe
4012	UserAccountBroker.exe
4188	ms-teams.exe
4188	ms-teams.exe
4188	ms-teams.exe
4188	ms-teams.exe
2392	edpnotify.exe
2392	edpnotify.exe
4076	msiexec.exe
4076	msiexec.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
5936	msedgewebview2.exe
5936	msedgewebview2.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe
2392	edpnotify.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4012	UserAccountBroker.exe

Suspicious behavior: MapViewOfSection 6 IoCs

pid	Process
4376	ev2f79.exe
2344	vssvc.exe
4376	ev2f79.exe
1176	ev2c34.exe
1176	ev2c34.exe
1176	ev2c34.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5040	msedgewebview2.exe
5040	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4816	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4816	msiexec.exe
Token: SeSecurityPrivilege	4076	msiexec.exe
Token: SeCreateTokenPrivilege	4816	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4816	msiexec.exe
Token: SeLockMemoryPrivilege	4816	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4816	msiexec.exe
Token: SeMachineAccountPrivilege	4816	msiexec.exe
Token: SeTcbPrivilege	4816	msiexec.exe
Token: SeSecurityPrivilege	4816	msiexec.exe
Token: SeTakeOwnershipPrivilege	4816	msiexec.exe
Token: SeLoadDriverPrivilege	4816	msiexec.exe
Token: SeSystemProfilePrivilege	4816	msiexec.exe
Token: SeSystemtimePrivilege	4816	msiexec.exe
Token: SeProfSingleProcessPrivilege	4816	msiexec.exe
Token: SeIncBasePriorityPrivilege	4816	msiexec.exe
Token: SeCreatePagefilePrivilege	4816	msiexec.exe
Token: SeCreatePermanentPrivilege	4816	msiexec.exe
Token: SeBackupPrivilege	4816	msiexec.exe
Token: SeRestorePrivilege	4816	msiexec.exe
Token: SeShutdownPrivilege	4816	msiexec.exe
Token: SeDebugPrivilege	4816	msiexec.exe
Token: SeAuditPrivilege	4816	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4816	msiexec.exe
Token: SeChangeNotifyPrivilege	4816	msiexec.exe
Token: SeRemoteShutdownPrivilege	4816	msiexec.exe
Token: SeUndockPrivilege	4816	msiexec.exe
Token: SeSyncAgentPrivilege	4816	msiexec.exe
Token: SeEnableDelegationPrivilege	4816	msiexec.exe
Token: SeManageVolumePrivilege	4816	msiexec.exe
Token: SeImpersonatePrivilege	4816	msiexec.exe
Token: SeCreateGlobalPrivilege	4816	msiexec.exe
Token: SeBackupPrivilege	2344	vssvc.exe
Token: SeRestorePrivilege	2344	vssvc.exe
Token: SeAuditPrivilege	2344	vssvc.exe
Token: SeBackupPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe
Token: SeTakeOwnershipPrivilege	4076	msiexec.exe
Token: SeRestorePrivilege	4076	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4816	msiexec.exe
4816	msiexec.exe
4752	Update.exe
4188	ms-teams.exe
4188	ms-teams.exe
4188	ms-teams.exe
4188	ms-teams.exe
4188	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4188	ms-teams.exe
4188	ms-teams.exe
4188	ms-teams.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4076 wrote to memory of 2824	4076	msiexec.exe	84
PID 4076 wrote to memory of 4840	4076	msiexec.exe	86
PID 4076 wrote to memory of 4920	4076	msiexec.exe	87
PID 4840 wrote to memory of 4752	4840	hyBpXlX.exe	88
PID 4920 wrote to memory of 2828	4920	hBeRqKUUTm.exe	89
PID 2828 wrote to memory of 948	2828	cmd.exe	91
PID 2828 wrote to memory of 2884	2828	cmd.exe	92
PID 4920 wrote to memory of 4744	4920	hBeRqKUUTm.exe	94
PID 4744 wrote to memory of 1308	4744	cmd.exe	96
PID 1308 wrote to memory of 1264	1308	cmd.exe	97
PID 4920 wrote to memory of 4376	4920	hBeRqKUUTm.exe	98
PID 4920 wrote to memory of 1176	4920	hBeRqKUUTm.exe	99
PID 4188 wrote to memory of 5040	4188	ms-teams.exe	107
PID 5040 wrote to memory of 5024	5040	msedgewebview2.exe	108
PID 5040 wrote to memory of 4740	5040	msedgewebview2.exe	110
PID 5040 wrote to memory of 4740	5040	msedgewebview2.exe	110
PID 5040 wrote to memory of 4740	5040	msedgewebview2.exe	110
PID 5040 wrote to memory of 2740	5040	msedgewebview2.exe	111
PID 5040 wrote to memory of 3104	5040	msedgewebview2.exe	112
PID 5040 wrote to memory of 3104	5040	msedgewebview2.exe	112
PID 5040 wrote to memory of 4692	5040	msedgewebview2.exe	113
PID 5040 wrote to memory of 4692	5040	msedgewebview2.exe	113
PID 5040 wrote to memory of 4692	5040	msedgewebview2.exe	113
PID 5040 wrote to memory of 396	5040	msedgewebview2.exe	115
PID 5040 wrote to memory of 396	5040	msedgewebview2.exe	115
PID 5040 wrote to memory of 396	5040	msedgewebview2.exe	115
PID 4076 wrote to memory of 5264	4076	msiexec.exe	118
PID 5040 wrote to memory of 5172	5040	msedgewebview2.exe	120
PID 5040 wrote to memory of 5172	5040	msedgewebview2.exe	120
PID 5040 wrote to memory of 5364	5040	msedgewebview2.exe	121
PID 5040 wrote to memory of 5364	5040	msedgewebview2.exe	121
PID 5040 wrote to memory of 5804	5040	msedgewebview2.exe	122
PID 5040 wrote to memory of 5804	5040	msedgewebview2.exe	122
PID 5040 wrote to memory of 5936	5040	msedgewebview2.exe	123
PID 5040 wrote to memory of 5080	5040	msedgewebview2.exe	124
PID 5040 wrote to memory of 5080	5040	msedgewebview2.exe	124
PID 5040 wrote to memory of 5584	5040	msedgewebview2.exe	125
PID 5040 wrote to memory of 5584	5040	msedgewebview2.exe	125

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\MSTeams_680.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4816

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4076
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2824
- C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe
  "C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4840
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=hyBpXlX.exe --bootstrapperMode
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of FindShellTrayWindow
    PID:4752
  - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe
      "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.4.0.0&instExecTime=1778536334481&launchSrc=t2installer
      4⤵
      Adds Run key to start application
      Checks processor information in registry
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:4188
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,BlockCrossPartitionBlobUrlFetching,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=4188.1196.17374448305662382215
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:5040
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ff8fbaab078,0x7ff8fbaab084,0x7ff8fbaab090
        6⤵
        
        PID:5024
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1656,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1652 /prefetch:2
        6⤵
        
        PID:4740
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2012,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:11
        6⤵
        
        PID:2740
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2256,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:13
        6⤵
        
        PID:3104
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3740,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
        6⤵
        
        PID:4692
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=4320,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:1
        6⤵
        
        PID:396
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4808,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2052 /prefetch:14
        6⤵
        
        PID:5172
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4924,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
        6⤵
        
        PID:5364
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4576,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:14
        6⤵
        
        PID:5804
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADoAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAABCAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=4736,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5040 /prefetch:10
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5936
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=4616,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
        6⤵
        
        PID:5080
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26093.415.4620.1935 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=932,i,8720788553059601098,212313845990854737,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BlockCrossPartitionBlobUrlFetching,BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
        6⤵
        
        PID:5584
    - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 19b13594-2bb9-4ea2-b2b1-dd868cf83756 -Trigger EnsureTmaAtStartup
        5⤵
        Checks processor information in registry
        
        PID:1748
    - - C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID 19b13594-2bb9-4ea2-b2b1-dd868cf83756 -Trigger SchedulerDirectLaunch -BgTaskDelay 2490
        5⤵
        Checks processor information in registry
        
        PID:4204
- C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe
  "C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C tasklist | findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2828
  - - C:\Windows\SysWOW64\tasklist.exe
      tasklist
      4⤵
      Enumerates processes with tasklist
      System Location Discovery: System Language Discovery
      PID:948
  - - C:\Windows\SysWOW64\findstr.exe
      findstr /I /C:"360tray.exe" /C:"HipsTray.exe"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /C start "" /B cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C "powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\"
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:1308
    - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        
        powershell Add-MpPreference -ExclusionPath C:\,D:\,F:\
        5⤵
        Command and Scripting Interpreter: PowerShell
        System Location Discovery: System Language Discovery
        Suspicious behavior: EnumeratesProcesses
        
        PID:1264
- - C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
    "C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:4376
- - C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
    "C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    PID:1176
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 3901F10C5FA796D7853246A8B911C17E
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5264

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Drops file in System32 directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2344

C:\Windows\System32\UserAccountBroker.exe
C:\Windows\System32\UserAccountBroker.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4012

