045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818.msi
Size 1.5MB
Sample260522-e9588aht5s
SHA256 045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818
MD5 3ff61a00c1a6be20f14f6d126913a609
SHA1 071dcaba6e221a35f70406071405669f228cbadc
SHA512 99ed16f3ea6ac934b64826c9ddce0f36caf599f852b6231dd361415c20850f9a0fcd88919a59d0438e659ae23f552dba4df6776dfe253bb9307c39ff22975092
SSDEEP 24576:MXi7m6PYnzOlHAGkG1D1xGcbpmByP+yXNpHQ1Dx/cGGJg/3pHJcBm0OUnWKUJJE:MS7rSilHAgjxRGyXqTegPp6m0vn/UJJ
TLSH
T1006533FF75112810D182033890D3D1FA3A78DF995FA249C6C25BF7A82E36BD1C5467AA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware discovery persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 3 IoCs

pid	Process
3712	n6NqqYiFJocG.exe
3476	Microsoft Teams Revo Helper ZnrAq.exe
1792	Update.exe

Loads dropped DLL 9 IoCs

pid	Process
3476	Microsoft Teams Revo Helper ZnrAq.exe
3476	Microsoft Teams Revo Helper ZnrAq.exe
3476	Microsoft Teams Revo Helper ZnrAq.exe
3584	MsiExec.exe
3584	MsiExec.exe
3584	MsiExec.exe
3584	MsiExec.exe
3584	MsiExec.exe
3584	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Revo Health = "C:\\Users\\Admin\\Pictures\\FPKmXNI8Vo0b\\Microsoft Teams Revo Helper ZnrAq.exe"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3052	msiexec.exe
3	3052	msiexec.exe
4	3052	msiexec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF0033500A3D0B7762.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF52DB231B1671323E.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e586704.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF6539534C0468EE4B.TMP	msiexec.exe
File created	C:\Windows\Installer\e586705.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2DFA.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC3B1F7DC79B7884D.TMP	msiexec.exe
File created	C:\Windows\Installer\e586702.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBD2E9410D32A1C40.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{638CCC7B-F2A1-4592-856D-8EECFD59996F}	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File created	C:\Windows\SystemTemp\~DFD74375EA26103C92.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFB2489508A19DE70B.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2B29.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI2D6C.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DF807DDC475F4232DD.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3936.tmp	msiexec.exe
File created	C:\Windows\Installer\e586709.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI3A50.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e586702.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6869.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e586705.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
3052	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	n6NqqYiFJocG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000512b028b2c2fe2ee0000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000512b028b0000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900512b028b000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1a512b028b000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1d512b028b000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe
Key created	\Registry\user\S-1-5-21-1679180529-4058988202-686829476-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238985118383744"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.FastConnect\CurVer	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\TypeLib	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\B7CCC8361A2F295458D6E8CEDF9599F6\WixDefaultFeature	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.Connect.1\CLSID\ = "{CB965DF1-B8EA-49C7-BDAD-5457FDC1BF92}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.FastConnect	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.FastConnect\CurVer\Description = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.Connect.1	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Runtime = "v4.0.30319"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\State = "2"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\A28B8577D4F7BDE5B9DA033EF8800996	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\msteams\shell\open\command	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\PackageCode = "6C657E8FAD932A9448CF5E7D0C37BA16"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\Version = "1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\msteams\shell\open\command\ = "\"ms-teams.exe\" \"%1\""	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\msteams	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\B7CCC8361A2F295458D6E8CEDF9599F6\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Codebase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.FastConnect.1\CLSID\ = "{19A6E644-14E6-4A60-B8D7-DD20610A871D}"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TeamsAddin.Connect\ = "Connect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2984	msiexec.exe
2984	msiexec.exe
3124	ms-teams.exe
3124	ms-teams.exe
3124	ms-teams.exe
3124	ms-teams.exe
2984	msiexec.exe
2984	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
3132	msedgewebview2.exe
3132	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3052	msiexec.exe
Token: SeSecurityPrivilege	2984	msiexec.exe
Token: SeCreateTokenPrivilege	3052	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	3052	msiexec.exe
Token: SeLockMemoryPrivilege	3052	msiexec.exe
Token: SeIncreaseQuotaPrivilege	3052	msiexec.exe
Token: SeMachineAccountPrivilege	3052	msiexec.exe
Token: SeTcbPrivilege	3052	msiexec.exe
Token: SeSecurityPrivilege	3052	msiexec.exe
Token: SeTakeOwnershipPrivilege	3052	msiexec.exe
Token: SeLoadDriverPrivilege	3052	msiexec.exe
Token: SeSystemProfilePrivilege	3052	msiexec.exe
Token: SeSystemtimePrivilege	3052	msiexec.exe
Token: SeProfSingleProcessPrivilege	3052	msiexec.exe
Token: SeIncBasePriorityPrivilege	3052	msiexec.exe
Token: SeCreatePagefilePrivilege	3052	msiexec.exe
Token: SeCreatePermanentPrivilege	3052	msiexec.exe
Token: SeBackupPrivilege	3052	msiexec.exe
Token: SeRestorePrivilege	3052	msiexec.exe
Token: SeShutdownPrivilege	3052	msiexec.exe
Token: SeDebugPrivilege	3052	msiexec.exe
Token: SeAuditPrivilege	3052	msiexec.exe
Token: SeSystemEnvironmentPrivilege	3052	msiexec.exe
Token: SeChangeNotifyPrivilege	3052	msiexec.exe
Token: SeRemoteShutdownPrivilege	3052	msiexec.exe
Token: SeUndockPrivilege	3052	msiexec.exe
Token: SeSyncAgentPrivilege	3052	msiexec.exe
Token: SeEnableDelegationPrivilege	3052	msiexec.exe
Token: SeManageVolumePrivilege	3052	msiexec.exe
Token: SeImpersonatePrivilege	3052	msiexec.exe
Token: SeCreateGlobalPrivilege	3052	msiexec.exe
Token: SeBackupPrivilege	3504	vssvc.exe
Token: SeRestorePrivilege	3504	vssvc.exe
Token: SeAuditPrivilege	3504	vssvc.exe
Token: SeBackupPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe
Token: SeTakeOwnershipPrivilege	2984	msiexec.exe
Token: SeRestorePrivilege	2984	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
3052	msiexec.exe
3052	msiexec.exe
1792	Update.exe
3124	ms-teams.exe
3124	ms-teams.exe
3124	ms-teams.exe
3124	ms-teams.exe
3124	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
3124	ms-teams.exe
3124	ms-teams.exe
3124	ms-teams.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2560	2984	msiexec.exe	84
PID 2984 wrote to memory of 1060	2984	msiexec.exe	86
PID 1060 wrote to memory of 3712	1060	cmd.exe	88
PID 1060 wrote to memory of 4624	1060	cmd.exe	89
PID 1060 wrote to memory of 3476	1060	cmd.exe	90
PID 3712 wrote to memory of 1792	3712	n6NqqYiFJocG.exe	92
PID 3124 wrote to memory of 3132	3124	ms-teams.exe	99
PID 3132 wrote to memory of 4656	3132	msedgewebview2.exe	100
PID 3132 wrote to memory of 772	3132	msedgewebview2.exe	103
PID 3132 wrote to memory of 772	3132	msedgewebview2.exe	103
PID 3132 wrote to memory of 772	3132	msedgewebview2.exe	103
PID 3132 wrote to memory of 4248	3132	msedgewebview2.exe	104
PID 3132 wrote to memory of 4528	3132	msedgewebview2.exe	105
PID 3132 wrote to memory of 4528	3132	msedgewebview2.exe	105
PID 3132 wrote to memory of 32	3132	msedgewebview2.exe	106
PID 3132 wrote to memory of 32	3132	msedgewebview2.exe	106
PID 3132 wrote to memory of 32	3132	msedgewebview2.exe	106
PID 3132 wrote to memory of 4896	3132	msedgewebview2.exe	109
PID 3132 wrote to memory of 4896	3132	msedgewebview2.exe	109
PID 3132 wrote to memory of 4896	3132	msedgewebview2.exe	109
PID 2984 wrote to memory of 3584	2984	msiexec.exe	110

