045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818.msi
Size 1.5MB
Sample260522-e9588aht5s
SHA256 045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818
MD5 3ff61a00c1a6be20f14f6d126913a609
SHA1 071dcaba6e221a35f70406071405669f228cbadc
SHA512 99ed16f3ea6ac934b64826c9ddce0f36caf599f852b6231dd361415c20850f9a0fcd88919a59d0438e659ae23f552dba4df6776dfe253bb9307c39ff22975092
SSDEEP 24576:MXi7m6PYnzOlHAGkG1D1xGcbpmByP+yXNpHQ1Dx/cGGJg/3pHJcBm0OUnWKUJJE:MS7rSilHAgjxRGyXqTegPp6m0vn/UJJ
TLSH
T1006533FF75112810D182033890D3D1FA3A78DF995FA249C6C25BF7A82E36BD1C5467AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
4496	n6NqqYiFJocG.exe
4644	Microsoft Teams Revo Helper ZnrAq.exe
3988	Update.exe

Loads dropped DLL 10 IoCs

pid	Process
4644	Microsoft Teams Revo Helper ZnrAq.exe
4644	Microsoft Teams Revo Helper ZnrAq.exe
4644	Microsoft Teams Revo Helper ZnrAq.exe
4644	Microsoft Teams Revo Helper ZnrAq.exe
3984	MsiExec.exe
3984	MsiExec.exe
3984	MsiExec.exe
3984	MsiExec.exe
3984	MsiExec.exe
3984	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Revo Health = "C:\\Users\\Admin\\Pictures\\FPKmXNI8Vo0b\\Microsoft Teams Revo Helper ZnrAq.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Badlisted process makes network request 7 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
5	1608	msiexec.exe
21	1608	msiexec.exe
33	1608	msiexec.exe
35	1608	msiexec.exe
38	1608	msiexec.exe
53	2144	msiexec.exe
55	2144	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\e5883f2.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE6C1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e5883f3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID990.tmp	msiexec.exe
File created	C:\Windows\Installer\e5883f7.msi	msiexec.exe
File created	C:\Windows\Installer\e5883f0.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5883f3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID5B6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSID6B1.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5883f0.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{638CCC7B-F2A1-4592-856D-8EECFD59996F}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF08.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE327.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1608	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n6NqqYiFJocG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000020c8f0fe5d92f37a0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff00000000270101000008000020c8f0fe0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff00000000070001000068090020c8f0fe000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a20c8f0fe000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d20c8f0fe000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238984791605528"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\SourceList\PackageName = "045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818.msi"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\ProductName = "FPKmXNI8Vo0b"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\Version = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TeamsAddin.Connect\CurVer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\Language = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Runtime = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID\ = "{EABAE40C-B27C-455A-B672-F234DD780948}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TeamsAddin.Connect.1\CLSID\ = "{CB965DF1-B8EA-49C7-BDAD-5457FDC1BF92}"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\SourceList\Media	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A28B8577D4F7BDE5B9DA033EF8800996	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7CCC8361A2F295458D6E8CEDF9599F6	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\SourceList	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TeamsAddin.FastConnect\CurVer\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TeamsAddin.Connect\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Codebase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\TeamsAddin.Connect.1	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A28B8577D4F7BDE5B9DA033EF8800996\B7CCC8361A2F295458D6E8CEDF9599F6	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\msteams\shell\open	ms-teams.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2144	msiexec.exe
2144	msiexec.exe
5048	ms-teams.exe
5048	ms-teams.exe
5048	ms-teams.exe
5048	ms-teams.exe
2144	msiexec.exe
2144	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2032	msedgewebview2.exe
2032	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1608	msiexec.exe
Token: SeSecurityPrivilege	2144	msiexec.exe
Token: SeCreateTokenPrivilege	1608	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1608	msiexec.exe
Token: SeLockMemoryPrivilege	1608	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1608	msiexec.exe
Token: SeMachineAccountPrivilege	1608	msiexec.exe
Token: SeTcbPrivilege	1608	msiexec.exe
Token: SeSecurityPrivilege	1608	msiexec.exe
Token: SeTakeOwnershipPrivilege	1608	msiexec.exe
Token: SeLoadDriverPrivilege	1608	msiexec.exe
Token: SeSystemProfilePrivilege	1608	msiexec.exe
Token: SeSystemtimePrivilege	1608	msiexec.exe
Token: SeProfSingleProcessPrivilege	1608	msiexec.exe
Token: SeIncBasePriorityPrivilege	1608	msiexec.exe
Token: SeCreatePagefilePrivilege	1608	msiexec.exe
Token: SeCreatePermanentPrivilege	1608	msiexec.exe
Token: SeBackupPrivilege	1608	msiexec.exe
Token: SeRestorePrivilege	1608	msiexec.exe
Token: SeShutdownPrivilege	1608	msiexec.exe
Token: SeDebugPrivilege	1608	msiexec.exe
Token: SeAuditPrivilege	1608	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1608	msiexec.exe
Token: SeChangeNotifyPrivilege	1608	msiexec.exe
Token: SeRemoteShutdownPrivilege	1608	msiexec.exe
Token: SeUndockPrivilege	1608	msiexec.exe
Token: SeSyncAgentPrivilege	1608	msiexec.exe
Token: SeEnableDelegationPrivilege	1608	msiexec.exe
Token: SeManageVolumePrivilege	1608	msiexec.exe
Token: SeImpersonatePrivilege	1608	msiexec.exe
Token: SeCreateGlobalPrivilege	1608	msiexec.exe
Token: SeBackupPrivilege	5840	vssvc.exe
Token: SeRestorePrivilege	5840	vssvc.exe
Token: SeAuditPrivilege	5840	vssvc.exe
Token: SeBackupPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeBackupPrivilege	4244	srtasks.exe
Token: SeRestorePrivilege	4244	srtasks.exe
Token: SeSecurityPrivilege	4244	srtasks.exe
Token: SeTakeOwnershipPrivilege	4244	srtasks.exe
Token: SeBackupPrivilege	4244	srtasks.exe
Token: SeRestorePrivilege	4244	srtasks.exe
Token: SeSecurityPrivilege	4244	srtasks.exe
Token: SeTakeOwnershipPrivilege	4244	srtasks.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
1608	msiexec.exe
1608	msiexec.exe
3988	Update.exe
5048	ms-teams.exe
5048	ms-teams.exe
5048	ms-teams.exe
5048	ms-teams.exe
5048	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5048	ms-teams.exe
5048	ms-teams.exe
5048	ms-teams.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 4244	2144	msiexec.exe	104
PID 2144 wrote to memory of 4108	2144	msiexec.exe	107
PID 4108 wrote to memory of 4496	4108	cmd.exe	109
PID 4108 wrote to memory of 1228	4108	cmd.exe	110
PID 4108 wrote to memory of 4644	4108	cmd.exe	111
PID 4496 wrote to memory of 3988	4496	n6NqqYiFJocG.exe	113
PID 5048 wrote to memory of 2032	5048	ms-teams.exe	123
PID 2032 wrote to memory of 5396	2032	msedgewebview2.exe	124
PID 2032 wrote to memory of 1120	2032	msedgewebview2.exe	127
PID 2032 wrote to memory of 1120	2032	msedgewebview2.exe	127
PID 2032 wrote to memory of 1120	2032	msedgewebview2.exe	127
PID 2032 wrote to memory of 3956	2032	msedgewebview2.exe	128
PID 2032 wrote to memory of 5380	2032	msedgewebview2.exe	129
PID 2032 wrote to memory of 5380	2032	msedgewebview2.exe	129
PID 2032 wrote to memory of 5632	2032	msedgewebview2.exe	130
PID 2032 wrote to memory of 5632	2032	msedgewebview2.exe	130
PID 2032 wrote to memory of 5632	2032	msedgewebview2.exe	130
PID 2032 wrote to memory of 6124	2032	msedgewebview2.exe	131
PID 2032 wrote to memory of 6124	2032	msedgewebview2.exe	131
PID 2032 wrote to memory of 6124	2032	msedgewebview2.exe	131
PID 2144 wrote to memory of 3984	2144	msiexec.exe	137