C:\Windows\System32\edpnotify.exe
C:\Windows\System32\edpnotify.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2392

C:\Program Files\WindowsApps\MSTeams_26093.415.4620.1935_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:4808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5877ad.rbs

Path C:\Config.Msi\e5877ad.rbs
Size 8KB
SHA256 edebc26165575f63869310e5105b4b51a59524a205206796b621995befd88149
MD5 4609adf76d4f68db44566ac91a78e780
SHA1 d4fa99556d8ed7d3e6de490f29f9c0912877286e
SHA512 6ee075beabc808fb05fbde83b907225e32d1c4bdb88d4f65a4758b7c800c41976a54c2e9a41498c3aa98b4b4f93d1414eeb39e62d98fc390b08ebaa5c4d09f31
SSDEEP 96:zh2EhczumI0IzIsbQfQnU4MKCsThqPU4MKC6jjjzxThqIHbTwWtEHKGQRCip2BNr:zQEhsCREskoUVZI3VZ20ipa
TLSH
T1F9021108B385C4D2F6696732D687171837B3E3F68310339F664EE2184F27BA5AE1D096
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5877b2.rbs

Path C:\Config.Msi\e5877b2.rbs
Size 357KB
SHA256 d6283ca5b34f4a7ed9789afc58018ef458524732417d81e467bd1733a0db8613
MD5 d97b65327adb73bae039370bd90cfd7f
SHA1 1862b9993463a3a1b5b6ce3b1136394a68ee7736
SHA512 39718641e2278af193dfee263d2a1f5f22e795b13f113094d9c151f93a3070662c0d1090435e2c0ab7aa8c79e39e7b3ad491805bff472f317d9f13b64e8c186f
SSDEEP 3072:Je0z/XjS8SgMq+jVrrb1MMBBMolzaDhI314S8SgMq+jVrrb1MMBBMolzaDhI31RR:Je0zrpkp11ex3pkp11exQ
TLSH
T1EF744B11AB41DDB6D47C353612B17A8D703EF6630AC0BE9F8700D6684F6A7E8E718E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\AddinInstaller.dll
Size 35KB
SHA256 c0306045119da6aa284f77f5ae57e9a35ae473294ef6b983db909902ef860b65
MD5 077c50b05317268a4e84b0d8e18b7e25
SHA1 4e4320e74fb1d2ca46e38b7a5554547f8c0ea57f
SHA512 e61171028a7faef3e4545ddc1a6a0e9a0ba618c20db82d4cb32eae379710497b30fee3f165400ed93c2760e04c102889686a14d7f996b3664026c881e93024ed
SSDEEP 768:CJLtIDER3wlQ0Tkjb6PO59zeTzlU+9zZU:myARglQ7jQ4zeTm6zW
TLSH
T1E0F21891A7F84102FAFB6F706AB4E5422DB9BF875C70D92D1989E14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftTeamsMeetingAddinInstaller.msi

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddinMsis\1.26.08901\MicrosoftTeamsMeetingAddinInstaller.msi
Size 13.9MB
SHA256 636115933ab2f678c8d9eaf50e79e47be094436d438565fa30b0f1ae3d7362f4
MD5 8444b913223f0ebe0d7eb0867ece55e4
SHA1 43028a51223cbea7b405b18be0a59b42f7777136
SHA512 a1617c7eab8ff2922e9ba1c4273db6917cca25d3ac886aa28ee59dee45f4dc0a406be0f5251a189fd589720635aeeba8781f0899fbd3cb080ed82ad3e7c7596b
SSDEEP 393216:PMyGsr31tl7C4WYe47SXsxbOLq5a38wnt9lTmr7:PM831jG47ZIsZOLq5a38wnFm
TLSH
T170E63353358AC932C2BA0A7826BB97556B7DBD254DF0CC0B5710BA4A2C723C01BB5F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

protocols.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\AutoLaunchProtocolsComponent\1.0.0.10\protocols.json
Size 3KB
SHA256 4fd800e7b1a5fb24b13fac2e31946d205012b7c28d8c61580b0669b2fa3517cc
MD5 1de85fec2dfcc28011a7c2aaab95eb5f
SHA1 80e8c954bfbe8f7ee5a2335c8d969ae033935dc3
SHA512 9c7dd37eb0c094b6aa05201e7c71a8f33b9db81284223bcfa595a44a6ac95d5a6820ab6f07b7aa8d26bf207454e94277bf35332e9c009ee63f083752b6b51750
TLSH
T1D1611DB79A3048090E3412B86B19B35DF63E029F1AD598EB76BE568F1F710F7245C54C
MD5 SHA1 SHA512 TLSH

Submit Download

crl-set

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\CertificateRevocation\6498.2025.9.4\crl-set
Size 22KB
SHA256 6ddcaf50aaff98b960d067054ce2ce17872ac0719d02abbb7fe56b9eabc818f2
MD5 d01869348d5a783f61f90cbb27b82a78
SHA1 d4eccc91435adaf01f8589cf7f3589cf65425de2
SHA512 7ad7f27d1f559d1f50f1f009518ccca5d6d01696cd70657ad94c9fe37db7bbe06e4afc13170bc5c065cf72d69a92c3df78f637b7faa2f968bb89aa154fe371da
SSDEEP 384:2t71+UygzeWhU6yVS2Ddc0fp/9yYoIJgWUeJuDzeG0LOsr2h9ltQYX9hVPz/HG1y:m4OBwVPDdFhVyYoPWUiuXeG0K5dQYXFr
TLSH
T1B8A2BE9FAF48F112E211523D94245F40DD24D54A23996AB74F943F30ADAE42AAF3CC7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 48986f171e1d815d27ec90a6b94ff19d61df2fac0584213207470100069c02a5
MD5 e6543b2592139fb8f849eae7f234873e
SHA1 fea3851fe3d8eb014d1a8e80aa992a5211f35b3c
SHA512 24cd62441a8da50deaf5e4ca8b2dbc838fe1236a2c758414d015cfd66f96259e3ffc1fb97673788b309925b176a0b642d26a3c080de42fcfca951e94a220a9b1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 2ba9a0de8eb5f7507ef53e07856d1b5332def6b47f5d9f6968e1a7f3ebdff0b1
MD5 a17bfb91804eba6f5679f34f82578bae
SHA1 35b28bcf8bad45631a87b179aa27ba401b25154e
SHA512 695570c164c9a192518ae8a55bdc9b10333b787331fc8b8dcadc0e7bc5b274d31273469f2f3c2b9739ed5b49054038e3fba15b2af5e445df36fc558aad64a4c3
TLSH
T1EAD01213324101B4C02020730803A3080800D50BC0455405682DD91E5A044900907D41
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 1KB
SHA256 a905d0a68c81cdef368bf2b7a248ce91c04594076578a236b11f7a8f3bb04bf6
MD5 7efdea0ea0ad7e26a77a969fdd173c99
SHA1 955d6f7824711f35212fb57d39ac780cbbf0be40
SHA512 f157f785e0436ad882134c62193c51e29b1d0d000564360d4b9c42db3935da691e7a5dfc5bd0bb5f4807c1c1ae4c7484890b58cdb7ab7fb88a823cf391b61133
TLSH
T10831B573E0949B3229D29A9AB1436B472F212136E6518F88A1DE0B1C19A779C653BC33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 b64284c247be950c714942edb35ae5d34929ea7aa549336235e7e37b29c76a19
MD5 446f6f94373fed189ded41b2760e32e4
SHA1 0a9d4190bf461e3e2d5499c5d2544b1c9d8c2098
SHA512 bcf3c5a9d6808838b4bf0392b3991405a66bcf1d674a98b1c04d4c8b8427ed69b6e1982c570dca6cc4c494ae69f12214e9c1f326ab5c8b503940595cb6f6663e
TLSH
T144517573A858973645E38A59B84B2F136F351162AE622FA095DE0B0C05D776C2316C36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 b49b0aa1ec9bacf0792bdca1fa2dc1b9c981913ea4076ad15055219c22300e6d
MD5 c282582fc1c70534cd4e2d56ef56dacf
SHA1 57f6b3563a3d460aac25a106d8385e8030c83486
SHA512 60a403eef766b142cc3b68c9ddcadf5861017e0ffca575c95aa6ad3e15cee9c4a4ec1d090290c56c90159e283ec41c3882378f6e54f17006d770cb9871cd57e5
TLSH
T136718623A968D6370DF3DE49B8862B067B651137EA953FA4D9ED0F0C05D73982312C27
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 cbbf46461a0533552ef7fd4975fe5f5f57bbadfe8cf88015b917f21f334e2705
MD5 bd51a84066b67362a3eee8f8d5cb5186
SHA1 e063ca0de344cd972c10e73477450b2585f013de
SHA512 0328b441a350fbd854415809b7a0e975aff86a04e8120f3a4d16151c13af853b10c3c14609286c057d476024469d05117a43abe8d188bfdaef300095d5882edb
SSDEEP 384:zZvsrvyOiyp4+IWA1eUVWGfvvLhNbLBqjtyf/k2Mu/g:t0raxyp4sQe6WGfvLBq4fM2S
TLSH
T12272AE720A7496379DF6AC4ABC4B3A0A7FD85177DDD12F98E4E91F0E06472C81706817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5978ef.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe5978ef.TMP
Size 1KB
SHA256 ad054bb8d04c9c7a5ef87ef331c63383e2453729f8f595be0b6fc390c2cb7471
MD5 5bcbbf191c36c1eba519aad86fb3f6e2
SHA1 6fe7d7455aa37c0a82a446574b7b51c61d05c990
SHA512 de172cc1b14cfd28556b99e78cb8fafe8c16f1dcc6a2bf08dc70dd3a9890e37b4756c7d9ea3a1ccbf335e413b5af1674873457528f9b27faa4369c6f357e2be6
TLSH
T127219573D0989B3129A5896AF113AB4B2F502136EB109F18E1DE071C1A977EC623BC33
MD5 SHA1 SHA512 TLSH