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3052

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:2560
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe" & reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Revo Health" /t REG_SZ /d "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe" & start "" "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe
    "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3712
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=n6NqqYiFJocG.exe --bootstrapperMode
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:1792
    - - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.7.15&instExecTime=1779424903101&launchSrc=t2installer
        5⤵
        Adds Run key to start application
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:3124
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=3124.1188.17901956303148990619
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:3132
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x160,0x164,0x168,0x13c,0x170,0x7ff9614fb078,0x7ff9614fb084,0x7ff9614fb090
        7⤵
        
        PID:4656
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1660,i,10126981079791880276,2443254735136516830,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1668 /prefetch:2
        7⤵
        
        PID:772
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2000,i,10126981079791880276,2443254735136516830,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:11
        7⤵
        
        PID:4248
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2288,i,10126981079791880276,2443254735136516830,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
        7⤵
        
        PID:4528
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3776,i,10126981079791880276,2443254735136516830,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:1
        7⤵
        
        PID:32
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=4076,i,10126981079791880276,2443254735136516830,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:1
        7⤵
        
        PID:4896
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID 3f37b702-16ab-492d-a27a-517074bb904e -Trigger SchedulerDirectLaunch -BgTaskDelay 6105
        6⤵
        Checks processor information in registry
        
        PID:936
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 3f37b702-16ab-492d-a27a-517074bb904e -Trigger EnsureTmaAtStartup
        6⤵
        Checks processor information in registry
        
        PID:4908
- - C:\Windows\system32\reg.exe
    reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Microsoft Revo Health" /t REG_SZ /d "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe"
    3⤵
    - Adds Run key to start application
    PID:4624
- - C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe
    "C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:3476
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 5407EDF4BB270210386D390D5A991D84
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:3584

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3504

C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:1388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e586703.rbs

Path C:\Config.Msi\e586703.rbs
Size 8KB
SHA256 1cd0bff6ea7d6c13632aab1e1526d0bdd15adb0f17d8162219c6452c75a26609
MD5 fd5f9e1e68515ca191341335cc0c8361
SHA1 051c4fd4a4774e34008e604be83fc4af03aa714c
SHA512 84bc2df83c93741a128cb3b1a5849a5e90e36e3a487301f1a445dd3219466fbeb6c2431d668fa13f93a6149ddf14835ce17e285efef1258d3d7258a5c8a76497
SSDEEP 96:mQV5RfpdD6yzGDCzIl5UyoO84COThqzdUyoO84CgjTcAyThqzkHhr59ZJWK7MTCJ:miGCAytPGvtPBfPXVpa4
TLSH
T1B2020E017706C5E3E8E24B75C71317683BA3E2F96B06634B4AAD80345F0738D5E99B8B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586708.rbs

Path C:\Config.Msi\e586708.rbs
Size 357KB
SHA256 60399eed6a6ca8b202f4b438cad8d6cd5fadf812ef10b3e61dcc35ae97d67262
MD5 29812adc66dde7e72998dc7c65f736ba
SHA1 09fc248784da8f6c664fce7cc9b30170cea84077
SHA512 59941e925adafd1c03d5dd89cc5bf588499e8201ea36d48b35887b17e2b05e34d07f34084ea29b6003c4e4a9521a1fab448ec25aff871bc8b208970615f51178
SSDEEP 3072:2e0z/XjS8SgMq+jVrrb1MMBBMolzaDhI315S8SgMq+jVrrb1MMBBMolzaDhI31l0:2e0zrpkp11exOpkp11exP
TLSH
T16F745C12AB41DDB5D87C393602717E9E743DF6630AC0BE5E8700DA684F5A7E8E318E52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