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:1608

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4244
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe" & reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Revo Health" /t REG_SZ /d "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe" & start "" "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4108
- - C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe
    "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4496
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=n6NqqYiFJocG.exe --bootstrapperMode
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3988
    - - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.7.15&instExecTime=1779424869158&launchSrc=t2installer
        5⤵
        Adds Run key to start application
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5048
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=5048.1248.6274093495252365310
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:2032
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x158,0x15c,0x160,0x134,0x168,0x7ffb2e94b078,0x7ffb2e94b084,0x7ffb2e94b090
        7⤵
        
        PID:5396
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1756,i,8461252507812601495,11781793064010529523,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1748 /prefetch:2
        7⤵
        
        PID:1120
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=1388,i,8461252507812601495,11781793064010529523,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2080 /prefetch:3
        7⤵
        
        PID:3956
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2420,i,8461252507812601495,11781793064010529523,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2432 /prefetch:8
        7⤵
        
        PID:5380
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3824,i,8461252507812601495,11781793064010529523,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3864 /prefetch:1
        7⤵
        
        PID:5632
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3960,i,8461252507812601495,11781793064010529523,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
        7⤵
        
        PID:6124
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 7e07abe8-ef48-4cbc-8854-e09a7506c969 -Trigger EnsureTmaAtStartup
        6⤵
        Checks processor information in registry
        
        PID:3860
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID 7e07abe8-ef48-4cbc-8854-e09a7506c969 -Trigger SchedulerDirectLaunch -BgTaskDelay 2115
        6⤵
        Checks processor information in registry
        
        PID:5036
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Revo Health" /t REG_SZ /d "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe"
    3⤵
    - Adds Run key to start application
    PID:1228
- - C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe
    "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:4644
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 2D057CE750811AAC495B27EA5B376719
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3984

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5840

C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:5468

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5883f1.rbs

Path C:\Config.Msi\e5883f1.rbs
Size 8KB
SHA256 d6cb38a77db595edde45b14c8f41a0fc93af168050586a4c9d7b7afa74498f61
MD5 780003b3f38deb6ec3368a4d2df31342
SHA1 7d54e7e5c98d070c37ca3d089d211f41d3b940b6
SHA512 d1de174d2e00fd493bd17bf105c12e151ccf3ae556e8d69d001fa03fdefdff8036d52817f7034970b4259dd6a3777ef3c5efe3ee7ad0b18383818345cd391a6d
SSDEEP 96:nQVKRfpdD6y5oqeiil5UyoO84COThqzdUyoO84CgjTcAyThqzkH3hr59ZJWK7MTo:ni8ebytPGvtPBnPXVpa4
TLSH
T151021E017606C5E3E8E20775C72317683BA3E6F96B06634B4AAD80345F0738D5F99B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5883f6.rbs

Path C:\Config.Msi\e5883f6.rbs
Size 357KB
SHA256 de627907ec36b2c2aeaa0d26db1d5c0f3885f5b0f7abc24394a7a66024f50d8f
MD5 c8166e6b8f2d89bfdba816088e9b502c
SHA1 6ff04ac3d4a4c337e272a915e404474816ab51fc
SHA512 4ef460e1ba47dad449ff708b825b7a54367cb0b50ea7a1e524ed87837bbc4e3c199f02e17826375875c6bbf815dbd95544cf90fa2c00dd11639febb048a92631
SSDEEP 3072:Ge0zxXjS8SgMq+jVrrb1MMBBMolzaDhI31JS8SgMq+jVrrb1MMBBMolzaDhI315l:Ge0zJpkp11exmpkp11exC
TLSH
T17E746E12AB41DDB6D878753602717B9E703DF6630AC0BE6F8B00D6684F5A7D8E718E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 2KB
SHA256 97885d672298877be305adf7f7839ec602ba77e78531ad973f3e121c63cccf3b
MD5 a7d3fb6923fcb6b2ca39abe4cec5d092
SHA1 0a7c2a2c4c9f59764d4e460acfdb85420adb21e2
SHA512 b4a7c9b528a88042f45d3e60cb6e81a8e50a0e11e161fd894cad2c29a5a07c13a0e79e71d0f19ce7b78e52b024a660b5c4f3b2b5e7ac2813ed115917f8632f23
TLSH
T15A4162EE751C6982D1E0A930C9DBAFC7DEF021E5B3D0F35F15244F840029B82CA96682
MD5 SHA1 SHA512 TLSH