Submit Download

crs.pb

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\PKIMetadata\46.0.0.0\crs.pb
Size 233KB
SHA256 c132e2ba94619caf6143b3bbdd9c32944e80cbf3bff87364175c42801afe2584
MD5 8bbfaa2cd5cdd9a5019da146cf4deed5
SHA1 17ed2fb07543c5d4bc196a1989dd16a9dbcaacc1
SHA512 cfeee2916f19648ed408b4287e234b4140cf82254cd4b83d918c0a4c3bac2b0467d921915aec290823355be4a0cc82017557be588f65134b466b7192f795f6c2
SSDEEP 6144:KKiD4F7BVps9YpVW+J2i/P66k8GyST+uUP:KB69Vps9C2GAQb
TLSH
T14A34AE9A0F3C3A11BFD2DEA466C8D9377D79B3E06A6928172111C4F169927E07D8C12F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ct_config.pb

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\PKIMetadata\46.0.0.0\ct_config.pb
Size 16KB
SHA256 aaeeb46cd91a4a392223cf2885f449bf532f0878c087d50bb0cb3fc7fa873a60
MD5 ca6e253c3fc7718b4455493460053be3
SHA1 4085dcccd29a931b8ea9b74f008e26409edf78ad
SHA512 0004e83a845bdab07f01df32094c202c9f3b8767a6dadd707abc19796f917221f869791673315e9d2c5a6a1fc50b922cceb622db98601055df5949818dd6ea58
SSDEEP 384:7tomWvvtJvzm9myvg+FN2VOhikm5hV5+QiyA94pDmiDyDS1c8CazaUhszz:7l5Zhk5hV5+Qis2DS1cbe7Kzz
TLSH
T13A72C9BFA1169F000383D558D6E157AAA12363DACCF3763DB1E1C005F5423E6B1A567B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

kp_pinslist.pb

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\PKIMetadata\46.0.0.0\kp_pinslist.pb
Size 10KB
SHA256 b5b2a45a5b25becb901916b13752e3477d4126a42d088f29863bd8672320ecf6
MD5 8061c7027f406f3e20ea5d26969f00bd
SHA1 635d6260e16d1ac595f760df9c5bdda8279629a4
SHA512 7be0be7d59ed46b7ce6adbc1ddc42119426b3223491a03ff068dae66d13a261cc954640916ff4379a6040e021689f070b33dc82b45c010b728ee59abd42f3610
SSDEEP 96:Bxk+yBjecaikDBwrBnnoxGwMAy5z5tBT6c5MacFwn2Xh6g/gw:I1IDCrBnYQ5jlMacFwn2c9w
TLSH
T1362204B37904F99350E7E0BE1041F59AE93343A540ADF98A528C4A7635F1F0719BB4EB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

