31e75e9b008b16b2ba7861082e6d80e18d2cc928153b395816ba353812e759da

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/05/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
31e75e9b008b16b2ba7861082e6d80e18d2cc928153b395816ba353812e759da.msi
Size 1.2MB
Sample260522-fd8vxaev8n
SHA256 31e75e9b008b16b2ba7861082e6d80e18d2cc928153b395816ba353812e759da
MD5 82073ed5c2844a193911be73a2a68727
SHA1 4c1d23d040bd1c41bf87b935a76cce8ca0fda1dc
SHA512 8021948bc0925ce036780afe0ad12c118cfe052c2cfbc18783b5e4360e9e69dc8b88f50eecf9e79845532a9ee5e3b15ae99027a228ea46ac9da5dc84c2981e67
SSDEEP 24576:gQ19m+op2rY4yp+sJMvtMv7vfRYqp8O1TQy4e1SLXm1xUctK:D9m+HsJqz4f1sFkym1mct
TLSH
T11A4533A1730080E0DAC61D3AA445E316B87D9C592FA1C9C6C65FB2CCDF76BB0529F5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Badlisted process makes network request 9 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
4	4760	msiexec.exe
6	4760	msiexec.exe
9	4760	msiexec.exe
50	3488	powershell.exe
52	3488	powershell.exe
74	3488	powershell.exe
100	3488	powershell.exe
146	3488	powershell.exe
157	3488	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
3488	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1764	VGIcF8yFH0YG.exe
3420	Update.exe