Submit Download

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 290B
SHA256 f5acf31bd69d598503e44784fc8599612b489a495f3241ffee4f598fe0d86a41
MD5 357ea0ac15b063bafd36f381577fab96
SHA1 b5e97f10bba9e856be8a4213f5bf952b9b00f94d
SHA512 6c3b441d64dd4624cd605b2b7904baa5dd300427507febebca10616a792603a9dd19883d8f69b1377a3f3572a1f28213f153cc4edf3db8e5458219974bc55585
TLSH
T156D05E2D93F40221E050C67EA9E81553FA75BA198115834406F0D34C7464E16F931723
MD5 SHA1 SHA512 TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\AddinInstaller.dll
Size 35KB
SHA256 c0306045119da6aa284f77f5ae57e9a35ae473294ef6b983db909902ef860b65
MD5 077c50b05317268a4e84b0d8e18b7e25
SHA1 4e4320e74fb1d2ca46e38b7a5554547f8c0ea57f
SHA512 e61171028a7faef3e4545ddc1a6a0e9a0ba618c20db82d4cb32eae379710497b30fee3f165400ed93c2760e04c102889686a14d7f996b3664026c881e93024ed
SSDEEP 768:CJLtIDER3wlQ0Tkjb6PO59zeTzlU+9zZU:myARglQ7jQ4zeTm6zW
TLSH
T1E0F21891A7F84102FAFB6F706AB4E5422DB9BF875C70D92D1989E14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a50487ef016e1ce77b3875402e952e331c9e410a.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a50487ef016e1ce77b3875402e952e331c9e410a.tbres
Size 2KB
SHA256 63fb32fe5b1929f56d78094e31b3d541308de5da8f3988f31309fa60cf03749e
MD5 f82f30fe789d47df70fe46fb889f2b6a
SHA1 35fefff1fccac5ed0200df7fc782d88db4a991b5
SHA512 ddf8c94912b0489c87e769276f908c415be2a5d2b98dbb583ad45d30f2772e150f7e46044b9bf29d5cacc182b7c62723f9ddd9e5426bed5bf0052d2adfb36c4d
TLSH
T170412768AAE9114CB3777E169BF6A86D487BBD372E06D49E00110D4F0963B04C9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

a7e624d3a800058467350735a3c9b4df6502fd79.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a7e624d3a800058467350735a3c9b4df6502fd79.tbres
Size 2KB
SHA256 bb0a371f2623a4cdb446fd444010cc57fb5650b40003ebd80ab1cbba6b133168
MD5 9286d45a074a23238f59d91a1c37dd82
SHA1 769edbc8329839372dd27f6065b7da5b6a570850
SHA512 d377a49124327670880b1e43dc24ff013f4f237f4705c00745037922351628c3144171b6bcbe25c0e5f3b57867914bd8e920185534de652dbd9b16abbf319f7b
TLSH
T1B1412B5CB6E91148B3B36E5AABF668AE487EBD372E06D49D10510E4F0A72E00DC61737
MD5 SHA1 SHA512 TLSH