117308CCCD9C93758827D7CC85BB135E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\117308CCCD9C93758827D7CC85BB135E
Size 913B
SHA256 875dbf52604d2ca7c8e397856c552718eabe923c5b56519fb6b447b079ade55d
MD5 845f690db0da86702c56224d4c25dc7a
SHA1 d947396489f05dc3281246dce1b71493da7ca609
SHA512 1f2cd0f4bf5fb87a8888aafb3a2a620884e96d0a5480b39001212655bd3db9fe9e11af902c7736ae6d9bd817079dcb79bb03210196fb7fb1676032841bc202be
TLSH
T156118435902893229941BB78A780CCE571B943C7371127256694A9D04006BD2F7051CE
MD5 SHA1 SHA512 TLSH

Submit Download

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 2KB
SHA256 97885d672298877be305adf7f7839ec602ba77e78531ad973f3e121c63cccf3b
MD5 a7d3fb6923fcb6b2ca39abe4cec5d092
SHA1 0a7c2a2c4c9f59764d4e460acfdb85420adb21e2
SHA512 b4a7c9b528a88042f45d3e60cb6e81a8e50a0e11e161fd894cad2c29a5a07c13a0e79e71d0f19ce7b78e52b024a660b5c4f3b2b5e7ac2813ed115917f8632f23
TLSH
T15A4162EE751C6982D1E0A930C9DBAFC7DEF021E5B3D0F35F15244F840029B82CA96682
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 7a8a247d4b8ba35919ea815ec569794738968ef0660098106b6a9ab4e8fbae95
MD5 7db3e9e08000d8de550226566005a6bc
SHA1 e3aa488e0bc912ea209804c9a5790faade12cf76
SHA512 9a7c7d6a0ac246424e397d418d69ca6927c2b60a39597e3cab1921fe4f8a855a145fae8894de5e0650d919b025a8a889f4c2f34ab339b5eb2dc22dd37eb46eb2
TLSH
T1A30175A7D66D92C064E46950E728EBA7BAD2D3F23900BA2134BED25D00DD3811701426
MD5 SHA1 SHA512 TLSH

Submit Download

117308CCCD9C93758827D7CC85BB135E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\117308CCCD9C93758827D7CC85BB135E
Size 348B
SHA256 eeb0e4dadd13f77f5cec7c4604d708d398f608d2de3dbadeab8cba68f3be17bb
MD5 83af74a885a6c2544c567f51110c2c8c
SHA1 976849e2cb927f626b4297b1bd973e12b70d760f
SHA512 31ec95ec2d7623fa9437784a71eb0a53eaa6eaf1ba14f6022beb3520a00f9873de57a5b4879d459415cf71f10b245a634b9612d0d90d23f104663246b0ccfb0f
TLSH
T163E0B619A3BD0B12E8A9C63A44E42557EA766D167194C28A06B1474C6168E21A870713
MD5 SHA1 SHA512 TLSH

Submit Download

68D3CB5DF8B60914CA2C29396FD1ED7E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\68D3CB5DF8B60914CA2C29396FD1ED7E
Size 290B
SHA256 4157d0c272173b19abb1d6e22006137fb35d71e551cad78c6aefd68df69a74f0
MD5 18ed76bd84cf87e349036e3115f58979
SHA1 c1e752ddb06957361aa8e350313b00e7922ddcb5
SHA512 99e02449d117c467792e25ff9a1f995e028b89ee3512d6d7b9ced42b1ebe6deda7efa24c54ae23278786f3f1cec47beca7c283403a5d9dade84eb21453e09277
TLSH
T101D05E1C97F40221E040C63EA9E86653BAB5BA298119834416F0D3487064F16F931723
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 8adfbbdb77bfb5eab3a490673aa8261178735511fe2f72724365105cfcfe1278
MD5 da45cafe67ac638cabe384af69a24d21
SHA1 2aee769948b04255f61baa22bbdbbbbb20b4038a
SHA512 7786c11840b6111fc4d519920987d385fd77ab7642682dff57a2c53d0793c31416cdd815eca584712a101ade97e0d3817e66e2e26d4390807d0b0657fad8e1ac
TLSH
T177E05E0CE3F60A16F0C1CA3DA5E02957B535AE654610835507F0870D7828E41B931713
MD5 SHA1 SHA512 TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\AddinInstaller.dll
Size 35KB
SHA256 c0306045119da6aa284f77f5ae57e9a35ae473294ef6b983db909902ef860b65
MD5 077c50b05317268a4e84b0d8e18b7e25
SHA1 4e4320e74fb1d2ca46e38b7a5554547f8c0ea57f
SHA512 e61171028a7faef3e4545ddc1a6a0e9a0ba618c20db82d4cb32eae379710497b30fee3f165400ed93c2760e04c102889686a14d7f996b3664026c881e93024ed
SSDEEP 768:CJLtIDER3wlQ0Tkjb6PO59zeTzlU+9zZU:myARglQ7jQ4zeTm6zW
TLSH
T1E0F21891A7F84102FAFB6F706AB4E5422DB9BF875C70D92D1989E14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftTeamsMeetingAddinInstaller.msi

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddinMsis\1.26.08901\MicrosoftTeamsMeetingAddinInstaller.msi
Size 13.9MB
SHA256 636115933ab2f678c8d9eaf50e79e47be094436d438565fa30b0f1ae3d7362f4
MD5 8444b913223f0ebe0d7eb0867ece55e4
SHA1 43028a51223cbea7b405b18be0a59b42f7777136
SHA512 a1617c7eab8ff2922e9ba1c4273db6917cca25d3ac886aa28ee59dee45f4dc0a406be0f5251a189fd589720635aeeba8781f0899fbd3cb080ed82ad3e7c7596b
SSDEEP 393216:PMyGsr31tl7C4WYe47SXsxbOLq5a38wnt9lTmr7:PM831jG47ZIsZOLq5a38wnFm
TLSH
T170E63353358AC932C2BA0A7826BB97556B7DBD254DF0CC0B5710BA4A2C723C01BB5F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 42d45d6200b6398f58d303c2f3e57830a34741c1e498941e7cbdbea03d4d7f29
MD5 3fd2b5ecd87d42338cde0fbe26d61a23
SHA1 4abc6b7d3f1b7b33124bde6213ce90bb6d2cdeae
SHA512 c5e29489f998948383d6e18e3e42e86e60a2aa58c8b40af0042cea5481ce49d76ac05f47e0c0ad6adbf826a7eb37f4ad684b5f7b86c3afbe17ace5850337d0d2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 9ea77a2c32b22cbb3d8eadb13409764e6aa55a9b5bba599814b80cc652ce1633
MD5 4f3fe91c91182b9d79d299b6a89d129d
SHA1 d206ee0f90998c252d732b3b9455053bab6de0c1
SHA512 3fffefd55917bea24b686a965fbde133a154c6f0b95f7e10d48f903ce854511d6d92ccd70dd7440faa228d225d2c91f0ffdbd6833d31fdb29d8ffb363e35af9e
TLSH
T1C3D0241373010D74C47030334047770D0400C30F410540055C3CC71D1F744741F03441
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 1KB
SHA256 40706d1f0b1d95509f666cd9df3ee006703cffe8121a7650b329f8e9396f33e9
MD5 e09fe47a1494edda18a6b57a1f95206d
SHA1 bf2306fa97c2fb470845ff2c6e215b063e73d8ee
SHA512 8f87482a4b66126f30feff8c15a9d996eda69b35be80564b6a9168989e77e9e856997185ad39beae9968b9448b5fff2eedc5cd820a8cffd51f22e654b6831e3b
TLSH
T1823187B3E0845B73589296C5B5427B671F31652DCA810E48B0EF078903D76CC926BC36
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 f1441b75dd732d68d58d179bfed1d4312128a5f353c4f0456ceb9ca769898519
MD5 8420d7157c65440f4b39f9b87e440d4d
SHA1 1b90c923cfd739fe1f8978aeda24070cd709149c
SHA512 02af9716cfb3a8f96ab57c145c727caff3080b92be6ab931dedf4b9ec4701620b77103d03f7966faeef4a5c273ff7246018e46a5d037a7ab3c33a74365287dd8
TLSH
T14C51B673B848977785E38A84B9453F235F35A169DF921F50A9EE0B4801D769C2343C2E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 17b621f973766827e5ff881339058f7efb47beb8ae3eff536deccbaa13b042ae
MD5 675a7c9a41ae5f6fef12df8de89eadc8
SHA1 240cd445ed8cbd527154618afe1b1e3d65a9086e
SHA512 365316116425da0e288518500437bdb3b85d8b0f9877086b5662cd06b5e77a4edf7a80fb1c55bdf803e67e49f3a2266c3dade49d910f87a37775047bdef8ff03
SSDEEP 384:z+vsrvyOiyp4+IWA1eUVWGfvvLhNbplFxIF/poD4O:C0raxyp4sQe6WGfvpCFxop
TLSH
T14E72AE7207745A378CE1ED8ABC892E167BD58527D9C12FC8E5E55F0F020B2DC074680B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 adace98904936ca31f512647cc11f7e1f76f86b650c6241193240f4769619ec7
MD5 28dc0301b5910a026f4e12979e8b1be7
SHA1 119ae8e20ee500b8b5961e52e8a3c761b7b10630
SHA512 d77c719b79695080dd84da1025ebc7429f93a0a2cc1dcd5a338e6bb0d2349a0841ce58dd7d2bd4ad8517a24688881e046ed2a7a1821a52a7690a8a99d7d0095c
TLSH
T13771A573A864D6774DE3DE44B8852B126B65512ADAC12F98D9ED0F0D02D73982342C1B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State~RFe5a21d1.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe5a21d1.TMP
Size 1KB
SHA256 813feeb9872763b9943fc8cca5c6ebda0f5ff6e2800fe91725f30ec434863838
MD5 77a102ea89a430187ecd43bc04dd00df
SHA1 32fe82dce8dc4ca1f27a2481e56f57a2f5093d79
SHA512 a80e2bbb0ec9ac7cde46894eb51f10fe11762aa9e95c41b7f41dcefdf367686fb4bb60c83fcc612a956d9b5e8a7dc76f4dd9f8b9fd264999e7cb008a7077d773
TLSH
T1A7214273D0889B7394929595F55277971F60A9699A800E4CB0EF038903D75DC926BC36
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnGraphiteCache\index
Size 256KB
SHA256 a6bfd828540c165671f3fe6d351f629e591e19182e8bedc52a87980e5e13d830
MD5 46c77d3f4ec2ae7d5d6056fa1afc3c91
SHA1 992688feaec028de39b2280ffd7d49b76fcfcbfe
SHA512 2c3c188534676ada3eac5b75c72e33f71166caeffdd795027ecf35682b49adf7e2134df6e2de9d3c035ea6a42c264079e4faa90c8d5ed5f418970af1336b46c9
SSDEEP 3:LstlNllkll/lLVK1:LsX3lEtLVe
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\GPUCache\index
Size 256KB
SHA256 6e5c8ff2de40dee12a1ef6e6bedf5caee0e02e2650c3586ee90630735e942ee7
MD5 bf26349e790e3e6df44a2bcb8ec67372
SHA1 15737b31e86d5a9fa63abcc99da46a4d7305e4a7
SHA512 53595d34b55c9188914cbe6e3be9ccf5f21a11d77d9efda878d6a397314d2929f4863128da7f65b0b5cbfcf6c93a13faf90e72913bf8b318f2289e5c15c734a5
SSDEEP 3:LsOllllkll/lLVK1:LsUlEtLVe
MD5 SHA1 SHA512 SSDEEP