Loads dropped DLL 6 IoCs

pid	Process
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe
4424	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Updates for Microsoft Teams v0.2139458437 = "powershell.exe -WindowStyle Hidden -NoProfile -EP Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\39QBoaFa00wu\\SQKqjgW3.ps1\" rfFw1zTUJaGYSeaVOCiyp97bkMINKtPxF8AHXaahNv7P9lM8KfU= rfFw1zTUenGReNq4dCaqj3qpufDCig=="	powershell.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
916	cmd.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 17 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\MSIBBE.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e588fc8.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\e588fcb.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFD45.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI814.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\e588fca.msi	msiexec.exe
File created	C:\Windows\Installer\e588fcb.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File created	C:\Windows\Installer\e588fcf.msi	msiexec.exe
File created	C:\Windows\Installer\e588fc8.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{24624174-D303-4657-A0BB-E79DE911E0F4}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI90C2.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFA07.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFAE3.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4760	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VGIcF8yFH0YG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000e0d688459d835b340000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000e0d688450000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900e0d68845000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1ae0d68845000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1de0d68845000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000\SOFTWARE\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238988867184793"	msedgewebview2.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.Connect.1	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\Language = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\SourceList\Net	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\msteams\shell	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.FastConnect\ = "FastConnect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\msteams\shell\open\command	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.FastConnect\CurVer\Description = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID\ = "{EABAE40C-B27C-455A-B672-F234DD780948}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\msteams_8wekyb3d8bbwe\Internet Settings\Cache	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.Connect\CurVer\ = "TeamsAddin.Connect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\CodeBase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\1E2695703799DCC5B85E930B57A69E01\47142642303D75640ABB7ED99E110E4F	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\SourceList	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.FastConnect	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.FastConnect\CurVer\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Codebase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\FLAGS\ = "0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\msteams\shell\open	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.FastConnect.1\CLSID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Runtime = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.FastConnect.1	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ = "FastConnect Class"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\47142642303D75640ABB7ED99E110E4F\PackageCode = "A0812909BDB892C40904D1D89630B2CE"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4036	msiexec.exe
4036	msiexec.exe
3488	powershell.exe
3488	powershell.exe
3488	powershell.exe
1468	ms-teams.exe
1468	ms-teams.exe
1468	ms-teams.exe
1468	ms-teams.exe
4036	msiexec.exe
4036	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5000	msedgewebview2.exe
5000	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4760	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4760	msiexec.exe
Token: SeSecurityPrivilege	4036	msiexec.exe
Token: SeCreateTokenPrivilege	4760	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4760	msiexec.exe
Token: SeLockMemoryPrivilege	4760	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4760	msiexec.exe
Token: SeMachineAccountPrivilege	4760	msiexec.exe
Token: SeTcbPrivilege	4760	msiexec.exe
Token: SeSecurityPrivilege	4760	msiexec.exe
Token: SeTakeOwnershipPrivilege	4760	msiexec.exe
Token: SeLoadDriverPrivilege	4760	msiexec.exe
Token: SeSystemProfilePrivilege	4760	msiexec.exe
Token: SeSystemtimePrivilege	4760	msiexec.exe
Token: SeProfSingleProcessPrivilege	4760	msiexec.exe
Token: SeIncBasePriorityPrivilege	4760	msiexec.exe
Token: SeCreatePagefilePrivilege	4760	msiexec.exe
Token: SeCreatePermanentPrivilege	4760	msiexec.exe
Token: SeBackupPrivilege	4760	msiexec.exe
Token: SeRestorePrivilege	4760	msiexec.exe
Token: SeShutdownPrivilege	4760	msiexec.exe
Token: SeDebugPrivilege	4760	msiexec.exe
Token: SeAuditPrivilege	4760	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4760	msiexec.exe
Token: SeChangeNotifyPrivilege	4760	msiexec.exe
Token: SeRemoteShutdownPrivilege	4760	msiexec.exe
Token: SeUndockPrivilege	4760	msiexec.exe
Token: SeSyncAgentPrivilege	4760	msiexec.exe
Token: SeEnableDelegationPrivilege	4760	msiexec.exe
Token: SeManageVolumePrivilege	4760	msiexec.exe
Token: SeImpersonatePrivilege	4760	msiexec.exe
Token: SeCreateGlobalPrivilege	4760	msiexec.exe
Token: SeBackupPrivilege	208	vssvc.exe
Token: SeRestorePrivilege	208	vssvc.exe
Token: SeAuditPrivilege	208	vssvc.exe
Token: SeBackupPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe
Token: SeTakeOwnershipPrivilege	4036	msiexec.exe
Token: SeRestorePrivilege	4036	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4760	msiexec.exe
4760	msiexec.exe
3420	Update.exe
1468	ms-teams.exe
1468	ms-teams.exe
1468	ms-teams.exe
1468	ms-teams.exe
1468	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
1468	ms-teams.exe
1468	ms-teams.exe
1468	ms-teams.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 4312	4036	msiexec.exe	103
PID 4036 wrote to memory of 916	4036	msiexec.exe	105
PID 916 wrote to memory of 1764	916	cmd.exe	108
PID 916 wrote to memory of 3488	916	cmd.exe	109
PID 1764 wrote to memory of 3420	1764	VGIcF8yFH0YG.exe	110
PID 3488 wrote to memory of 4472	3488	powershell.exe	111
PID 4472 wrote to memory of 3188	4472	csc.exe	112
PID 3488 wrote to memory of 1916	3488	powershell.exe	113
PID 1916 wrote to memory of 2088	1916	csc.exe	114
PID 1468 wrote to memory of 5000	1468	ms-teams.exe	130
PID 5000 wrote to memory of 3492	5000	msedgewebview2.exe	131
PID 5000 wrote to memory of 744	5000	msedgewebview2.exe	132
PID 5000 wrote to memory of 744	5000	msedgewebview2.exe	132
PID 5000 wrote to memory of 744	5000	msedgewebview2.exe	132
PID 5000 wrote to memory of 4748	5000	msedgewebview2.exe	133
PID 5000 wrote to memory of 3612	5000	msedgewebview2.exe	134
PID 5000 wrote to memory of 3612	5000	msedgewebview2.exe	134
PID 5000 wrote to memory of 5472	5000	msedgewebview2.exe	137
PID 5000 wrote to memory of 5472	5000	msedgewebview2.exe	137
PID 5000 wrote to memory of 5472	5000	msedgewebview2.exe	137
PID 5000 wrote to memory of 6024	5000	msedgewebview2.exe	139
PID 5000 wrote to memory of 6024	5000	msedgewebview2.exe	139
PID 5000 wrote to memory of 6024	5000	msedgewebview2.exe	139
PID 4036 wrote to memory of 4424	4036	msiexec.exe	145