Submit Download

baeae54df3400d002e036f586e0c785624c9121a.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\baeae54df3400d002e036f586e0c785624c9121a.tbres
Size 2KB
SHA256 2d6f16f43ca1790a18c74a78f0c62abe44927e764856b7f70da01e5a0401ae89
MD5 93a2b8ce7d420cf4ca7331486b91e5db
SHA1 3bcddd8a0e8f9dd2f6882d13e101e543b6529bbb
SHA512 582b7b18ac7863cf7914fa4f6accd776ac722b925be3d7828ed506bd6276b8005968cef49b5228edac365eac68aabe1d57705969ae2e37805ded12355f20690e
TLSH
T14A514A586AEE0149B3B76F5A9BF6786E487ABD372A06D05D00110E4F4623A01D971B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 22c95740318ab7af108602e3b405d4b066553bc1cbc057282a049a76538e3be8
MD5 ab766a61ecac41b5f960ba313e941337
SHA1 c292c8d19a5b9a3e995267b2824185f1a9b291ee
SHA512 9c12d1d80eb4f46c9d876738750b436412a5a55fd1fea1938bbc8b33e1df846a75c9555103114d10724f7a4c7f47078d99ff9c93782ee774652eeb14ea7210d7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 96d4971b21320dce50468a9c3d32fc07848c531086548c9d44fd2fec50c3b3b3
MD5 8c1cfec0a4bbf50e09b69402a15d94ec
SHA1 5b1eadf3418cefc6bf76818f019ecf8449c20545
SHA512 8eaeb6fcbbec37cb2a3b50c774f7cb2c16d264c2bdb6b2434f56ed0182d801f56ff8130cbbb58b4a14a3e223586ba135c0317976d49b16452ab4eb57b60ffec3
TLSH
T133D012137601C53CC02030330002A20D1800D20B41064143942E891D6B1505009134C1
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Rules\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 1KB
SHA256 46154b18f9b84028142599ee7ca292693936d5b679ef268951682b033bcf820f
MD5 ff808e80aae820c8933a1ae06f40014c
SHA1 e23290743cca2d4ae85980021338fb8075eaa243
SHA512 5aa3436b349804cd5228606eba540a2904bcd78b3b4c0e257dc2488a9c4d0aad9ebf7887a955cac5692d9c6d04d076eaec506f811b91f6afebe0c0514d1ba114
TLSH
T1AD318573F4A01FF65CC1A19271527E2B3E60506BD2516E4865CD0F1D41EB1CCAA36D36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 ee13817b85ad73bff72f9643673c6129320f91e45b1071bb9b041c6f35818ccf
MD5 d691dd320c3dabaf371e40ad87f0b575
SHA1 8e26d4af583594d6b5822d1ccb9f9e74e9825986
SHA512 cbb5d5decd2105dec4eba5b83949e63ca0e9b13b92b75ac48946722ebe2c7a9296cc3a940690b09be0ad702d01bac65da35b2912b0ab8b8575a91f807ee5f50a
TLSH
T19F519673B8149BBB8DE2895479453F226E3590669A913F5499DD0F0C01DB19C3712C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 cba8a358620c596c610ce5aff1a04ed8802dd46848b946fd6c3e0a1841b2725e
MD5 a70115e96684d1973ee60fa5c302581f
SHA1 dbc89aacabf99167cff5ef2a320c7a44f833aab3
SHA512 053eae9724d18b6bf7f3482110d6a8e5d6dbbb14fcdc7d3b6d3b29e5fffd8c1c0c333bb3443f05f53c079ddbb7110612b0e14686f54513631ee5f923602b9104
TLSH
T10371B637B8649A7B4DE29940B8813F167BA59027E5D53F98D9EC0F0D01DB2C82312C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 7357901935cb4a98333ec19c59915e64e2b0039847208334433e95e449396024
MD5 499894c9ddffcf040b60a103b885f5be
SHA1 b587a24729b1c7f21618110afa2076efac9a796f
SHA512 8942ab1a63d96c8f60c145eb9b11eac4b2cbc9182d8e44355cf7d55af2e754bc4e6fbd7f2ec353a5353972dbb8666bcbd048f3c7ee0d205d82e8a5295651ce59
SSDEEP 384:zEvsrvyOiyp4+IWA1eUVWGfvvLhNbA3UKyP/I/Ew42:o0raxyp4sQe6WGfvvPQ/EE
TLSH
T19F729E7616346A7B8CE6EC4ABC8A2E167FD58527D9C02F9CE4E05F0F011B2CC274691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5994a5.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe5994a5.TMP
Size 1KB
SHA256 090fdd12d46e17b36192390520e78d4340440a5731a433f5749c38f30d2123fd
MD5 ef42e47b008d7287477de85d7a05931e
SHA1 5e145c826c84cadf7f5485cdb0c8dc42a468c31e
SHA512 dd5ff4c718b3e2c62b3409471307a05392f673155f461273937d68ff30428c807235e7522dce0a1203c903c1437b1e3b8159b0724a14d70fb2574762c7f046cb
TLSH
T176216533E4945EF55C8154A1B1527F1A3E50906AD2546E08A4CD0B1D42DB0DCAB37C37
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 7767fc357be2037f911ec10d82d0a11f5afea58bfcf58fe4908493f7b7944452
MD5 9c9dd02df8497f2457534380bfd48119
SHA1 758a16b645bdcbd6ef28d4c8eebd77ceb81c9c2e
SHA512 7651cd52cd9dac88a241f659f500ed4eff17beb8e71c54a8d6df43a45114069719ce03525d5ccf0e8a329948bf0425b0190398936fbb853e74be720cad6ddfc7
TLSH
T16831EB6846CDE423EF1D35FC2424FC8F614447EC864D176B95232E252BBFEC4B226214
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f9b8.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index~RFe59f9b8.TMP
Size 48B
SHA256 9b11155900b373930ea865bdb3f7539a4840c6994bc17ff339edbf519ad31d41
MD5 482bf7a1d232833d08133127b477d50e
SHA1 66bafe06838f2b4111a320adb5b3b62028502553
SHA512 1d19fc198f30fb1c0bb823d795eed410d3bcdbce6cc17a5ac6f5d5ef8518eeb163fb1ba2f2453daf9fd5007cf42c597f290361f495be81d30857e6c9c90d55ae
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\index
Size 256KB
SHA256 e0c268f58542e01da0bedac2a71882d6760917fb7b600a438018d78c87a03352
MD5 8be5205aa6c5610aa1d124dd79571bfb
SHA1 354efaef854898e39175a333741e3b28532041b6
SHA512 3ba9483bbc90a9fb7c2f32c5f923161571a8bf722272685efc0c6bdb4c9cfce24817ba9001f61fe4c1be358f61631090c4a0738daef934a00de9e1c73afa676f
SSDEEP 3:LsOllllkll/lwrTgX:LsUlEtwrTg
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences
Size 6KB
SHA256 ea4c01169eb51582745bb88782eb62046906f2d7c4b30637bca16b585339cbbe
MD5 4798fb94629193ee48b8bf31bbc6910c
SHA1 a19daecad404a67794e372a60864c5251f21e53f
SHA512 baecca70f74ab500d84635d15f6ebe843a0b3a2bfc8f97a46c79c33f6d9d958c776b598f36bdcce6ef64e310bf62f5eff76f4562669c10a691bb26465f6eb74a
SSDEEP 192:stwNZVYfyZ8pa5ev/S+WiFvGvmewd7s1pALMC:stgM9x/VkwAC
TLSH
T13AE196439E285DBB4CC7F6197A25FB16E6F6502366D10E98ABFC870C04E66DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a32c9.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences~RFe5a32c9.TMP
Size 6KB
SHA256 5b0eebc81dd12b1c1dbf998c1436e04b017330827df71c096e8ba7a4eebd82c4
MD5 e4b6d35f1a9cc33b7c294b7e70652370
SHA1 bfb3f61f29803658d7d1e59f938950b2cb217211
SHA512 a15b2feb1f6a254be0155af8641582a82bb11fb2e7f0c77243909a3b2e45ac8ea1a94d84ba6507e3354152ba77714499162160145053c014cd648a4429e77359