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7cbe644b-ad6c-4980-9927-7a9f523af051\73cb100cf1fe8262_0
Size 2KB
SHA256 e95ff77a68f348c27493c5c292212babb34df4588cb934f105c300bc08980110
MD5 c6c2f97d6c10a503d6a6023846a2b87e
SHA1 2db65966534c6f7643e000ee46c3f550edb48c65
SHA512 170eac5c073ec466e3c4f21f1ea2d425a812069f62657bcfe124b7e9e1686e74cfdcda7a5c8abc3cb7bafa4accdf8e253b17174f6279ef870a9ebdd92cdabbc6
TLSH
T14541076B41100C5ED9825C79510D1E7866EEAF20F6CEEEEECEED09381A354D9B12F830
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7cbe644b-ad6c-4980-9927-7a9f523af051\73cb100cf1fe8262_0
Size 2KB
SHA256 14954f30da4ed7f146e9ecc01cbcf1058249a811e2d0accd8495b52be9f5bb85
MD5 bf97c52f957248ac0a146c9bd0fc71d8
SHA1 47566856decb59b23239d4cda6f714d825306b5c
SHA512 945289d0647acb3fca5d827348c75d53a5efd960d917525bec77cbfbb5715881e7c1c293d9507dd969c14f3fbb3ed93ba346fd9936362b9524e4aa16cf9aa45b
TLSH
T15841076B41100C5ED9825C79510D1E7866EEAF21F6CEEEEECEED09381A354D9B12F430
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7cbe644b-ad6c-4980-9927-7a9f523af051\73cb100cf1fe8262_0
Size 2KB
SHA256 96f1352cff8c0ffd08acfe356655edb867073720590cb674e19daba71151f356
MD5 e3d7c89302978a1d3cac3787eb3cd034
SHA1 f3fb38e6ec20511e3d4ae721efe85191d4f10612
SHA512 af843d67d39e11886f1a41cbbf8dc3e6097c48eb57c23a80b43c2570aaa99b0c31acd887d03ae4c37d4707fc86922c32c8eafdbcb36fceda5514443ab79eeeef
TLSH
T18541076B40140C5ED9825C79510D1E7866EEAF24F6CEEEEECEED09381A354D9B12F430
MD5 SHA1 SHA512 TLSH