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\31e75e9b008b16b2ba7861082e6d80e18d2cc928153b395816ba353812e759da.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4760

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:4312
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\39QBoaFa00wu\VGIcF8yFH0YG.exe" & powershell.exe -NoProfile -WindowStyle Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\39QBoaFa00wu\SQKqjgW3.ps1" rfFw1zTUJaGYSeaVOCiyp97bkMINKtPxF8AHXaahNv7P9lM8KfU= rfFw1zTUenGReNq4dCaqj3qpufDCig==
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:916
- - C:\Users\Admin\AppData\Local\Temp\39QBoaFa00wu\VGIcF8yFH0YG.exe
    "C:\Users\Admin\AppData\Local\Temp\39QBoaFa00wu\VGIcF8yFH0YG.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=VGIcF8yFH0YG.exe --bootstrapperMode
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of FindShellTrayWindow
      PID:3420
    - - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.7.15&instExecTime=1779425277132&launchSrc=t2installer
        5⤵
        Adds Run key to start application
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:1468
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=1468.1704.7103107032787419660
        6⤵
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:5000
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7fff1bbeb078,0x7fff1bbeb084,0x7fff1bbeb090
        7⤵
        
        PID:3492
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1764,i,6183006514193059058,14133951387086611594,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:2
        7⤵
        
        PID:744
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2072,i,6183006514193059058,14133951387086611594,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:3
        7⤵
        
        PID:4748
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2404,i,6183006514193059058,14133951387086611594,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1752 /prefetch:8
        7⤵
        
        PID:3612
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3860,i,6183006514193059058,14133951387086611594,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3868 /prefetch:1
        7⤵
        
        PID:5472
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=4400,i,6183006514193059058,14133951387086611594,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:1
        7⤵
        
        PID:6024
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID 3ef90c28-5e2e-4284-be7f-9b6606830fd3 -Trigger SchedulerDirectLaunch -BgTaskDelay 1875
        6⤵
        Checks processor information in registry
        
        PID:5936
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 3ef90c28-5e2e-4284-be7f-9b6606830fd3 -Trigger EnsureTmaAtStartup
        6⤵
        Checks processor information in registry
        
        PID:5896
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\39QBoaFa00wu\SQKqjgW3.ps1" rfFw1zTUJaGYSeaVOCiyp97bkMINKtPxF8AHXaahNv7P9lM8KfU= rfFw1zTUenGReNq4dCaqj3qpufDCig==
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:3488
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\nov23jzv\nov23jzv.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4472
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9BAE.tmp" "c:\Users\Admin\AppData\Local\Temp\nov23jzv\CSCA1ADCABA3A6A466585B315FB63D177D.TMP"
        5⤵
        
        PID:3188
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\xt4jqopm\xt4jqopm.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1916
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES9D06.tmp" "c:\Users\Admin\AppData\Local\Temp\xt4jqopm\CSC1AD1E61841A34516B217266AC0A65A7A.TMP"
        5⤵
        
        PID:2088
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BF306CEE8E5264AA3A9FE80238F9EDD4
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:4424