SSDEEP 192:stwNZV9fyZ8pa5ev/S+WiFvGvmewd7s1moALM8:stgJ9x/Vkw1m8
TLSH
T181D198039E2859BB4CCBF2197A25FB06E6F6502266D11DD8EBFD861C04D66DC720780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\8449b4b5-72f1-4f3e-98d0-b1b2dfb05cfd\73cb100cf1fe8262_0
Size 2KB
SHA256 354f887d6f174ab1bd5ced77ec113e9c821c77c0d62d84b86b53ef901813df3a
MD5 c3d64a71b91e2ca44829943f0281f524
SHA1 b2a51e7733c4be34940e4370cb32c01dec5d4ffc
SHA512 e56737a30c6277c425eef3d4d11c24c8730c4f5abc489d956cc2cb2d60213376dac1c9725b9040b58269621ccb2179a43bb81cb15de3a383197f69049ea77438
TLSH
T14241A86F81000C5FDD92AC59901D1E7466EF9B25F5CEFCDECEEC09384A654C9712E422
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\8449b4b5-72f1-4f3e-98d0-b1b2dfb05cfd\73cb100cf1fe8262_0
Size 2KB
SHA256 d4f29e34f7b0953a3896a4e2505f930c269971a71355aa6f5728aa3a2ebb24a3
MD5 e6ac759a8e5848a26d86dbc8e2788da2
SHA1 239d9bcaa5813e976170e1def43725da66698728
SHA512 dcb75fc5148b9ad2c0375fcaab5edb4cfb61dca7133219d86e64f762f9d182d5996a41e6fa197bc9b8b23b58cfc067b6230903def4e4403d8fd88a141bdc7c6f
TLSH
T1F541A86F81000C5FDD92AC59901D1E7466EF9B25F5CEFCDECEEC09384A654C9712E422
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\8449b4b5-72f1-4f3e-98d0-b1b2dfb05cfd\73cb100cf1fe8262_0
Size 2KB
SHA256 a0e36a0dc2b469d5ca45132083298aec7617e6bef8f37bbb248d19044474ab1c
MD5 736a95f745f6584f03a8e2ec7a59e5f0
SHA1 9a8349008c10875f73f5dcda84394c591278e1a8
SHA512 d25d494327708bcf409fd2c2f6f4b986c74a4bd82640aaddfb7c3a598d7668e0482203643dd11f471bcb32054f971484dbe5096ef9365867906e6fdec061c7f0
TLSH
T17141A86F81000C5FDD926C5A901D1E7466EF9B25F5CEFCDECEEC09384A654C9712E422
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\8449b4b5-72f1-4f3e-98d0-b1b2dfb05cfd\73cb100cf1fe8262_0
Size 2KB
SHA256 a54c4a86bf88143c29a99fc199762be3c9e68fbce7d8781971b6073f25d4561f
MD5 ebbeeca4f4d2806fa4fea62a40b85e0a
SHA1 b867778a1f3a2981ed4ab08e30d1ca5486f9f824
SHA512 4a7d943cb37022e16530c2715fb60923f5aae0d635b12010ea5e97a73c1e336f6cf67efa048e437d09ce357ababb6df4e5d1933cb9221d44c6354282eb17975c
TLSH
T1B541A86F81000C5FDD926C5A901D1E7466EFAB25F6CEFCDECEEC09384A654C9712E422
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\8449b4b5-72f1-4f3e-98d0-b1b2dfb05cfd\index-dir\the-real-index
Size 96B
SHA256 b33cf79f7d51603d393c67587caf456c143d6f50d6912d6d00f64786fe5b5829
MD5 e3629ecabd409b347b3073fab5dee840
SHA1 073a7fdb4dfd80bfd0a67bf61fb078b13bc442fc
SHA512 146235819b2a6c46431b96387d1819441c7fb43e4074a6a22ac9eb79934f4a49a9a67c7a62f502f1e47cd960019bcf90e385ea17df09ac98416f003f60e407ee
TLSH
T145B022E828208C02C0200BF3A8C300C03BBC0FA80303232E82C800238E323C00200020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f246.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\8449b4b5-72f1-4f3e-98d0-b1b2dfb05cfd\index-dir\the-real-index~RFe59f246.TMP
Size 48B
SHA256 ff358ee7ecd6b1f642c4c483c09b913c4d3054f7bf54819be2e151f22aff7d89
MD5 a42d56a6afc90ecb93973cf19edfb67d
SHA1 4c66c8ad35f4d90c46f8ce88a5ee63360371e58e
SHA512 f38c0c1c7b610e3324f4280c50c7ea8ea1825ec6fc3cff74bc6ae1b0d1437c780c2dcae646c50ab4ebe3bfdc57c66863aa7f4c427e617b538b66e417dbb48846
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\af392d63-d9db-4261-85d5-44e89d3860da\index-dir\the-real-index
Size 96B
SHA256 59542ac13986f53ac59cebb71a8a148fd133232bf5f4ecfb752a43f87aeab521
MD5 3b301b142f9993c8fcf5772703f85233
SHA1 bbb0f5b20c9a016187b446d20cbf96afca1a8415
SHA512 adb3ea5fa24397cc7e60874a0e855a3394579f9b9ed4f7369f606f8ac1fbe4d5c8739b4f2121ef0720e31bd7c968ae5d8d3b8ccef3b98be55b051db6f1124921
TLSH
T1CCB024140534C007C400437C30CD45C1333C1D04C7170370D07141F44C1731D00401F0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59f13c.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\af392d63-d9db-4261-85d5-44e89d3860da\index-dir\the-real-index~RFe59f13c.TMP
Size 48B
SHA256 2513ec8f8d417d32b1fe7b0ecdc310d8ae5001d8c3eb279b991ccb5565537d82
MD5 ab7ccba4cce9d3aa40b2fff29c3fa99e
SHA1 3d591edf0e53da6a2c91a4a99d16e1b11f9bff05
SHA512 599422da29b2262d86ee4ce2af6f13b71e4fae639c94980af7e33320724f971dfc1bc099d058ba96c9ef978e20e5ddbf36db00f0b5682b19d96796f1244ef0b2
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 5d6d8a2112905e7283dd01e805e553b7c2fe8b5dfa75172ec1eec2a5f685bba7
MD5 bae12e6f58f2719770717f39e0b22c62
SHA1 bb36654296d592f857cf015f6c426466d16cff1a
SHA512 6fa6f212fe9766e11bf04a639a8571ccd98e46c953f7eccb3f8ce806f3d4bd505f6815d33b1e17710bcb882c04ae63f185fd5bfce7046c170beb3d29ac01c40e
TLSH
T1F6D0A7BF902058216B8DA5829181E013804B0D4B154EE154DD8BB600383F6AF5502879
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 dbfbbd5108359c6bed4f12a9525c553bc2a1327aca8fc64c6561126a0e5c51f8
MD5 954d5753130968c308a2c6388d08fefc
SHA1 08033757d30d7bcf03a740954bc472bed5ac9d95
SHA512 e72943c9ea00a605f3cf7ff32fea7e9850e4c0feff29ce7c23c69fd3ffebc47194766041a56aa39e63f5eaf10faece56deb40d4818eadc752eb3d85c6138ae73
TLSH
T1E1E0E76F51105C311F8ED4439081D017810B0D4B21C2F150DC57A5053C3F1DF89034FA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 70bf08309e9fa137549dcc87571dcc76992f568f56c7aebb2db09e344bd56c72
MD5 2a29d2e196256f7aa4e36a27f8da9ba4
SHA1 1c5d985403413cef859e23b673616bffdbc6f030
SHA512 4d607c0f142b5105947adacce2af75827b7266a5608d79e551051da898cdcbc2df85853140920f99b7c7bc34a5ba63965f1014b5a11975323a88279f89407d73
TLSH
T1EAD0277F91145C355F8FE5416181D01B8157458B72D5F150DC5689163C2F1DF4D078FB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe599abf.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe599abf.TMP
Size 141B
SHA256 88a3b485bd45e97da8a65b4a6a70a6fc42338462d5832351ee001b92c5527ff7
MD5 198b42b04386100c6934f196bbc7dd06
SHA1 ad0b1c2b027e30ba6e6415775c49b11a260e70f4
SHA512 8dc54104a7c2d6662a7a4005f1f01bee434d2571fad4463bd80554a51dd240f26b86983658186d9b80caf4a274763d40e3774934fb5bf07ac52d2c4a5bd96d77
TLSH
T1BBC02BEF51300C055BCC2083C0C0E003908E8D4F4841F484804F7540243F2EFE5035BD