822c3841-a3a7-4930-b9b9-b5c306986d19.tmp

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\822c3841-a3a7-4930-b9b9-b5c306986d19.tmp
Size 6KB
SHA256 0fcb47a3a08397a6d7b22aa0d60cf85f334e630ead690751e94b721523f6eea1
MD5 29c3e106bdf224133d04dbca7b967365
SHA1 0ecec6a1c1246b604abfd203a96657406daa5610
SHA512 b0154ecf5affa827cc72c6ab960711daf11a4c206bf661d0705b5267cbc120a4ede28af19e9eaa275861b4ed282d4331bd227f916cf5153fee358879c0df4e31
SSDEEP 192:st9p7XfcZ8paqmn/S+WiFY7YS9pgwd7Y94cMC:str7XrS/VxwFC
TLSH
T1FBE1B7039E6859774CC7E619BA25FB12E3F6512366D50E98ABFC860C09E66CC730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 0fac968c591a438254ed153c26ab3abab6ce600e6d6ab2b642755ed18e3a7d63
MD5 1eab20eb5f734fc75d098d317c3d9811
SHA1 05f85ba9e450dd9b079c32168e5b8b348329f6f0
SHA512 5984385bd5fa130ab6f89a0856e9c44c00c6df632ce845faac0a33b31f58d132666a4e966ab4944a8117a7a99289b0f9d3b799e22dd2932cf4fa15004a7d3c90
TLSH
T119414E7941EC691FEFD8963C18184C82A9C0C13D05900F53C923F6B6067BFF1112EA2E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 45f65d7565f9f97164f97bcdb9b57b82f14c7d9d0eda83f738cfb0c3848254e2
MD5 56569d46b10d6151a3f2d8b3be6ba165
SHA1 8295b79e8361465269c864055886c1440eb6bbde
SHA512 cd8960839fac0c9cb4359b1f1470be218a93dda035dcc03d5be12bb43303b0547703719e09f513052e2850b45854efae3c5db475908c882ef72083073f39127b
TLSH
T1D6412E7941EC692FEFC8963C08184C92A9C0C53D05900F53D923F6B6067BFF2112EA2E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59e0d1.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index~RFe59e0d1.TMP
Size 48B
SHA256 a6428781b766203d4ad779a84baf96fa9aa7a243440ef6482db5b3059d4b2eb7
MD5 0d7c18ea8af499e64d6a4986c2355f8d
SHA1 1bb6598c09c58f0d484af9cb7c8d7749ef6ad1c9
SHA512 645fed18eae8af6f6c1d2fc5df5465195f9c6dfcbd689a8c29e4b35dd70e6a2a48a045fed8ef4b54408170821723a1cdf286c49063667491e0b695f92beaa55b
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 1014B
SHA256 0a855bf02109185e1cbaf53ae20a2d50f604c5c4a57500be5166936f1f825306
MD5 87069da135d8982cc40a2783744b7851
SHA1 a02976602994d7c795f19bd58a16009bf3432448
SHA512 0956a24130d26bc235297695bb9950d6411f792c62a0f5acbce69698485dac965b11350a5b690f6a81d1304b295801e111d474244a8223dee9619ca69ecb2835
TLSH
T17511C9B387A408AECE4146F01A24EE1BEE2D0242430C2824CAC0FFA7D7E3072F10321B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity
Size 517B
SHA256 7d07086b5a5b404aa030bb1dd5f3830613f91113e5392b928fbbe0a1b5f4ac0a
MD5 a514a80ae09391dfc339142aadb22962
SHA1 3e3ae401b90afba506676bf9514b156ed3974dbd
SHA512 727d188ef0655adbd27e08034a2694acd924a9190b381767444216a3e2529cc77fa08654bf08545cb70f57a7c29081a4c5f516c79829bdcf1b21a0ed26564651
TLSH
T135F059539579F46BA57D0ABB5DC4BE062E3FF0351182E0F4E96A807C60456F70223463
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5b8692.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity~RFe5b8692.TMP
Size 517B
SHA256 99038786aad11fecf4b078d08bfe817e2365747cb86854ee22a6da0525cd1d8b
MD5 3e095ba30c48f08915790d872860d87d
SHA1 65c9d951d37e020233fa905481c71db880f32f07
SHA512 f135a2f2db238c90a84a05133ed6ff82f955ea97a35003c017b6a65bc39db9645834fdc217672db0bc41ac3ab78d98a3a16f607b6204afc0c2cf50520267d01a
TLSH
T134F02453596DE86BA67E0ABE5D80BE0B2E3AB4360153E0F8D96A817C60446F31223453
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences~RFe5a1723.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences~RFe5a1723.TMP
Size 6KB
SHA256 e90f1df458bc9ff0b653e9356cd579a03664dae1043dc26ccc429e368047f158
MD5 110dec7c9715228eafbcfc0ffffea269
SHA1 2b531278f29c15c5a91481d492e7c82eea185f6b
SHA512 a181950a5a3bcccaa9648a2df6b52dc2038438334b6e64272e85df44cc2f5d57140a41c3468d8ef4ddc9dc3f5fca019d3365b7474a8ec1103e712acf175e2edd
SSDEEP 192:st9p7OfcZ8paqmn/S+WiFY7YS9pgwd7Y9vcM8:str7OrS/VxwA8
TLSH
T12ED1A7039E6859774CC7E619BA25F612D3FA512266D44E9CEBFC861C08E66DC730780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\2e5b22d0-2b4a-4f3a-9b91-02a3207a4ca0\index-dir\the-real-index
Size 96B
SHA256 8c4d80b8c4c7910daece34ccdb9b1961c08e71ffe6789ba880a94a1071b5b443
MD5 adf5c234292b171486ccba6070792046
SHA1 8d616bcdeb52530ffd0b5d7e552d2c00e03ff83e
SHA512 600acebe1c8ddcba80430288892a4635fc3ca85901b2a864049db44624363ab0122aeccf7ba51abffd467d70646bd0efbe5dd6911dd73d41058d113d457214bd
TLSH
T1E0B001180220461AD40047BD22C68AA2A32D6E5AE2520215A194E6ECBD6D76261411A9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59da87.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\2e5b22d0-2b4a-4f3a-9b91-02a3207a4ca0\index-dir\the-real-index~RFe59da87.TMP
Size 48B
SHA256 a37be4302385a9ac87879000ff84d6f18d2c0569f261c51d0c7a2737b6d852a6
MD5 94d360fcfe4bf4f615f16a9c0c09754f
SHA1 8fb169ff382639f61f17c75ed814c3008bed092a
SHA512 fda87bc7da7bb769b2f70a4abf4275ae3a58abcee4abd32782ca345f27e4b99bb6fc329d98d9b93b949381ecd2ae3736770766b3738c0b8505b463ecdcf36884
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\635edffe-8ca6-4ef9-9fb4-220d4551efeb\index-dir\the-real-index
Size 96B
SHA256 f519846be9c33d39cf707e79034956f2d9ce891e77a32635ed4dc4b92bc50af4
MD5 5209d28504e18cdc08974b2ed7c0384a
SHA1 90fd008a24a5f560ebefa68d3fe661b3946fb4c7
SHA512 f536029bc3ebef201afa4f2b011f8283fbf555681d9855cdcaeb2ac8930d5e39c54656d0b6d3e344bcc3bfbe1b91fa1766b102b9c6d2c48bf2e4cfdf64cb6c1e
TLSH
T1B5B022E02800802ACA0083F382C3AAC0333C0FA80B03032C82C80023FC2A3C002C0020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59dba1.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\635edffe-8ca6-4ef9-9fb4-220d4551efeb\index-dir\the-real-index~RFe59dba1.TMP
Size 48B
SHA256 80df6ba23a399d907251890a30e29abed9ecd9dfc2af787c22f1ff87cfa46998
MD5 b2e947cb5e2d1a17e2fe8d71cfb5e91a
SHA1 a83cc6157bff6c9996e5956925ca704fe22710d5
SHA512 cf50525207de87abe40fc66e1657bfb0047767399666266fb085b18fa1994479a0cf420ea68d5043253724704288fb11dce08f5860b3ade1c27cf784419c8e5b
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 e8f9af0e6e63b09b0b7e5697c0583a85ffa740dd1759f8cad90991c191d41f12
MD5 614fca168aad259de0a8bd50430a6afc
SHA1 236aed12a9c8014ce7023f9a0746e7680b5c2183
SHA512 560c525ea5641d40fa1518d4317b83fdcd187527b3d7eb7a02ed6d0527531e6ed24f3c5cbeb4aa8d0097fa04feb1cb7c6c3d01e00239f061483a5d4b44dc14ac
TLSH
T16AD0237FC5004C134F8D59C4D4C1D027555E4C477886F0858ED6B401793F6E696056F1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 eaba9823fff36be096b4086739fba97fe68095ce1403b95533530337d10ffdff
MD5 e5da5813ec8c2c9cc964fe455b62573f
SHA1 9bea86b5a8975afc9d79614e9a5a2e10d5c31546
SHA512 748c51ae3f36ffad7423c1330a70f92b9768b1535b75f282b2df219d9c40318f7a102f1fd71a909e776ed0851ce04209a44d743cb3baa9a2a13e175824e446df
TLSH
T1ABE0C23BC5005C278B4E69C5D880E01A855A4C4B68C2F2899DA5AA087D2F5D6AA0A6F1
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 07fa1e5624d750686b9e8f0df14c918c9d8f745f6e846a7eac93258b7d3cecd7
MD5 da9ca85537c5516b7af13c4967cd690b
SHA1 5315d488b242b5fb9d631227b94c17d1e7205b72
SHA512 49fa350df01a0cd4d1b345a9140f67c81e9a3eb450095fde8a9afbbda46738b279e8dddbd65f7ab0a0da9f92ee432bd3da50fe03e4b028c7ef961cc47f40fcab
TLSH
T1F3D0EB3FC9000C2B8F4E26C0E8C0E01A828F808BB5C2F2889CD0C9087D0F1E66A091F3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59835f.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe59835f.TMP
Size 141B
SHA256 edc2b517f694376e64f4274d24a6cd77df5a377b9bde064bee39f32217364f5f
MD5 6c313f0c55975f0cfb0ffa139a8a9ec2
SHA1 3f6a4083b53cb0bcf95816d30937a9feefad34f5
SHA512 a775a4ac29d370354f742c733b6d517fd3cf26180cc5c1fc39c1c344671a0e63d94fc3bd0da8a7ff2ff3150047b358af95bf4ee0ccf9fd6c4c2f3b4769779c75
TLSH
T116C08C3FC0000C020B442285A090D016A00A8D8B5882F0A884CA7041283F196A1164B5
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-05-11_22-52-20.01.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-05-11_22-52-20.01.log
Size 2KB
SHA256 dadecb66d7a0cbd1a9282ccba07f14e0d48109d7e72fc87b1d1be30e42aa9987
MD5 23e04542d30573beeb407a0483e83f04
SHA1 7ba087b354c6ab15d648b5f7135e33da35407f88
SHA512 7acf2dd93240c7e485a1026dfe8053dfed262b6798fe53a6959a97878d2b7dbca00b3c06f80d504a365eeff362da108a376bb78236ffc30969de9343ab767c3e
TLSH
T1F251B16A459B4461E5491E0AE7303F50C79EF20EE2FC306C7FB07B5A430C1A98E5C2AE
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 a31a22fd34ea2a8e759e0fe916ce57ff983a57361335b92a309ca1c926615522
MD5 6a9b924a681c5e1be67e82959aa8f816
SHA1 53d5dc80aa81345075fbdc7195243c61d37c96c2
SHA512 7fecb89460958726a4a93a9b8e2ff0d942180246d442cdeffffdad4c006c336cbd651b992d1c597d1e7f7fa1bf42d855c1993fbaad7556d981ac4178477da8f9
TLSH
T1CF51C42C0514A2BEDDC7864BB55F3E234AE741A4EFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe59764f.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe59764f.TMP
Size 2KB
SHA256 9059aedae41985c3bea5574bb24bdfc779a81a7950b8e3d391c3b6c2486c5888
MD5 1dfd4312dabffb5d401c38fffe675cc2
SHA1 1aa7fe1743482b829a660e74791fddd811f2c5f3
SHA512 e10fb1041d771a8d79b900cb2ec7c226f1487b78c9909d53e91c512cf53332672c7a16108797ba3b3e280fb747ce2cc9594c6deb653a321d70f4642521d515ec
TLSH
T13C51D52C0614A2BEDDC7864FB54F3E238AE701A4DFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 5b723f8bc5a5b5a1cb79320783a6b5f190bca51701aabf2c3eb991d7c630ba18
MD5 c21adae5899ea73764e646b34a7dc576
SHA1 0931932338ef376b4639edd225326de00f0f918b
SHA512 863ac05f63243998aa654db64bdef651413e2a0341eb634ad17a5a66abc52e6a727896823346264ed9207afb42e114c4118faab80aac5d49ca06e502201827a0
SSDEEP 1536:asOSvsBoP16ChLJV9UBYDireji7YDere4rHdkl6iR:wgV8k
TLSH
T1EFA561A41845B6FEDB8AC2B8673C2F18B5FC4DB78C415024DADDE61D70A346673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 91423194c598801291d18d25ae25661447d51e1b01ebbd2610299a23f0d837c7
MD5 abbf7fb6405c5fc91d04b68c16de44ee
SHA1 e5a3153acb99a4bbd2a21fca8c8ea9792f54541a
SHA512 a014d202db28d90396c4151fd7887b29bcd3398ba1291893026c00371309f5a63da34b3249045e02449bcc1a7b96580f4df5ae6288843c02c60ad499c7211501
SSDEEP 1536:dsOSvsBoP16ChLJV9UBYDireji7YDereRrHdkl6iR:xgVxk
TLSH
T1D7A561A41845B6FEDB8AC2B8673C2F18B5FC4DB78C415024DADDE61D70A346673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe599205.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe599205.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 8KB
SHA256 db2753940905959f4779a6093fb250b783b5a4f60ad02054890afd6cf22e72ca
MD5 2ad79d0d7e4b1c0506a54989eae21fab
SHA1 bc663745074145a253a49522b711d929813ecbc6
SHA512 e171cb1ee7b38af5bd4f7eafb0e6652d055e7ab12e87c439c90e3d82b388be6acb6e1d92c383bf8bb6b62518d1e99ee8f43c63dde56da0027d8c380df42da31e
SSDEEP 24:KRSqt8VtbDBtDi4kZERDoiqt8VtbDBtDi4kZERDf:0SO8VFDYMEiO8VFDYML
TLSH
T16902F1C175787261E1A921B7C8B3136B173D9269043382632DB258919CC19CB94361FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 360B
SHA256 9b3303fda5ac07cc806551ad1f67a5c26464ebd6c47e142891198fd8d53f02e1
MD5 f7a98c7990867223d91848ee6c7fd70a
SHA1 60a279194a6604fea0395e64723359f993305433
SHA512 dae44d8f1f5cac286cf8ec0c3a21a56c74cb182531610c70e8d17140d3a1d3d540bba582e728db27e772ebcb9a1d5f4fe850575e785f2a15b6a7175b599a363c
TLSH
T1A5E0C0070F9E567723500500C874AEE0CDB43A4F8158C4A17B3FC24A16151EDA040205
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 bd9bc644d82ddf0e6dce3667118959a2c1eb6b0f5103decdea43e126c4822109
MD5 651c6eca498ae363c8a870e55e85dba6
SHA1 6570842d37ce925c2800ad8030760f6190138c8a
SHA512 917cb5c7968cf868f8b8855e9a39d9be334e37b5a7fe92059441d7b7728ef526a9541c7cb690281e471d500f415540211a81c688eb7dafd3d6165f7bfcf6d600
TLSH
T129C02B030D17A2330B500E00C7BBFDC3C5883D87017018204939C04C0B286FEB00010F
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe5975c3.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe5975c3.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.5MB
SHA256 1f2a34f84b7f4171bcd0d40c80acee8aef0d9dc3529deb3e372bae180f571c14
MD5 b690b2420b21107e633b4e325768c1d0
SHA1 8f3faaab9eb83af7eb1c9963230e5980642c1dfb
SHA512 64b900fb5cefb8dec747c768061ea95d4ae2202127ae41cad46a59ab5e5cdfaaa78743d6383241a124e3ee4e2015566eb8f05285e16c12669745e23d293c90f6
SSDEEP 24576:DsOJ4Ly3kFbfr19RGKrestu44wKOwVuJaua9Y4RL/Tfrls4ON80gzl+BWRUAQg7/:4Lyijr1PGKltY7ls4Om0gz3UFoZ3x
TLSH
T1C5C54A10A7E88E2AE5BE1B76E170126117F2F9896772F78F560C60BC3AA33544D513B3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 8KB
SHA256 c3fa333fdbce95d504aee31912993dc17ab31324428f557ac774f7e98b049b99
MD5 3488a1749b859e969c01ba981036fab6
SHA1 a65b72461fa14c89fce0d025e43454830a1f7972
SHA512 7363003422bdaabb7943439ee1e846867f0f3d0baed3456424544a81989bd2d142a411cf982d90e4158314d410cd1a1a4ee33d8707219b4274cd2841705bcecc
SSDEEP 192:BSHYMeY9ayCss7Db0cvhlCZMNvgKiMKEl7eJ1XDw65pz:obBlCsyDb0cvbCSmEo1XDvz
TLSH
T1CC127D8FB85F4F9651593087F2C409051B0FECA9F990A6A7AB309BFC31614CACD24F94
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