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:208

C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e588fc9.rbs

Path C:\Config.Msi\e588fc9.rbs
Size 7KB
SHA256 256e9412ef8c3507838983431b0197945762a6df8010fccfb621915c0a478609
MD5 217836aba87056e060cc39b4f9b0a150
SHA1 1b5a60c1dab7d32572499706a9323ddb8374730d
SHA512 27ffeb73429463a5a6052b8c3912fa4a2ac71ca62daf1d95e53c0b332cf2ba4eedafcad26a6f2b32e9c976a5e3a2b769d8ebc220d2857d4fcdd4eab7548cb070
SSDEEP 96:9wEY95nITW2euFR5UypqZuqu4COThqF0mUypqZuqu4Cgj/gMyHThqFKHHvr5xEqm:9dNeKyQsulPGPQsulPTlwqGpVpD9
TLSH
T130F13101B3B095E2E8721B36C74B2BA537F6C6EA9751234B09DDC4642F5B3482F9428F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588fce.rbs

Path C:\Config.Msi\e588fce.rbs
Size 357KB
SHA256 e3b1e56109a8fc4a007c3e5cea0a5374b75b4a64381d5507bae946d88607ec6e
MD5 5c6a129a625233dbd2d465e3a9b91002
SHA1 ba2aec57bbec58992a46ff753fa5a74dab29a28b
SHA512 69d91466745df594a9be43d9944a400b90d326f35b697ef9ec832eab01ecfc611db4909fb00312e4a9549e4ea36c32e59a58235946cdc04926a66abec1aedb6e
SSDEEP 3072:Re0zxXbS8SgMq+jVrrb1MMBBMolzaDhI31PS8SgMq+jVrrb1MMBBMolzaDhI31Sn:Re0zRpkp11exApkp11exL
TLSH
T186746C12AB41D9B5C47C753612757A8EB03EF6634AC0BE5F8740CA684F5A7E8F318E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

206932163209AD483A44477E28192474

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\206932163209AD483A44477E28192474
Size 27KB
SHA256 224d810b30fcbcd100aa265d553f79ceb36b6d49ff4897195c5160e6d517a190
MD5 6f299e2f4f8ec1deaa35931aa07c25b2
SHA1 0754e2b70e441f6696910430e73b1b952b9102eb
SHA512 6134d223defb3697b6227c2901d470a922816a954151ca463eccab4a8ab59dac28081e0408e01b58d516414014eeb9c240e1dfde48c283a27c568c247af159a4
SSDEEP 384:9WH+EEf/CkcowQlIlWjZPWQaP7ABEpCnR+6/YQHRQ942t7ZDFjgRs:ceEESk4QlFYBAuUg6/xWt7ZDF5
TLSH
T17DC2C4BC984C36AB91C56A71CD9B8F97DCB144A53B92F00F06A15FC81422FC6CEE56C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 879520a08f5f75b8b8b57f5e78110c0496062ada7a67fec057336639d17e08f6
MD5 7f03a62c7ccb134770a79c292bdcd589
SHA1 99a6ccdd433b8ed7636a7f8c0e85cfb48d39d798
SHA512 2a88055bd8900aab2582979e1ea3d8f92e3437554833b83aa284edb484e3fb6bd163ad1c5677e1efeba90620117de9a99163135be25148153e1aa3e90224b068
TLSH
T13E410A434C6E6041ED86F9E1EAC5E17938F4EF5329051D239637A298145E3E9FB0810E
MD5 SHA1 SHA512 TLSH