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-05-22_05-41-27.00.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-05-22_05-41-27.00.log
Size 3KB
SHA256 b23a635784b0697a0e7e815643a8753eefedaa029325786034260f6a7a19fbba
MD5 80016811f6c45650e2db7f6ebc2b61d3
SHA1 38b8662f066ff476f6f7ed88ff36270a88944584
SHA512 e30132f3966adb176f71187231bf1e6c38c911e67ad70ce697abc135f739add9f975a2a2662e94de4e21f066368800427c7fa332315c3153cb5f7c71393389dc
TLSH
T1BB61606492A68096E00F181AE3143FB04DDB7D0D71FD3A7ABEB87E55404C166BDAC29E
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 a31a22fd34ea2a8e759e0fe916ce57ff983a57361335b92a309ca1c926615522
MD5 6a9b924a681c5e1be67e82959aa8f816
SHA1 53d5dc80aa81345075fbdc7195243c61d37c96c2
SHA512 7fecb89460958726a4a93a9b8e2ff0d942180246d442cdeffffdad4c006c336cbd651b992d1c597d1e7f7fa1bf42d855c1993fbaad7556d981ac4178477da8f9
TLSH
T1CF51C42C0514A2BEDDC7864BB55F3E234AE741A4EFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe599159.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe599159.TMP
Size 2KB
SHA256 9059aedae41985c3bea5574bb24bdfc779a81a7950b8e3d391c3b6c2486c5888
MD5 1dfd4312dabffb5d401c38fffe675cc2
SHA1 1aa7fe1743482b829a660e74791fddd811f2c5f3
SHA512 e10fb1041d771a8d79b900cb2ec7c226f1487b78c9909d53e91c512cf53332672c7a16108797ba3b3e280fb747ce2cc9594c6deb653a321d70f4642521d515ec
TLSH
T13C51D52C0614A2BEDDC7864FB54F3E238AE701A4DFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 09dac12386356c177b69cdc042dfea19e6a3d62f34b5c9e0f616401643daa653
MD5 0cf48c6a3f6f536ae9340e8c2efde75a
SHA1 e6feb367c439029828e053cc6eccd13fc6c0d4ec
SHA512 9471c7e6bcbffd05002954e0175f8a220a1af5d9628a58a3fa7353972c2b3271102cae0b159497e33722d4fd2be2f5d43abdd4fb84f57457f75919b60f79ea9b
SSDEEP 1536:/+WSWeqX+MNv5ZBL3VNUBYDireji7YDere1rHd8v60v:Q055V1Y
TLSH
T1D4A551A41845B6FDDB8AC2B8673C5F18B5FC8DB78C415025DACDEA0D70A346673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 93d558163e1820de7ac817ef1fbb1b99efae3a11aa81497fb7e6217c7b41db7a
MD5 f59ec76e0125d3066e26e8c001b357b6
SHA1 3d62c3f24d78f72288e01db17425ec86667d4049
SHA512 f72a356d9b742e62156d3d2e6546ae1da84061bb7d521efd97e23b5b56b00176f3a98d6dd36efbacde1aa51f3f395c4750ff52b2bc30c955f745bda5c7732a8b
SSDEEP 1536:c+WSWeqX+MNv5ZBL3VNUBYDireji7YDeregrHd8v60v:R055VUY
TLSH
T15CA551A41845B6FDDB8AC2B8673C5F18B5FC8DB78C415025DACDEA0D70A346673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe59aadc.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe59aadc.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 8KB
SHA256 dd50b3d8d3999d9774f34ce5562528fb043088e62bac3ec699e11a074e2314fd
MD5 69f9da25b169e20ae7bfb9168352645d
SHA1 6da4314c6a28211b75804a588ffbf754878c17aa
SHA512 8213e4d98ebde2ef7caf50eff1abba1cb5971ca309ff8ea2a84f30c98a4957b60c8d0e605b948331c1b77e3a364757b2005a47c4511248f7bb8093f916d8e69f
SSDEEP 24:Kf4Sqt8VtbDBtDi4kZERDhiqt8VtbDBtDi4kZERDf:i4SO8VFDYMtiO8VFDYML
TLSH
T10A02F1C17578B061E05961B7C9B3136B173D9265043396A32DB254929CC58CAD4255FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 ed078dcccc760bb9b8db7a141ddc9addaa4c6a14e781b0036efb0ae61f57cff8
MD5 2bffa9b5da6a22a8b858880de9f2d310
SHA1 ce086540689b4d0eb63f7476e3318d3eca5a1cfc
SHA512 2f6f74ee42e96e01bfbced5f8175e7bc5ae7e368470943161a6952659547b83a9aea269265705a4b51c7a39c4ccc0b5ae022bd9fdf194ca650a172ced8e9ebe5
TLSH
T16AC02B160F1761330B600A00C6BBBCC2CD853C8A05201C604239D04C0B182FF7580706
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 2c94ab12972982c5aaf4f3912ec7d2187c720376a3b14d9729841079679c593d
MD5 9bb5285c58f4a863a5d65d2e45e7bc38
SHA1 ad935b9db2e7e17340cc4e0bc14f79490f2bb000
SHA512 abb6954342c5cec537f9501c1dbe44d325df528e55b1eeebda435a035e29c64de6689c9a95b5bf5c92c95e10f552f2e6f7279f47f96528af523a6bbc9c099f9e
TLSH
T1C3E0C01F5E421CB74A610614DD76ACC0DEAB7C09C6A0F045977E868907046D961C4396
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 d06059112ed7ac4f453c109b43d5560727b710dfdb8a97317929eebd9b8781b9
MD5 7c2816f92c74fe40e268f0e2d1454ef9
SHA1 05292c596659e0adb7d803170ed6dd3cff23ca18
SHA512 466b56fb079f11e83e2d588d56f443d2356537985ec72ead1c41b1c5a5b8fef48e36866aed8f74f1ec35c2d4a907fe67b16b21a44fe2dc5327668cbcc5b445eb
TLSH
T143E0C01F5E422CB74A610614DC76ACC0DAAB7C09C6A0F0459B7E868907046D96184396
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe59907e.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe59907e.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.4MB
SHA256 2446b85a1c001c0920ff8e218e5aae69224af54c53fac4f64c5cc02abb60b879
MD5 dcd93307ee04f60891886906340dac01
SHA1 5c04aece7475f893eb4821997f4ad7e783db49e0
SHA512 69821539b930ddeffb329180286a9250e874d5fdba05d5005b9feabb061caac64e437ae329e814515d455a32bf2ebb3c7ed25ae329f6c59df238ca6375a91789
SSDEEP 49152:cwpN1pVhhlk9u7CXGtZxRz9DT0gzq8UdYb0UnE:cwpJhlk9u/7TzJpxUNUE
TLSH
T145B55A10ABE88E2BE4BF1BB6B57101510BF6F9866772F78F160C60782E933548D52763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 9KB
SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
MD5 18cf95269eab6519867f9c240ea57c6b
SHA1 7026775355daf1cf1a49d380d7cdd7785a6278e0
SHA512 873c83d15803396a636a09349313f90e2a1a9aa8e1a41b474f898ec0b6580b107f3e3763e8e1613f8cb9d7c611a21762ce712824b68de9ae48be73425f045096
SSDEEP 192:FTaPIYtYvIOnHW+pYt6wRpy6/WVkiS3s20AbCWGShWMeqf4:Fl8YQO2+pQDfykakiS3pb/1tw
TLSH
T14212AE53DBC9B884A0509FF7AD8C201A670381554D6458DBF9BA34AB350603A7B6E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 027ac84851ad3b9cdcc1f3c84de2f69b6a87a86755b3630d60ef5144cad27eb7
MD5 c1db941045039ece35410a11526d9b02
SHA1 028f2bb68aa3188c94ec8edfb26d2791afa6b1c4
SHA512 b042486cd6d6e589692d35c4cb8cc480c39c98939993bdca78120079530d3d8027abb9090d4c4a8acc1b0e833269d6523e3c9de0f4b6df9ad7e8e2fe3f83023d
TLSH
T1479002284EA1048158C86AA54E28589681062296C1DC20A7E1408A40C505D100C979B0
MD5 SHA1 SHA512 TLSH