endpoint.json

Path C:\Users\Admin\AppData\Local\SquirrelTemp\endpoint.json
Size 610B
SHA256 1578d085af8165ef971cbb88d327e07c2b82c34eff379fcb2ab030a188b2981d
MD5 34b2a3afe7ae8ad113f54e64d2f62111
SHA1 c0afa4727bab161b777363fd49225d7ef084c16e
SHA512 d6a8a70603157f0cf4b4d2a2992b8082d30e35aab7e47f973e8bde5841dc5528f7a62a8d3889093343f0a806a1161965126140345ffcb4cb0dbd36e56f155720
TLSH
T1DBF0F97BC7C280115FA84383A64BAA6DB91B6A4F3CC8B559C0CC850922119B6D7425BC
MD5 SHA1 SHA512 TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 534a49eac79e036dab7d3461dfa583fc9f628bccab83764a9a7e6f702a6cccce
MD5 d34c6a5eb26704cf629735bc4fc700fc
SHA1 ed954871e2b8c76fecc0598a691ff089353579e7
SHA512 59a65dea7cba3d220551df9977842cb9448a8c3d21d1a02ef801233124590496af2ef9d569395cc302ced5b9641c3b4a546fc8f8202f58abaf567ceb55e33abd
TLSH
T16C900210A12504A51A91194C44249A4AC5996247245A33B1808A54DE5449967468AC8D
MD5 SHA1 SHA512 TLSH

Submit Download

CFG8F46.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFG8F46.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 1KB
SHA256 198de1b92ba82bd8509489e40496fc7bebe8295aea34f5ac8269e265c01998b3
MD5 878d4489a125f3929ccd7becdcf68642
SHA1 33902271642ac66d9d5481fdc903f49296283274
SHA512 45ba2474f22237440b36681a3769a9cb546a26cbeb88ceb21b528a013415c14a478aa41a8b470b7cc63f28fed73bab90946f053ba40173480d7c34cfff5c6031
TLSH
T1D721CD1759A0D21E4AA0611D43B07E8F6A7DF35322053625F7B4C2CC62074BEDEAE04A
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mocszdiu.dsz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mocszdiu.dsz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

DcryptDll.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh7BC4.tmp\DcryptDll.dll
Size 20KB
SHA256 ad313f94da4ab0980173e60cbda7d1510e92fb49d2359224e0f89dc3ec0584e7
MD5 0a5e967b684d6f3db31cffb619cc0222
SHA1 2ed62db69f3ef5b0294805e326e3f41e5b3b0ac5
SHA512 9cf83f8827aafba394befe1a7c91cf6e12ccadc0767fd1934a823e951b6b6cb24ecf7ee56a4c012c162a41900de0c5f1820ca6fd6836bc474881d9f23e966954
SSDEEP 384:k3tsJOACduC6f6o14y5+UKjNLUtTQdCLXXCBwnp:k3tsJOhuDC44y5uLEeCLXSBwnp
TLSH
T1E492D750CAD10420E0B322BA7AF955129CF87E321836610FFEB7065B6D78AD76767732
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

nsExec.dll

Path C:\Users\Admin\AppData\Local\Temp\nsh7BC4.tmp\nsExec.dll
Size 7KB
SHA256 3a101fa91d4e8831dfb748a1e345ab74fd4a551e64254710bdf53972ba9b473c
MD5 c953dd0aab774f1446fcd63fa7c5f613
SHA1 6b7e1ef30b3ce2b353d310a8c99111c01e1f752e
SHA512 7fdfc451ada1789ad44a33fee7a97acf9f482ae58b5207564ce8ac90fbc8b0fc891bc02d8c1d9a1d0d3fb77954106115582080e129bb93634a2cb16777201e14
SSDEEP 96:JbzdzBzMDhOZZDbXf5GsWvSv1ckne94SDbYkvML1HT1fUNQaSGYuHwDQ:JEQHDb2vSuOc41ZfUNQZGdHo
TLSH
T15EE1093571C02DF7D08D897438167D2F83F4D52627BA05A046771AD579D0AF6EE28B42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uk_tmp.txt

Path C:\Users\Admin\AppData\Local\Temp\uk_tmp.txt
Size 1B
SHA256 2d711642b726b04401627ca9fbac32f5c8530fb1903cc4db02258717921a4881
MD5 9dd4e461268c8034f5c8564e155c67a6
SHA1 11f6ad8ec52a2984abaafd7c3b516503785c2072
SHA512 a4abd4448c49562d828115d13a1fccea927f52b4d5459297f8b43e42da89238bc13626e43dcb38ddb082488927ec904fb42057443983e88585179d50551afe62
MD5 SHA1 SHA512

Submit Download

hBeRqKUUTm.exe

Path C:\Users\Admin\AppData\Roaming\YGGnlMnga\hBeRqKUUTm.exe
Size 42.6MB
SHA256 0855861fc39342ca8009838782c39351be5da43e60809aa13322f11cd95d59ad
MD5 28827bb745df0e8f5ab4d809eba41ac0
SHA1 cfc0552b45b3f66969aa1eaffceb4c12e7636323
SHA512 6a907349ecfd72ab84c26e5ffc3ee8a57850c72f50f8c21557d2ca7db3b37f000968ebd4ac0f5bbb7fbbfec7bdd07880a0fbf07d96583fede26ca553b932aa66
SSDEEP 786432:W6q5OMGvRMbCubjuyCWwuMHIMtyOeZ4hYTpBrinrSER8e0TDGg8em:WjYMGvRM+YuyCWwuMHIMtyOeZ4hYTpBC
TLSH
T1BBA7AFF3B619C135F16D51B84D6457DB803D9C250BA121FBB2487BAA1A31ACB173AF83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hyBpXlX.exe