Submit Download

86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC
Size 2KB
SHA256 71b923ef578748cb9bb100732f430603c0e831f30e21682e6ce564d89336f58d
MD5 9eb1c446d163dd727f7bad26556c21e6
SHA1 ed95f921865907e39185bd369c0559e1630f5828
SHA512 8e57fe56afd30bedc7fc726dd7e447d2be08bee999a13cd773ba8f2cead04a650ae5687db5d557f926943d01c5d6210e9fd61f0d5e48794911889ccd93a7ba7b
TLSH
T18541E8AA936C70A3682119039BE8D7773E3D8BD705A41340747698391017FF77E09C69
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\EF7234CDBB1649702229F955C785C39F
Size 785B
SHA256 7a8a247d4b8ba35919ea815ec569794738968ef0660098106b6a9ab4e8fbae95
MD5 7db3e9e08000d8de550226566005a6bc
SHA1 e3aa488e0bc912ea209804c9a5790faade12cf76
SHA512 9a7c7d6a0ac246424e397d418d69ca6927c2b60a39597e3cab1921fe4f8a855a145fae8894de5e0650d919b025a8a889f4c2f34ab339b5eb2dc22dd37eb46eb2
TLSH
T1A30175A7D66D92C064E46950E728EBA7BAD2D3F23900BA2134BED25D00DD3811701426
MD5 SHA1 SHA512 TLSH

Submit Download

0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560
Size 426B
SHA256 05e3a2d4a441e342b2333c753b90e79ec1feea4562967058e389164e1adc2821
MD5 cf93cd37c77682bf0b99871a265fdc64
SHA1 3bc3c91ec3aab1b482df2be1fc90efdec2190085
SHA512 b81773c22665fd0c0568ad276b56ea0b2401ebaf261798117df4a587d239f812a26566699538880cba3af13addf38cf8ef86fce02e279aeec570b7fee805cb8b
TLSH
T1FCE02624AAFE8256F332ADF807D96235967FF062146867F2136008966A00D009CA6727
MD5 SHA1 SHA512 TLSH

Submit Download

206932163209AD483A44477E28192474

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\206932163209AD483A44477E28192474
Size 290B
SHA256 25fe36e6502f39a8d4bed87df3dde4f05311c9193da7a276c5c42f25c4bb1320
MD5 1aa649aad763c697b6674a399731a529
SHA1 7bf3b576d95c0290f60837abe96199768ebdf93f
SHA512 29dbd4c2d29609f71c8f2d5315fd2ca13aadaa2eb95551633530f7ff06b613396946733aa9a0e0d4cedaf83380ff6fe0be0d240dc772b19c96349e6e02604197
TLSH
T13CD05E2993B40711E141C67F59D41A23E979BC25865283850BF083497424D06B971353
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 556B
SHA256 5225323f16577596826af16076a022a4fe2100ddf70241bb6944b33a20bcec42
MD5 f67e5a2db9c7a102519d374e3f639fdf
SHA1 26fcbcc481418c25d6528497fc2b2d2575b7acee
SHA512 c65759cb351ca4d2da8a6852a0936202eb7239c503efce55eb6bdbfd46f39614c41f4f4698e7bbf879e1bb6b13ed7985cce9a675bfad4bac7416dc3bb985d09e
TLSH
T1EBF0593818FE8219E3772D398BD565BFEA36F21328481AAA665102865543E038DE131B
MD5 SHA1 SHA512 TLSH

Submit Download

86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC
Size 560B
SHA256 e95f5af59adce87642cd57e0570a4446ef4ebd839eb643396f90cfb5f9106bf4
MD5 3e0d67110aaba88d570e365d2000d812
SHA1 16787b787171947de7c226b1e6ea00017d1b9d76
SHA512 583c09f7d494a36ac87a7ced61938be65e5c4f0e19dadca167b5acdc42784f5ac11c169d3fcf31f7b48b7bae20aa8ce97a2f0fd11e27cc43513843f283164191
TLSH
T16AF0273C16F9422AF331EB3597EA599EB86DB01378196E5D009407590802B425D6233A
MD5 SHA1 SHA512 TLSH