Submit Download

ad04bcd31c122994_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\7cbe644b-ad6c-4980-9927-7a9f523af051\ad04bcd31c122994_0
Size 928B
SHA256 3e9871c18aa83e5027612de30069d8b1b785883a254dbd9973c4a8c790da5a56
MD5 bd6b3ea5358104cb49762a9e1dc23e94
SHA1 66adef07d0e0194399dd2c2b394d0402531a1a09
SHA512 9d40e02704917627e1f62757d8c0e8836c89b538f29d742ddf67d16e653a633298b40a4e451b0369891780501d4ec487b37b486c7ed270c74c7f801046a4a116
TLSH
T16A110A1610100C1FDD92AD7A910E1A7966FA9B55A1CEFDDACDFC4938DDA50C8606E824
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 92d94cb58d48168e6d56fad80164bba674ab19365292a61db2316fc4830f3352
MD5 e580721c34e65cc3757800c9178a2e8a
SHA1 d6a4c9ae6963a35aefc453cba154fd4c07dde531
SHA512 433d969a4a41f31cc12825a458f18eda9060c3665591eb197a491a87d7fa36a6af8099307521e2dad17269347cbdf09ec11df16c406b6d48e724aab71904b302
TLSH
T1BCD0232F96300C214FCCB0C65480F05B505D0E4F5547F190DE4B7423B83F9B996075A0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 0a8118c3070302f5ad83691fc95550b0dbb35aaee95ce0ca283488066a8442f1
MD5 8262653234a6cf10d1609e87bd28e702
SHA1 d17bf893f7360210d96dd7ce3998151d1f46bf3a
SHA512 83255d6683e18e09bbd4030e9d9a371da86a71cb560b28f8cde401c9d61720191da63bc34c591604b5e54e7f496f3e18171f1c92d912356373c2443263aae732
TLSH
T17CE07D1F42300C354BC8598A9440E05700090D0F5582F2D159AA74116C2E2F686061D0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a2740.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe5a2740.TMP
Size 141B
SHA256 28be36d0e192a6c82c3a0725282a676f47e341bc78e7c8e9e350f49659e93b19
MD5 286bde023b2c54b9b620d8de7145e247
SHA1 f31dac9e88a5b4ee93bf3d513db2405024f92b6a
SHA512 bc92f122d3bd3c7bec1c6240b7c698da32252ecd945698aaafd032888d2ac4e990ff9ade728bd84ab3da899b5a2e88a53a35fc6f85beb2101999c4ed47074a2e
TLSH
T1E1C08C2F433008014BC460829080E047A00A4F4B4802A0E4AA8B7011243E5AAE6030A5
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-05-22_05-41-46.00.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-05-22_05-41-46.00.log
Size 3KB
SHA256 0b95744940d1cd5a40f9e2e805687f117c0d2fb17cfc18e6c3ed595b8882eee2
MD5 1cc750944e619c93445e9136444b93c7
SHA1 49bebc55c5599eb9065d87b3774eb6d693657d44
SHA512 e43fb72091082567c8d2c6322a4a053a19211911ad36b286d324ee5d94b46ea18fa650acc1047692f282b147874d499c6fb1f3a45f232083e2575aed5a50e38d
TLSH
T1BD618D7092A54092F80E1C5AE1243FB46DEEB44D61E534B9BFA0FE46404D125FEACD9E
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 a31a22fd34ea2a8e759e0fe916ce57ff983a57361335b92a309ca1c926615522
MD5 6a9b924a681c5e1be67e82959aa8f816
SHA1 53d5dc80aa81345075fbdc7195243c61d37c96c2
SHA512 7fecb89460958726a4a93a9b8e2ff0d942180246d442cdeffffdad4c006c336cbd651b992d1c597d1e7f7fa1bf42d855c1993fbaad7556d981ac4178477da8f9
TLSH
T1CF51C42C0514A2BEDDC7864BB55F3E234AE741A4EFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe5a1e28.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe5a1e28.TMP
Size 2KB
SHA256 9059aedae41985c3bea5574bb24bdfc779a81a7950b8e3d391c3b6c2486c5888
MD5 1dfd4312dabffb5d401c38fffe675cc2
SHA1 1aa7fe1743482b829a660e74791fddd811f2c5f3
SHA512 e10fb1041d771a8d79b900cb2ec7c226f1487b78c9909d53e91c512cf53332672c7a16108797ba3b3e280fb747ce2cc9594c6deb653a321d70f4642521d515ec
TLSH
T13C51D52C0614A2BEDDC7864FB54F3E238AE701A4DFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 6ee00c795bb53d256c09fe15901de6e30870dc1b5bd634c3f4a63486036c4173
MD5 2f69aa921f1e137e96fc26975d7e7fb2
SHA1 8d84d054e215c2d8943bf53faee0b0f3b911ec70
SHA512 fe011e9a899afd48b2ba54ad1b4706a6301962472008a9a2136fa06365c7868efdb924aa2fabc931a833d83e51a951104b37253dfd248973f2d18e76d3c1b66c
SSDEEP 1536:6LcSWmVX+MNv5ZBL3VNUBYDireji7YDereBrHd8l6Ep:wZ55VB6
TLSH
T1E8A550A41845B6FDDB8AC2B8673C1F18B5FC4DB78C415025EACDEA0D70A746673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 ef3cfbd86232adac79216cd09e979ab7ed2b718837b59a197175de3a80beed7d
MD5 128e8eaeca0eaf21ffdf068b70921e37
SHA1 37b5c17dc045764a79c2c9b7749d8357d65ccc11
SHA512 ff2320d593d426c4352c3d0ed50c3aba848e5863feb3b4275276520adbfd418547d15c7191421a32778691ea80255fb71cc2ff9dc03440cc76404534d998c191
SSDEEP 1536:ULcSWmVX+MNv5ZBL3VNUBYDireji7YDereDrHd8l6Ep:+Z55Vz6
TLSH
T181A560A41845B6FDDB8AC2B8673C1F18B5FC4DB78C415025EACDEA0D70A346673238A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe5a32d9.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe5a32d9.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 4KB
SHA256 9e35955e948c21c50566469df31e9de121b10827556f7301e56125fdc713fb95
MD5 06ae23dc14a85c0c4bffb46ceca02397
SHA1 2b0d58d97242c72eb7aba0199e93e7be467f76a0
SHA512 5d5982e2290a362777c1e8274926ffd09bd22538588a4cc8134c1137bc4c785deefcfd290ef7d558e8fb275bc7c977ea83d8f0b3648a24c28069ba8fd6d31f6f
SSDEEP 12:KQ16upC/qtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbf:KQAupSqt8VtbDBtDi4kZERDf
TLSH
T1998147C135787120D05A21F7C8B30397037D9364043797632DB15491DCC18C5C4261FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 820f6bfae1365e3ac668cb6bf0da547725d74deed8ff6b75625d13767239a442
MD5 3db030276a5a5df1601be3000641084f
SHA1 323788deee20ad7be58cc2bc9f0364ce1c60b93e
SHA512 16f2b2d16ddb09792fb71b749bd205c6696bd9f5ab9f729dca6957f003f8e4f14e0627844d8662feb95dc45b4cfb1fb60854d5ad8a4297c23103c0bacdf76a51
TLSH
T107C02B160E1775330B500B10C7BBBDC2C58A3C8A05302C604239C04C0B1C2FF7140606
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 7176853907023cc4aced67022067bab4a1995bb37ff5b17d5b02422322a2ec39
MD5 5c64c37cb00aa4dcd274402e1920791c
SHA1 afaae9cb5501c5c1b57029b2bca821c3a1b8ff16
SHA512 200ee7642976a5a1c36f1fc77268ab06b85336d10b9147b9d3ed81ce6d4e9c70260722a91a859799b7f14a5db9967c8285622159b345b039a0754b809b8d64bc
TLSH
T1EEE0C0162B077E7713801600CA76AD80C5D7B8468650E486277FC50947142E92940305
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 30dbdab7038b60f7e7e03a13acb522ef9d0e02e72410d16f0e975e0e6d253152
MD5 950afd3c8a68d361092ade56e4c3e7ee
SHA1 14471a80612a761e0f66b33bc0d86be75094022a
SHA512 49884914e3a86d42de6d44ca7d60dca206ebd9e8e3c71feece91c4561fcfc8a838da46b9ea1f0cb85c3a017daa0714de67ee73225f9dac1faf5d587b02496447
TLSH
T18FE0C0162B076E7713801600C976AC80C5D7BC468650E4C6277FC50947102E92940305
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe5a1d4d.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe5a1d4d.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.4MB
SHA256 2446b85a1c001c0920ff8e218e5aae69224af54c53fac4f64c5cc02abb60b879
MD5 dcd93307ee04f60891886906340dac01
SHA1 5c04aece7475f893eb4821997f4ad7e783db49e0
SHA512 69821539b930ddeffb329180286a9250e874d5fdba05d5005b9feabb061caac64e437ae329e814515d455a32bf2ebb3c7ed25ae329f6c59df238ca6375a91789
SSDEEP 49152:cwpN1pVhhlk9u7CXGtZxRz9DT0gzq8UdYb0UnE:cwpJhlk9u/7TzJpxUNUE
TLSH
T145B55A10ABE88E2BE4BF1BB6B57101510BF6F9866772F78F160C60782E933548D52763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 9KB
SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
MD5 18cf95269eab6519867f9c240ea57c6b
SHA1 7026775355daf1cf1a49d380d7cdd7785a6278e0
SHA512 873c83d15803396a636a09349313f90e2a1a9aa8e1a41b474f898ec0b6580b107f3e3763e8e1613f8cb9d7c611a21762ce712824b68de9ae48be73425f045096
SSDEEP 192:FTaPIYtYvIOnHW+pYt6wRpy6/WVkiS3s20AbCWGShWMeqf4:Fl8YQO2+pQDfykakiS3pb/1tw
TLSH
T14212AE53DBC9B884A0509FF7AD8C201A670381554D6458DBF9BA34AB350603A7B6E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 a501d1ed264f74f83682327691a514006c4a5e05a7668a2a79d42f3d483d06c3
MD5 877aba84bf5ee7a7f9cf7dd8ab10d8bc
SHA1 bcdef5de2c8ece481a056cc24c745c7aa2551ed4
SHA512 931f24c1ef1a74c916db240f1ab95169736b1d66795270c109d374212136496328f6a35c3a0021728fa4756ab8b28777140ac57ca6419f08aaecced2d652f7cc
TLSH
T16B9002FC44E0C546A87DE95204500834A45F19C30172C70922420494501AA440C92444
MD5 SHA1 SHA512 TLSH