Path C:\Users\Admin\AppData\Roaming\YGGnlMnga\hyBpXlX.exe
Size 1.4MB
SHA256 c8db62bed2305b35860ba601c926f664da5c49cb58db6e364f0ed2805af511f0
MD5 7ee6219d0f497752aa7f1c129ca50bc1
SHA1 68bec1b6c594b6bdaf74b4062e4b3c477aa6a1ad
SHA512 a91760aeb550d5683ce0222f40addb3507b79ccf10199c6c5a4773d3b3fc0bcf874360202bfcdca0871da5efe94b94b24fecb72dd5ebeca02939928c5a534094
SSDEEP 24576:E9Yu8GgnSf7uw7J8qyKD0OIqKT//pIgl6A5H2TuDWkd3WZZ7SuW42C7Z32o3:zGMo7NSK/Iqwp/6A5Wgz501SuWYZ3V
TLSH
T1F965E05026A0C176C6E20732C565B375377D6D2C4F3046DB63A4B2DDBA7B1809A32AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ap.asin

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ap.asin
Size 260B
SHA256 e8b29a30cbb74f3d73e0815f2fd43f4c9c67fe658825b8269b56dcba3c77c363
MD5 fdf521b810372be57e20f42f5a5917f9
SHA1 9c96de6a467545de4a32e9f9e4671494c2316349
SHA512 c74f81f34acbbed2bb169f1c05a99b760793ccec6f9ec604bac962a46cc28abee893c0ead515295b6b71ff1cf12c39e0661d61665fcf664fae344acc1df2e745
TLSH
T19BD09526D334F773716E3E5C0C28507A1C10F7D2221746172C164961F331350D4C7168
MD5 SHA1 SHA512 TLSH

Submit Download

bnymir.ou

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bnymir.ou
Size 403KB
SHA256 311f644a8cc871e9fde0dbf9126189f11cf14534d8aadd824954595b56dbe5d8
MD5 665dc9cb1017f75370dead01c35e5342
SHA1 92be12e735b77849181d94779fec0efcf26342b5
SHA512 072bc616feb46a3f297671bbef8c2cf7a15416b95d3cacb2bc87ba0db6269d02c95d3dd6c51dd941398d367b4aca8a948e3f5e73f276d52ba150d8fff2c002e9
SSDEEP 12288:h47eobnoU0GOxiz2QQIl8yrjroV9ueRvu:G7hUT3xiz+uLrfoV9ueRvu
TLSH
T12494BF6A2C3FAE681ABC41A7F94C11577DF21FD8ABEDC132C24DCD1917D10899AB8193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bteuns.pt

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\bteuns.pt
Size 533KB
SHA256 c56bba6fd6236e30d9b5bb7ffea33079a143819fe1f08db346ff7b96acc9cf00
MD5 202faa607d44d8350d8d5ab435a8e81e
SHA1 244389e040acd9798f1960135b4b37e7711356fc
SHA512 31fe7f1baf7ab2964ca468a686a00e724f5466daf949df5173e4bf3ed575c3651447f990e72f2c0465c8762d258f1238f80ee6948f09bf6d979bee62b66757af
SSDEEP 12288:hU43LGMwhDLctEYGzqIx+Tsj/KKKKXE49ckVd:K43LXwm38VEEckVd
TLSH
T1FFC47D57193E7D0D26E05293B81C49D37DF223809AEDD031D39D9E6816C6A2EA9F12F3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cmrsk.ce

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\cmrsk.ce
Size 166KB
SHA256 32c1efcf15430df8e87207bde1916c807378edf6bd9552f02aeb6d50ac56f752
MD5 5b0756dc69ec9ed4b6dc5f4948d00c91
SHA1 e6938bbe27ba077f95b925c92c8c5e71875c76cb
SHA512 a16cfbbfec0311cded46376ca2d04bffbeb36c3f80e84ae2052671bf2bc6a8370d293a8df606b2f311914f90513cdbe393c99533284f5a6c4532b49b4bfb0c1d
SSDEEP 3072:hhIKRyikUOIya0rhMcnSfTSFqeSy4In48H0gFuHNJbmeqdyYV5gY:hh+ta09McS72+vI4dgOxigY
TLSH
T1D4F39EA7297D6FB839684183344C04975F651360AFEECD32C39ECF1409A66A726F817B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2c34.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\ev2c34.exe
Size 942KB
SHA256 bc1c0a2fc2b84a938fae034baf88c6cc43857b67b6814c5eb56824fa2835fd68
MD5 5af667ddc81dd731948caa2d64ebff6c
SHA1 327a0f7ce09a3f6b1574b27d8f69067895d691c4
SHA512 b367ec266fe7877f6e9343f9f7a1a4f3dd822543c544c44ba976f09dd827cb5c4febc358c663ab3363464e89e5df2f032d8f6e3e4c200c9264b930ecac4eebe5
SSDEEP 24576:FGp/QoLvjfJVdmHLfU9rKqeyV851Kmv6Gd0xnL8Sh:sp/QoLvlmHQdvVGv21gSh
TLSH
T10625E0227390D077D7E301324A4687A961BBAED159EF8E4377D43F8D8E3029D9A36B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fhkan.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2c34\fhkan.oi
Size 180KB
SHA256 4846e03250931965df77d4fb897fb3d100d451b72a7910a2840630195cfe1246
MD5 30806c3b99d158af70ad6448bfdd7716
SHA1 d557aac16144b0ff77759b7562aeef6c346ab110
SHA512 04e1e86c842870f02401cd42668095a81bb6c1b3e8c47bebf7d333453453a6ce65442339ff5ce1f51317b471c0f31e0afa7d877aaa861535273c8f944bd4aac9
SSDEEP 3072:Xhhg05n4/1J42BVXU9w9x32R68wJZzjz+Ifwaa65LjI2ccF6SarDEFzjqF3:Rhge4tJ4UEG9xZfIaaAjI29narDEY3
TLSH
T1B104BEA4434BEF34AD5E41E3B0611D9AA3E9308CF2DC6354AB9B8D2104D857F67F9293
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dxyvnb.ti

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\dxyvnb.ti
Size 56KB
SHA256 2ede6fc732c291281f5e51563a4239e38bc9cc57c42719836d51690edf46c525
MD5 02fd4fd8807ff36f506029f6d161c6ea
SHA1 725066f05fb2dcdb6d50b398beb5556ce817cf70
SHA512 71714a3696a1e4ddfa55fbadee60727efcf246a53c6ac2f2fc112e14d562f61b231dca120cc67bc665d510bee2d136df1937ba7c76da9dc7bebbb67c6ffc5ae8
SSDEEP 1536:+2xNv/qrXz0t8NADTop9ObO7BqTfHw+gPRRwZB1p04:+2xNSgt8N7wb4qT3gMNpB
TLSH
T19143CF440289AFA2F154C3737E59D98706D89F802FAA7537A3D8BD252C58F7B75F8022
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ev2f79.exe

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ev2f79.exe
Size 942KB
SHA256 7efd0f02d171b52f803c4793ee31070461f753387307d26d8ddc319fd129ef7d
MD5 6c4c052cfa3e24a05af2ddaa474685c9
SHA1 de88662a97db0c89c31aca744f3c89a57421c0fc
SHA512 a5577ed49d7a63e2b7eb2785c672c35c9856ff150e9baaf4a226c7797f030cd152d650aac8b9b4edfc62adeb0e3008b67208acbba0e56c9ae101f541f7701e4a
SSDEEP 24576:Fyp/LoLvjfJVdmHLfU9rKqeyV851Kmv6Gd0xnL8Sh:Ap/LoLvlmHQdvVGv21gSh
TLSH
T1A725E0227390D077D7E302324A4687A961BBAED159EF8E4377D43F8D8E3029D9A35B05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ntrin.er

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\ntrin.er
Size 168KB
SHA256 0250643af857245804b1836a240104cd8122c995d1e63f45c6ab6cb4d1065532
MD5 423ea290beb120f487d6831083dd1f87
SHA1 beec3f71d604ebbeef52bd03407b1fa52e68c2d9
SHA512 082915fe636a6bf88dee3eba9153b75542b049d82878b510cce7dd633b83b53cc8b81db513ed5a47f3d67b715f7e45c5c4182ffc14fcf36b89552e149721f553
SSDEEP 3072:kS4Cu9rV+QT6ZfRiflr3PQ1InKMzjVFPumXrA29hJ6QSxHPmbrF8vodrQOs+:keFRi7kIKMz7Bhs+
TLSH
T1BBF38DA32C6C9F78B9689183384C45930F641760AFEE9D33839ECF6505E65A762F412F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

otrm.oi

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\otrm.oi
Size 163KB
SHA256 23b5d84ad8a53b77dbda0960d8423e558bcac4ed3fd6221b60370fc94452495c
MD5 bdfa1e1ac89f99fdcfa761182d745bd0
SHA1 536c22b1e037456b55ca27bb9ac87a0f664e3de6
SHA512 579ca037a0ed37f052011300f812469ce49d5c7111340ff33a2c4717e9ebd324b2ff468552da99f7755a6a49bab7d913bc1c577b95474386cb5ebd92a97f979a
SSDEEP 3072:qtH9dODPB564nXjtFCH0gVqsxCua4DwJ47PreIV6V2Cpbnhdd:k9dOrBU4nqWua40J47zeIVYpLZ
TLSH
T1A4F3AD4C421AAE74ED6E81F3F9600AE593D53140F2DEA3967F2AED5104A423F52F8793
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yinma.vc