Submit Download

EF7234CDBB1649702229F955C785C39F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\EF7234CDBB1649702229F955C785C39F
Size 308B
SHA256 35fb51b55367054d8d919bf80f4edb263dbae3c6b193a4d1ee58d388cef316f3
MD5 5303c312f774786450aff4f2e02f69ef
SHA1 c3955a5f3040dea5e75e505016107387e3f4c709
SHA512 b1be60995af6913d1a474003f116cc714ba562abdc6f2b65cc7f360903744790ac890515f48908303f40af7ab7164a5c4d56bca23135f444aad895bd6d7b3aba
TLSH
T198E05E1CE3F60A16F0C1CA3DA6E01967BA35AD658614C35507F0870D7828E41B932713
MD5 SHA1 SHA512 TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\AddinInstaller.dll
Size 35KB
SHA256 c0306045119da6aa284f77f5ae57e9a35ae473294ef6b983db909902ef860b65
MD5 077c50b05317268a4e84b0d8e18b7e25
SHA1 4e4320e74fb1d2ca46e38b7a5554547f8c0ea57f
SHA512 e61171028a7faef3e4545ddc1a6a0e9a0ba618c20db82d4cb32eae379710497b30fee3f165400ed93c2760e04c102889686a14d7f996b3664026c881e93024ed
SSDEEP 768:CJLtIDER3wlQ0Tkjb6PO59zeTzlU+9zZU:myARglQ7jQ4zeTm6zW
TLSH
T1E0F21891A7F84102FAFB6F706AB4E5422DB9BF875C70D92D1989E14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a50487ef016e1ce77b3875402e952e331c9e410a.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a50487ef016e1ce77b3875402e952e331c9e410a.tbres
Size 2KB
SHA256 691a2f09a85b9347a1533a1cc0637fff08b5b92d86cbdd3bf1818b2798d259b9
MD5 b51ef327469902c53352676dbb7715f2
SHA1 ddca719b648a6a76ecc1eee17589aeccbc91a2fb
SHA512 8450121f823fb1b0d686fd69099ba905a40f5097be593e38a09f5074bc808048b1943000f2cc09fc4b9eae75fae6a67a1162553059eaced58f0661150c713aa9
TLSH
T18C41185DA6FA1148B3B76E569BF6A96D487F7C332B0AD45E10010E4F0A22B00C9A1737
MD5 SHA1 SHA512 TLSH

Submit Download

a7e624d3a800058467350735a3c9b4df6502fd79.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\a7e624d3a800058467350735a3c9b4df6502fd79.tbres
Size 2KB
SHA256 5c24db783cb45a329611aec445ae0caf049e6d56f616d0682347e3d25d356482
MD5 85e3d422be1fa7273c80e07349b7a98b
SHA1 9c1324c0900237977e3917250209b06aca20936d
SHA512 47f61105a19b61d23255ce415338c20585abce4e8d72c9ea1b976b6f7da79df4790d3222768e29919c3e22adf64807a95760bea735557d41b1f31b15b9cf7a49
TLSH
T12141285CA6F91108B3B76B5AAFF2A86D447B7C772B46C45E10110E4F066774084A2B37
MD5 SHA1 SHA512 TLSH