Submit Download

CFGD690.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFGD690.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Teams Revo Helper ZnrAq.exe

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe
Size 51KB
SHA256 8b94af60bb58bc1629edb3b4f6a86ccff5769bb9b96d8826f06686af2d7fc55f
MD5 f5116556007dbf3fef5fb13f8a0ef18d
SHA1 dae322d2c8675cb39fc96a44acf39d8f9445383c
SHA512 3e8541586719ac7eb9b7cdb7f20ae78c9637031b717fb1ecf5fc50a02c0f636f015e70dedc2ed1a95fff9b0059063d4f0f19bfbc683dcf9d4d99a8c0c1039b3b
SSDEEP 768:WnPj8ZtfjZ/26C/11BV4/eYiv37H/35o9lsEpYi6s4OYih2E4:WnQTjZI1P5LHBo9ll76sz7hO
TLSH
T1FE336C138BF40898E5AA9375AAF14D2AEEB178465B60D7CF0351C0290F717C07DBB7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\VCRUNTIME140_1.dll
Size 43KB
SHA256 7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7
MD5 21ae0d0cfe9ab13f266ad7cd683296be
SHA1 f13878738f2932c56e07aa3c6325e4e19d64ae9f
SHA512 6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c
SSDEEP 768:uJnUUV7xPg4RdPvv1DHkhhFAWN6srByiYzC:uaY7XN7Ih4CIiYzC
TLSH
T1E4135A44977C8046E5AB85B0C4A2DF27FA38F6925B50938F0B65D29C2E637D0A73D31E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\msvcp140.dll
Size 1.0MB
SHA256 70a38d03a6c932de692912550730fb130db00f1708f756a9d1b5ac2e73da38cf
MD5 33ed5886def32d4380bb96327c7dd19c
SHA1 5c76aeced849165b5fd2ce088e59e89f44695f27
SHA512 eebfd43b41fad31f2301d2e3b5dfae0b928ffd98ad8704c9ab12bf584f78aa335d55e8110f1c05f0128ee486de10bb461bb13b3716e0583a3b0a45561c17d0c1
SSDEEP 12288:Kt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUi/NSfbQEKZm+jWodEEV3HfD26MVDM:KCMm9pypG2bQEKZm+jWodEExC6KDj0H
TLSH
T1C2354CBA668A8AB6C5D2A33891CD4F6DF2707544439267C781E7E58DDF43BC0937E220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n6NqqYiFJocG.exe

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe
Size 1.3MB
SHA256 a574173f6f46428bfbf852c9b9da1ed6ab4bdf11064fe719040ffffb271511be
MD5 205182ce5e6ed46f2d839064ddf4c7dc
SHA1 7a2804a7c37f47384fd17db42cc1a39b23924cec
SHA512 a6074b2ffae3272e512c66d38026a563c3722685fae5d305dd7295da3f373912ad0ad061a0df896f53cbcd7b5ed35d5db10adf0ef7272b657fe174c1271bb419
SSDEEP 24576:YmPjS7HX11V1/hpz4yF+sxtigrZ4Psb0iK7GO6L361scQm1wUnDAnEoOqd:l+31bxAsxb40o9gTYkm1ZnEnEG
TLSH
T11E5512127782C472D6B229324A68C672967DB9211F248BDF53D8165CCEB42C1CB36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\vcruntime140.dll
Size 99KB
SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
MD5 8697c106593e93c11adc34faa483c4a0
SHA1 cd080c51a97aa288ce6394d6c029c06ccb783790
SHA512 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
SSDEEP 1536:7y6+2mUD0uBFRXqYue/o+18iBH5T7heunxr98nZXR9xecbSQ2bIB0TO:7lXfRXqQw+PHLrCZh9xecbSt
TLSH
T147A36B4AB6A442B7D16AC174C4F39A47EB31B485873053CF03B58AA90F67BE15E3E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSID5B6.tmp