Path C:\Users\Admin\AppData\Roaming\comain_ev2f79\yinma.vc
Size 478KB
SHA256 cc734def371a00e17d744833b7a61f030051d0149712fba9d63bb7400271b12a
MD5 cb2c7240e7b48f49f0f140a0ab5fcc51
SHA1 5732767b46198f321d73fb4a9395fb44de3803b3
SHA512 476651d071cdad81fc10ed4d23857b47cccb0a7d686fe94e8deee220d78d81d02532291f8c044c4965cec5d90734cfe9bfd35da61f961e316fec70d0a4d37b81
SSDEEP 12288:HCsJxcMXlPRu2/Awl6kdd2a+Ih9CTnRdzpo8:HCsJSMlJu2/Awl6kddf+ysRdzpo8
TLSH
T100A40919149AAF398180484F7A1DD121A977DB48D22FE23198A9EC1A7DE4F21DFFC1C7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI8EBA.tmp

Path C:\Windows\Installer\MSI8EBA.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA1F7.tmp

Path C:\Windows\Installer\MSIA1F7.tmp
Size 113KB
SHA256 cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36
MD5 8fa4088a730b967d85df562fd5ef7d5e
SHA1 629db9229f4a4a691e14f38f4dbffba157fa1ce9
SHA512 1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2
SSDEEP 1536:xS8CWyksWMcdMWBpjr+UsgtFmVrrXL1MgbIurgnIMolaeB8DhIm+uBSw:xS8SgMq+jVrrb1MMBBMolzaDhI31w
TLSH
T19AB39D41BA908432D5FF2D3C1578DA621E3E79701FE09DAF175851B90EB43D0AB38E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5877ac.msi

Path C:\Windows\Installer\e5877ac.msi
Size 22.1MB
SHA256 f36047d7ce108d834458cb5c21c26238f52883b8c56d7bfa7760cbd3bab7c4bf
MD5 b848c1d883bc210453286fc3d967e745
SHA1 79a18e6d14db69a56f87708c3d14cb3baa83ee98
SHA512 b4f1e624fe65815d21925f6dd8fe6742e5e3fc6f5efb97d6470ca530e7901dd663c3ee13b4236c55db38777c953b602d9beacda450a77c6157524b65ca08f046
SSDEEP 393216:/A4EQoVqkO+fFgTOfPPNiv1P8z1FhO350N+54Ktq6UWP3knuptZgNFRdu/vqIWB3:qPO+fFgTOf3Nih83wp0N+KqMuptW/du6
TLSH
T19C37333E2A889325ED83DBFBD8F4C42CC4D733435D161067E99EDC6992E2A089DE591C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1652333974\manifest.json
Size 102B
SHA256 932322ae700a7d7606efb182239db5fd9550dd6cb5860e0a17bfb6fe3bcb5f35
MD5 19322c8a94f1ac01a70f8c58cdbbc720
SHA1 7c90dac178c47dac9087dfce738f24a4a627f022
SHA512 f54a9cab8dbe96333862a67912e88c4f26cc3e25a7dc93e8f06d1fb5b0b8e91d53cc0f5619c192380573a2846034ee583276d7eda73dc9fc93bb0d9168f4e099
TLSH
T156B01221EC10B4B32004036C086CC3C063272F032C4079280DE19F84E90D9DBE471528
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1788986642\manifest.json
Size 113B
SHA256 98821f71a1973ac61b45967ce0c121eb598ac6e95abaa23c912d2f33e4237d8c
MD5 7ef3c71464d0fef472bc1d81fd363c62
SHA1 230e8ec0f849bf34d444c55ef548ba0c9c94d39b
SHA512 f74b96ec3b9569e360a02bfdd4fe237efad8ee2a5deaf46db891bcadd39dba22fd6d59a4e9aafe5511152625ce9f468519dadd53fc0c9b6c8826dc58cbe6cd7c
TLSH
T1C8B09262DC80D872693A93AC0E2246C4F228234B2558AA493630048C0A3A3F082A2321
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_1857080952\manifest.json
Size 1001B
SHA256 25ac9b79df29fa869b4c9f4ca3bdbc3a85f6122f5a8efab5a1216d577099becc
MD5 580786a5ec9eb650dde3e0e75db8588a
SHA1 8c0835d1a6bf82e753b624440e9674d649696ead
SHA512 c8d41e16b291157e2afbf978469eae4c017d1ce3b941b93ae710e2bbaaf4c3e601db45e579d22b957b7a1ec48cba788015725a2fa23cf02f2d66010ef4fdd0a0
TLSH
T100115B10DD388D9326E4BAA21CC6580957661DAF4CC23F98379E161D8F1C8AFA37366C
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_6225131\manifest.json
Size 69B
SHA256 c0622dadf4ec10ce5f4a64e3f24956b750345dcc194d0bd3ff73cfce1bf6081e
MD5 fb0d9796a86299d3689982f7a949dc6e
SHA1 6179cd612ac0dcc44d0659c7c99d1e0aecbf206e
SHA512 e3e1a18be661da9d450a30a37d24dc08dc8de628a104ce0f4197214ce6f27a2bf9de3eca1c1697fcfa3c601787ca7a6b5e30a5fe3d6ae3b2c10f1ab34af22fd0
TLSH
T141A022200C2088FFF200E3CC0020E380CF28A300A2088C0A022220002280CB80200320
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.fingerprint

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_664745653\manifest.fingerprint
Size 66B
SHA256 c236a2ac7741d48e1c56980652331cb3f1f12baf937baf0b280600fbafb143e3
MD5 c28ffa45708f10e3a35143ed2708782f
SHA1 84a03f2615333c9311dbf79d6f58f56b5c009163
SHA512 beac0eacff45a152eb2a50f4d72db2933b8f8ba97e6f0a9f6811abe866fef5c7c83068151915dbdffaccaee5d0cd335d182671f44dbab6da2222266ff8a28ff0
TLSH
T169A022F3F000F02030022F8A80203C00C8A23BA80C8020808000BEE0200322A3A0C820
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5040_664745653\manifest.json
Size 135B
SHA256 ba5c9096d20a482aaa1aa9e5f98ad6127d3e97c2f21de84f7c78d9b8073c8e26
MD5 fbebd68ecaa98928909421f66909c054
SHA1 99d787d90f7ed2e5ad924f9c5668eb988b5a6c07
SHA512 749a3b2be47fe28399dc763888654a3e8d397e06e8d3c3af3965bb45846a1336e6ab4ca82c82c3df846b34a2afafa2156f2690e9bf347ab175408dc0171c61cc
TLSH
T158C04C668D51DEAB00A747A56B295315E23B4B4B5044800A7AF5429C1A288964171944
MD5 SHA1 SHA512 TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 c8f65695870643fb4c95acd2392aa68821567a9c1fed6cd6a2ab912d5fcb6d71
MD5 7649f11814d034d62b4c2790ff09161a
SHA1 0160bd7c8c2d43612494ca1147e2d1a031b3f685
SHA512 f984dd323e4f83e4716611d606d01d3d86b42c7d5d5b45cf3f91cbb2cacfc6453b55a8411c7ed1c565b01009603eba0a5d2aa95a1c62115d21f4f4a88f34078f
SSDEEP 24576:W2gmSp1cdoO/vvTLtmmeBkH6fapdwoi82GVtHZUGvNqYUqCDY93B7r8Rh:X
TLSH
T1DF47C12836F92250E7F79E3C68F06A234E3A7D5B9C159A8D05451B4E0D21FB0E872F5B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{ba5192ef-f072-4beb-9451-3a1e4430c207}_OnDiskSnapshotProp

Path \??\Volume{a6d9cdad-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{ba5192ef-f072-4beb-9451-3a1e4430c207}_OnDiskSnapshotProp
Size 6KB
SHA256 3ec5be6d731ce86d349e5929330676a6bc69b95f81b0be62d0e406c849af9b43
MD5 9758452d67a12ab0e578e7e5aed223e2
SHA1 53fe18d8be6fe6ded0648de813de3b765c9613c9
SHA512 ec1356aa763cd867e243a1605a032cb42aa1c251a96d2aef8ced31964448ae94517bbc81095f44dd3760eef500af138042f9e43f0f108e748c542ee354c2076c
SSDEEP 96:FQxo3hOVsvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:zMV2b++ZVmN
TLSH
T18AD188085AF54711E2B3AB7129F14557A877B911EF33CB8E0198238E6670A10F935F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/948-44-0x0000000000E60000-0x0000000000EC4000-memory.dmp