Submit Download

CFG2D6A.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFG2D6A.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 726B
SHA256 d73d381d7686498b0ccab723425d17e3911418fdc5c375bfaa4573150082f550
MD5 4c272a1671b573d475bdf5ad9fd73800
SHA1 fc67c18054afe5d454c66e5bc0202d6a86aafccd
SHA512 13c65a7d72a0d1fb9f8fc9a409a0c6983ebc5f3a2cd93f2913f7d1f10fbdf9737e244955c9d4ab556f223f64427383df3a580f3d7dfa0b4702f39ff70206c711
TLSH
T15F016D2A0FB8025B9754310403595FDE7BBB61062201F5C153E5C64822868F66AFE581
MD5 SHA1 SHA512 TLSH

Submit Download

Microsoft Teams Revo Helper ZnrAq.exe

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\Microsoft Teams Revo Helper ZnrAq.exe
Size 51KB
SHA256 8b94af60bb58bc1629edb3b4f6a86ccff5769bb9b96d8826f06686af2d7fc55f
MD5 f5116556007dbf3fef5fb13f8a0ef18d
SHA1 dae322d2c8675cb39fc96a44acf39d8f9445383c
SHA512 3e8541586719ac7eb9b7cdb7f20ae78c9637031b717fb1ecf5fc50a02c0f636f015e70dedc2ed1a95fff9b0059063d4f0f19bfbc683dcf9d4d99a8c0c1039b3b
SSDEEP 768:WnPj8ZtfjZ/26C/11BV4/eYiv37H/35o9lsEpYi6s4OYih2E4:WnQTjZI1P5LHBo9ll76sz7hO
TLSH
T1FE336C138BF40898E5AA9375AAF14D2AEEB178465B60D7CF0351C0290F717C07DBB7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VCRUNTIME140_1.dll

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\VCRUNTIME140_1.dll
Size 43KB
SHA256 7b8f70dd3bdae110e61823d1ca6fd8955a5617119f5405cdd6b14cad3656dfc7
MD5 21ae0d0cfe9ab13f266ad7cd683296be
SHA1 f13878738f2932c56e07aa3c6325e4e19d64ae9f
SHA512 6b2c7ce0fe32faffb68510bf8ae1b61af79b2d8a2d1b633ceba3a8e6a668a4f5179bb836c550ecac495b0fc413df5fe706cd6f42e93eb082a6c68e770339a77c
SSDEEP 768:uJnUUV7xPg4RdPvv1DHkhhFAWN6srByiYzC:uaY7XN7Ih4CIiYzC
TLSH
T1E4135A44977C8046E5AB85B0C4A2DF27FA38F6925B50938F0B65D29C2E637D0A73D31E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msvcp140.dll

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\msvcp140.dll
Size 1.0MB
SHA256 70a38d03a6c932de692912550730fb130db00f1708f756a9d1b5ac2e73da38cf
MD5 33ed5886def32d4380bb96327c7dd19c
SHA1 5c76aeced849165b5fd2ce088e59e89f44695f27
SHA512 eebfd43b41fad31f2301d2e3b5dfae0b928ffd98ad8704c9ab12bf584f78aa335d55e8110f1c05f0128ee486de10bb461bb13b3716e0583a3b0a45561c17d0c1
SSDEEP 12288:Kt8MRN4gE4x4iTqwTQa6IUqXF7XyxpypsdUi/NSfbQEKZm+jWodEEV3HfD26MVDM:KCMm9pypG2bQEKZm+jWodEExC6KDj0H
TLSH
T1C2354CBA668A8AB6C5D2A33891CD4F6DF2707544439267C781E7E58DDF43BC0937E220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

n6NqqYiFJocG.exe

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\n6NqqYiFJocG.exe
Size 1.3MB
SHA256 a574173f6f46428bfbf852c9b9da1ed6ab4bdf11064fe719040ffffb271511be
MD5 205182ce5e6ed46f2d839064ddf4c7dc
SHA1 7a2804a7c37f47384fd17db42cc1a39b23924cec
SHA512 a6074b2ffae3272e512c66d38026a563c3722685fae5d305dd7295da3f373912ad0ad061a0df896f53cbcd7b5ed35d5db10adf0ef7272b657fe174c1271bb419
SSDEEP 24576:YmPjS7HX11V1/hpz4yF+sxtigrZ4Psb0iK7GO6L361scQm1wUnDAnEoOqd:l+31bxAsxb40o9gTYkm1ZnEnEG
TLSH
T11E5512127782C472D6B229324A68C672967DB9211F248BDF53D8165CCEB42C1CB36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vcruntime140.dll