Path C:\Windows\Installer\MSID5B6.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIE327.tmp

Path C:\Windows\Installer\MSIE327.tmp
Size 113KB
SHA256 cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36
MD5 8fa4088a730b967d85df562fd5ef7d5e
SHA1 629db9229f4a4a691e14f38f4dbffba157fa1ce9
SHA512 1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2
SSDEEP 1536:xS8CWyksWMcdMWBpjr+UsgtFmVrrXL1MgbIurgnIMolaeB8DhIm+uBSw:xS8SgMq+jVrrb1MMBBMolzaDhI31w
TLSH
T19AB39D41BA908432D5FF2D3C1578DA621E3E79701FE09DAF175851B90EB43D0AB38E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5883f0.msi

Path C:\Windows\Installer\e5883f0.msi
Size 1.5MB
SHA256 045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818
MD5 3ff61a00c1a6be20f14f6d126913a609
SHA1 071dcaba6e221a35f70406071405669f228cbadc
SHA512 99ed16f3ea6ac934b64826c9ddce0f36caf599f852b6231dd361415c20850f9a0fcd88919a59d0438e659ae23f552dba4df6776dfe253bb9307c39ff22975092
SSDEEP 24576:MXi7m6PYnzOlHAGkG1D1xGcbpmByP+yXNpHQ1Dx/cGGJg/3pHJcBm0OUnWKUJJE:MS7rSilHAgjxRGyXqTegPp6m0vn/UJJ
TLSH
T1006533FF75112810D182033890D3D1FA3A78DF995FA249C6C25BF7A82E36BD1C5467AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5883f7.msi

Path C:\Windows\Installer\e5883f7.msi
Size 13.9MB
SHA256 636115933ab2f678c8d9eaf50e79e47be094436d438565fa30b0f1ae3d7362f4
MD5 8444b913223f0ebe0d7eb0867ece55e4
SHA1 43028a51223cbea7b405b18be0a59b42f7777136
SHA512 a1617c7eab8ff2922e9ba1c4273db6917cca25d3ac886aa28ee59dee45f4dc0a406be0f5251a189fd589720635aeeba8781f0899fbd3cb080ed82ad3e7c7596b
SSDEEP 393216:PMyGsr31tl7C4WYe47SXsxbOLq5a38wnt9lTmr7:PM831jG47ZIsZOLq5a38wnFm
TLSH
T170E63353358AC932C2BA0A7826BB97556B7DBD254DF0CC0B5710BA4A2C723C01BB5F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 4dfb78c497b361d186a2f79a241f72a7d65a1f0546607377cdfa7bd2a7a001de
MD5 c8d2cf15abff9239db942784b37ac89b
SHA1 0eceab2bfca2e808053e77f5e2b3fb77018c3000
SHA512 471b99e3dac48fe8da78816d5474e2da18bd2f876bf68aa3dc6d854ea79d75d397ed4a8059360bbf5f6550fee656165f419f220def671e903347584171346451
SSDEEP 24576:Vu8m+1zzdoO/vvTL7WBeU26FA4kDJFhitHmNjegl5Uqwe2YMYvlYpXqhU:B
TLSH
T16847D22432F92510E7F39E3CA8F1AA2389397D579C199E8D05411F4E0961FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{5bf90eda-b464-45ba-926f-b6a60f32f8fd}_OnDiskSnapshotProp

Path \??\Volume{fef0c820-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{5bf90eda-b464-45ba-926f-b6a60f32f8fd}_OnDiskSnapshotProp
Size 6KB
SHA256 1c933c573bcc52f36819cba896e8603dd28d7c7f85c46249b5ad155ae3bac9ec
MD5 a2c4dd84efa124face9e01da6b94bf90
SHA1 b0ebecefd5df21ddcd504cffcf26c45599798d68
SHA512 e999e204c706eeffb15332247b061bf83c70bac63afaff90f98cb663bacde0b853ee41adcafaafa2303029560894c5fe456c64db291976bdf815294e1bb7d84a
SSDEEP 96:Fb+CvMeXlSvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:x+fb++ZVmN
TLSH
T186D1AA085AF54711E2B3AB7128F54557A877B811EF33CB8E0198238E2670A10F875F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1120-156-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp

Download

memory/3860-947-0x000001FFEE700000-0x000001FFEE7AC000-memory.dmp

Download

memory/3984-899-0x0000000002C40000-0x0000000002C5A000-memory.dmp

Download

memory/3984-917-0x0000000004E80000-0x0000000004EBC000-memory.dmp

Download

memory/3984-916-0x0000000002E10000-0x0000000002E22000-memory.dmp

Download

memory/3984-903-0x0000000002DD0000-0x0000000002DDA000-memory.dmp

Download

memory/3988-67-0x000000000CF80000-0x000000000CF8E000-memory.dmp

Download

memory/3988-54-0x0000000005C20000-0x0000000005C2A000-memory.dmp

Download

memory/3988-66-0x000000000CFC0000-0x000000000CFF8000-memory.dmp

Download

memory/3988-55-0x0000000005CD0000-0x0000000005D36000-memory.dmp

Download

memory/3988-57-0x00000000063D0000-0x00000000068FC000-memory.dmp

Download

memory/3988-52-0x0000000002FB0000-0x0000000002FCE000-memory.dmp

Download

memory/3988-63-0x0000000007590000-0x00000000075B6000-memory.dmp

Download

memory/3988-51-0x0000000000A60000-0x0000000000CC2000-memory.dmp

Download

memory/5036-724-0x0000019FF3CD0000-0x0000019FF3D7C000-memory.dmp

Download

memory/5048-653-0x000001DC23600000-0x000001DC236A9000-memory.dmp

Download

memory/5048-654-0x000001DC25400000-0x000001DC254AC000-memory.dmp

Download

memory/5380-679-0x0000025582D30000-0x0000025582D60000-memory.dmp

Download

memory/5380-171-0x00007FFB4F140000-0x00007FFB4F141000-memory.dmp

Download

memory/5380-170-0x00007FFB4E4E0000-0x00007FFB4E4E1000-memory.dmp

Download

memory/5468-221-0x000001FAFFED0000-0x000001FAFFF79000-memory.dmp

Download

memory/5468-222-0x000001FA81B30000-0x000001FA81BDC000-memory.dmp

Download

memory/5632-299-0x00007FFB4DAD0000-0x00007FFB4DAD1000-memory.dmp

Download