Download

memory/1176-259-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/1176-266-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/1176-624-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/1176-268-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/1176-267-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/1176-265-0x0000000010000000-0x0000000010031000-memory.dmp

Download

memory/1264-82-0x0000000007940000-0x00000000079E4000-memory.dmp

Download

memory/1264-74-0x000000006CA70000-0x000000006CABC000-memory.dmp

Download

memory/1264-85-0x0000000007CF0000-0x0000000007CFA000-memory.dmp

Download

memory/1264-48-0x00000000054F0000-0x0000000005526000-memory.dmp

Download

memory/1264-50-0x0000000005C80000-0x00000000062AA000-memory.dmp

Download

memory/1264-53-0x0000000006320000-0x0000000006386000-memory.dmp

Download

memory/1264-52-0x0000000005BF0000-0x0000000005C12000-memory.dmp

Download

memory/1264-62-0x0000000006400000-0x0000000006757000-memory.dmp

Download

memory/1264-65-0x0000000006920000-0x000000000693E000-memory.dmp

Download

memory/1264-66-0x00000000069D0000-0x0000000006A1C000-memory.dmp

Download

memory/1264-73-0x00000000078E0000-0x0000000007914000-memory.dmp

Download

memory/1264-83-0x00000000082C0000-0x000000000893A000-memory.dmp

Download

memory/1264-81-0x0000000007920000-0x000000000793E000-memory.dmp

Download

memory/1264-84-0x0000000007C80000-0x0000000007C9A000-memory.dmp

Download

memory/1264-94-0x00000000062B0000-0x0000000006314000-memory.dmp

Download

memory/1264-95-0x0000000006770000-0x0000000006788000-memory.dmp

Download

memory/1264-91-0x0000000007FC0000-0x0000000007FC8000-memory.dmp

Download

memory/1264-90-0x0000000007FE0000-0x0000000007FFA000-memory.dmp

Download

memory/1264-89-0x0000000007EE0000-0x0000000007EF5000-memory.dmp

Download

memory/1264-88-0x0000000007ED0000-0x0000000007EDE000-memory.dmp

Download

memory/1264-87-0x0000000007E90000-0x0000000007EA1000-memory.dmp

Download

memory/1264-86-0x0000000007F20000-0x0000000007FB6000-memory.dmp

Download

memory/1748-1521-0x000001D81C5E0000-0x000001D81C68F000-memory.dmp

Download

memory/2344-190-0x000001D900D10000-0x000001D900D1C000-memory.dmp

Download

memory/2344-200-0x000001D97F650000-0x000001D97F65A000-memory.dmp

Download

memory/2344-161-0x0000000180000000-0x000000018007D000-memory.dmp

Download

memory/2344-179-0x000001D900DC0000-0x000001D900DCC000-memory.dmp

Download

memory/2344-5-0x000001D97F030000-0x000001D97F0DF000-memory.dmp

Download

memory/2344-1802-0x000001D97F030000-0x000001D97F0DF000-memory.dmp

Download

memory/2344-1803-0x000001D900D10000-0x000001D900D1C000-memory.dmp

Download

memory/2344-191-0x000001D97F700000-0x000001D97F722000-memory.dmp

Download

memory/2344-198-0x000001D919850000-0x000001D91986C000-memory.dmp

Download

memory/2344-199-0x000001D919870000-0x000001D919923000-memory.dmp

Download

memory/2344-201-0x000001D97F730000-0x000001D97F74C000-memory.dmp

Download

memory/2392-589-0x000001FA471C0000-0x000001FA4726F000-memory.dmp

Download

memory/2392-610-0x0000000180000000-0x000000018008C000-memory.dmp

Download

memory/2740-1458-0x0000022AB5A00000-0x0000022AB5AAF000-memory.dmp

Download

memory/2824-98-0x000001BD7CA50000-0x000001BD7CAFF000-memory.dmp

Download

memory/4012-636-0x00000228D8E90000-0x00000228D8F60000-memory.dmp

Download

memory/4012-588-0x00000228D8940000-0x00000228D89EF000-memory.dmp

Download

memory/4012-630-0x00000228D8E90000-0x00000228D8F60000-memory.dmp

Download

memory/4012-634-0x00000228D8E90000-0x00000228D8F60000-memory.dmp

Download

memory/4012-635-0x00000228D8E90000-0x00000228D8F60000-memory.dmp

Download

memory/4012-632-0x00000228D8E90000-0x00000228D8F60000-memory.dmp

Download

memory/4012-633-0x00000228D8E90000-0x00000228D8F60000-memory.dmp

Download

memory/4012-631-0x00000228D8E90000-0x00000228D8F60000-memory.dmp

Download

memory/4012-595-0x0000000180000000-0x000000018006B000-memory.dmp

Download

memory/4012-638-0x00000228D7080000-0x00000228D708C000-memory.dmp

Download

memory/4076-4-0x000001CEE2310000-0x000001CEE23BF000-memory.dmp

Download

memory/4188-1328-0x0000027A42A00000-0x0000027A42AAF000-memory.dmp

Download

memory/4204-1245-0x000001E267420000-0x000001E2674CF000-memory.dmp

Download

memory/4376-148-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/4376-181-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/4376-155-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/4376-156-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/4376-157-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/4376-154-0x0000000010000000-0x000000001002D000-memory.dmp

Download

memory/4692-850-0x00007FF928580000-0x00007FF928581000-memory.dmp

Download

memory/4692-1522-0x000001862D8D0000-0x000001862DC48000-memory.dmp

Download

memory/4740-1456-0x000001C28EED0000-0x000001C28F248000-memory.dmp

Download

memory/4740-1457-0x000001C294800000-0x000001C2948AF000-memory.dmp

Download

memory/4740-749-0x00007FF928580000-0x00007FF928581000-memory.dmp

Download

memory/4752-675-0x0000000004EE0000-0x0000000004EF8000-memory.dmp

Download

memory/4752-102-0x00000000055D0000-0x00000000055E5000-memory.dmp

Download

memory/4752-676-0x0000000005580000-0x000000000559E000-memory.dmp

Download

memory/4752-36-0x0000000000220000-0x000000000049A000-memory.dmp

Download

memory/4752-41-0x0000000004D60000-0x0000000004D6A000-memory.dmp

Download

memory/4752-42-0x0000000004E30000-0x0000000004E4E000-memory.dmp

Download

memory/4752-587-0x0000000005950000-0x00000000059B4000-memory.dmp

Download

memory/4752-51-0x0000000005620000-0x0000000005686000-memory.dmp

Download

memory/4752-680-0x000000000BF00000-0x000000000BF12000-memory.dmp

Download

memory/4752-679-0x0000000005950000-0x00000000059B4000-memory.dmp

Download

memory/4752-63-0x0000000005CD0000-0x00000000061FC000-memory.dmp

Download

memory/4752-678-0x00000000055D0000-0x00000000055E5000-memory.dmp

Download

memory/4752-677-0x00000000055B0000-0x00000000055C1000-memory.dmp

Download

memory/4752-101-0x00000000055B0000-0x00000000055C1000-memory.dmp

Download

memory/4752-100-0x0000000005580000-0x000000000559E000-memory.dmp

Download

memory/4752-68-0x0000000006E20000-0x0000000006E46000-memory.dmp

Download

memory/4752-103-0x0000000005950000-0x00000000059B4000-memory.dmp

Download

memory/4752-99-0x0000000004EE0000-0x0000000004EF8000-memory.dmp

Download

memory/4752-71-0x000000000B2B0000-0x000000000B2E8000-memory.dmp

Download

memory/4752-72-0x000000000B290000-0x000000000B29E000-memory.dmp

Download

memory/4808-965-0x0000027E58A60000-0x0000027E58B0F000-memory.dmp

Download

memory/4816-3-0x000001A621D60000-0x000001A621E0F000-memory.dmp

Download

memory/4816-31-0x000001A621D60000-0x000001A621E0F000-memory.dmp

Download

memory/5040-1455-0x0000021799010000-0x00000217990BF000-memory.dmp

Download

memory/5264-1516-0x0000000002AD0000-0x0000000002AE4000-memory.dmp

Download

memory/5264-1474-0x0000000004E80000-0x0000000004E8A000-memory.dmp

Download

memory/5264-1489-0x0000000004EC0000-0x0000000004ED2000-memory.dmp

Download

memory/5264-1490-0x0000000004F20000-0x0000000004F5C000-memory.dmp

Download

memory/5936-1808-0x00000218D8140000-0x00000218D8141000-memory.dmp

Download

memory/5936-1810-0x00000218D8140000-0x00000218D8141000-memory.dmp

Download

memory/5936-1809-0x00000218D8140000-0x00000218D8141000-memory.dmp

Download

memory/5936-1814-0x00000218D8140000-0x00000218D8141000-memory.dmp

Download