Path C:\Users\Admin\Pictures\FPKmXNI8Vo0b\vcruntime140.dll
Size 99KB
SHA256 ff43e813785ee948a937b642b03050bb4b1c6a5e23049646b891a66f65d4c833
MD5 8697c106593e93c11adc34faa483c4a0
SHA1 cd080c51a97aa288ce6394d6c029c06ccb783790
SHA512 724bbed7ce6f7506e5d0b43399fb3861dda6457a2ad2fafe734f8921c9a4393b480cdd8a435dbdbd188b90236cb98583d5d005e24fa80b5a0622a6322e6f3987
SSDEEP 1536:7y6+2mUD0uBFRXqYue/o+18iBH5T7heunxr98nZXR9xecbSQ2bIB0TO:7lXfRXqQw+PHLrCZh9xecbSt
TLSH
T147A36B4AB6A442B7D16AC174C4F39A47EB31B485873053CF03B58AA90F67BE15E3E391
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI2B29.tmp

Path C:\Windows\Installer\MSI2B29.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI3936.tmp

Path C:\Windows\Installer\MSI3936.tmp
Size 113KB
SHA256 cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36
MD5 8fa4088a730b967d85df562fd5ef7d5e
SHA1 629db9229f4a4a691e14f38f4dbffba157fa1ce9
SHA512 1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2
SSDEEP 1536:xS8CWyksWMcdMWBpjr+UsgtFmVrrXL1MgbIurgnIMolaeB8DhIm+uBSw:xS8SgMq+jVrrb1MMBBMolzaDhI31w
TLSH
T19AB39D41BA908432D5FF2D3C1578DA621E3E79701FE09DAF175851B90EB43D0AB38E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e586702.msi

Path C:\Windows\Installer\e586702.msi
Size 1.5MB
SHA256 045b76fa552dbfdfb7e5de66c9c599fe91151384be6a9849ec8965aa7251b818
MD5 3ff61a00c1a6be20f14f6d126913a609
SHA1 071dcaba6e221a35f70406071405669f228cbadc
SHA512 99ed16f3ea6ac934b64826c9ddce0f36caf599f852b6231dd361415c20850f9a0fcd88919a59d0438e659ae23f552dba4df6776dfe253bb9307c39ff22975092
SSDEEP 24576:MXi7m6PYnzOlHAGkG1D1xGcbpmByP+yXNpHQ1Dx/cGGJg/3pHJcBm0OUnWKUJJE:MS7rSilHAgjxRGyXqTegPp6m0vn/UJJ
TLSH
T1006533FF75112810D182033890D3D1FA3A78DF995FA249C6C25BF7A82E36BD1C5467AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 f8a84c87e7128d5e1411a2ac920162a94b431a488f734c7970cb42d5a94c55e9
MD5 a4c015c2c9d414c47ebcd52e4f97758b
SHA1 3c0213056a59fd20a11aa1adc5e6e625c7d2d79a
SHA512 a1b4c92d74fd9d24c5852bed558a0c4cf06f00238a76c2733e559ac842ce11cfb67baf3c3698b1acf49c3470f39d75b0f45b381aeb699fb2370b617b45b349fb
SSDEEP 24576:h2gmSp1ndoO/vvTL5GyuxEHKv65pg4WoGWBdHJESL5KoEe2HoZTVrf4lx:P
TLSH
T1EB47F61832F92140E7F39E3DA8F06A67493A7D5B9C15DE8D05811B8D0921FB1E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{e74ef7bd-424f-4dd4-852e-162c977122a5}_OnDiskSnapshotProp

Path \??\Volume{8b022b51-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{e74ef7bd-424f-4dd4-852e-162c977122a5}_OnDiskSnapshotProp
Size 6KB
SHA256 aadd0c1bf23f41d4f1198a06d8ab743ea6e3bc1fafe1a253a8052215c5e69b77
MD5 50d82dfc85557e4c36102386bf4e2279
SHA1 8a056e3cfc55dded4cfc399a1496b625a6946969
SHA512 2fccec81d866877ee14c7a313b2a714931a7dad65f0993ebb7635a4a00ae16bb9cf0a358fae90fbbe3f070583b7eb46c2eefe5363081c392fa99f86a36b30b47
SSDEEP 96:FaCvC4Uvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:U3b++ZVmN
TLSH
T193D178085AF54711E2B3AB7229F14557A877B911EF33CB8E0298638E2670910F835F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/32-912-0x0000021041370000-0x00000210413DF000-memory.dmp

Download

memory/32-309-0x00007FF982900000-0x00007FF982901000-memory.dmp

Download

memory/772-166-0x00007FF982900000-0x00007FF982901000-memory.dmp

Download

memory/1388-211-0x000001DDF7890000-0x000001DDF7AB1000-memory.dmp

Download

memory/1792-61-0x0000000005DB0000-0x00000000062DC000-memory.dmp

Download

memory/1792-76-0x000000000BAB0000-0x000000000BAE8000-memory.dmp

Download

memory/1792-58-0x0000000005060000-0x000000000506A000-memory.dmp

Download

memory/1792-73-0x0000000006D60000-0x0000000006D86000-memory.dmp

Download

memory/1792-59-0x00000000056B0000-0x0000000005716000-memory.dmp

Download

memory/1792-77-0x000000000BA90000-0x000000000BA9E000-memory.dmp

Download

memory/1792-55-0x0000000000230000-0x0000000000492000-memory.dmp

Download

memory/1792-56-0x0000000002B70000-0x0000000002B8E000-memory.dmp

Download

memory/3124-887-0x0000021C11B50000-0x0000021C11D71000-memory.dmp

Download

memory/3584-829-0x0000000002760000-0x000000000277A000-memory.dmp

Download

memory/3584-847-0x00000000049D0000-0x0000000004A0C000-memory.dmp

Download

memory/3584-846-0x0000000002960000-0x0000000002972000-memory.dmp

Download

memory/3584-833-0x00000000027A0000-0x00000000027AA000-memory.dmp

Download