Submit Download

baeae54df3400d002e036f586e0c785624c9121a.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\baeae54df3400d002e036f586e0c785624c9121a.tbres
Size 2KB
SHA256 d821aee199193fb37f0ae8fca9fd2bf650331c960995ab87f13bdc838ddb0dda
MD5 bbd98c440e8e473bf0229a66899f6bb9
SHA1 64247aae4346e3200d1c0aa3d1a66e5a170d4fee
SHA512 8e9577e2964231ea42708ddfe53d1c3600b2f1bb6070e2ec7457b9d413ecaea8e676f79be31094112ac742e699c751389daab288c1ee3bd96b46ec0e32d45658
TLSH
T115513858AAFA0118B3776F559BF6A89D887BB8732F07D48E10010E4F4623B41DC61B37
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 8b4281ceb6c297350b687634b4610f8fa7ffc1221e239057792dfe5034f9d492
MD5 6e1fbc92f28030a586790dd65dae1004
SHA1 b22f3af4b600ff1185f2bbe4fcf6e96751cd5596
SHA512 d6d11a71c3311be240471c482081544a9aae2417ae60218c31f43c200373d3a9cdf6eaa77501aacda9d2e5f98c7f32829a1d966956a057f9f99c0f0f901f4c8b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 f558bd60c2ee47264a124978c1d6c154b5a0fdfa95fec90c7c8d68c3eed3f43c
MD5 9354215d189159f23b418ea07690a0c8
SHA1 9c72c465ca06a240f2ad94e68d0d0526b97c4598
SHA512 e5ef5403c0272e2b3b911444dccc9583b48bcdc96391042bb12ac7257a67a478ad6957800be360d57c41143e0e617a500bdacec6bf64c2abe72c0e15a8fd3ffe
TLSH
T1EED0121236C24134C01030331412A1081A40C91B404A44456438869D5F040641912453
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Rules\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Sync Data\LevelDB\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 1KB
SHA256 b7a042d8be03ddd0294664a9c1bcd03faeb41b20943b1027d4b98cead251b8bf
MD5 1e59265a79e2ee503cf411f88405a36e
SHA1 aef2cd14bcee6efc1865f754631bef28f36ca833
SHA512 7af5b0b5592a81306268b2b27c3ab7493e8973015781e36b7219b23af8896723f8676c2f32302f451937f12f6f78b0d9b6f68ee6d7272c3c48619b5e9d47d079
TLSH
T1373140B2F5902B769C919246B2427B973F20117792A15E8CA1DE4B1D02DB6CC5237E3E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 b72f49dab3a2b58b344e972d2f2cb0ea009fac983a2453e4bd1f5ecd6f1abb0f
MD5 054551508c8c199dad629da9b5aa2316
SHA1 10549a668a7a75965f2cf7cde790080deb21ad45
SHA512 d9b2eca9084cb215e3d5005f9a6c23517a71c83bfcd05667bac8305691d0b8051daa63eb605f9b3dc270a6516521f40e7782051ea3ddf9416c5223a835e97c88
TLSH
T1DF519673B954577B89E28604B9453F126F3151629AA22F9895DD0B1C01DB2DC2313C3E
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 5f5d6f5e002bcedc74e91aa50ec672afb4ddb2f19772d4ed6aad1473297dbf8e
MD5 fd0bec70c3e69b88528dac6210bd1476
SHA1 c084a3b3f416d9849a9d34d3e0ca689414aa6149
SHA512 de3cacc3677c4e3cbbb00cd006f0a04b20b0d4a6d5edf062a300b82052e941c0b0a36863cddb8fa3b23fd76f6caca61ff5106d2f63f07dabee939e882ec4a16a
TLSH
T18B719433B9A4A62B8DF29A05B9853B127B615133E6D13F99C5ED0F0D01DB3D81312D2A
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 b58998682bdc47300d080dd137efab91dac6ff0f0a97e0ea25323e42ca7f5304
MD5 9b11dbbe8f8218391d93ed1c06b6f819
SHA1 ba0db43ebbdfc9d1838e4ba77c7610913918722b
SHA512 73a31bae78f97f814182cc2e3bbdf3b833e4bec91d4fd49043b80ab431c39fe25037e27d6680c7947e9609998b7e6b05a5833462e02d470dc1d38603b08fcbd8
SSDEEP 384:z5vsrvyOiyp4+IWA1eUVWGfvvLhNbZLv+A/y9r4g:F0raxyp4sQe6WGfv4A69T
TLSH
T181728D7117746A7B8CE2E84ABC8A2E167BD1852799C02FDCE1E55F0F018B2D8174691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe59a2ce.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe59a2ce.TMP
Size 1KB
SHA256 97f7250d7da360ea58f409be29e6eb5ad142c79a159cb891609b3e72d84a2603
MD5 6033454282a9f970fe80d2ed7cf3d47e
SHA1 b58e87f4322ef7ae2cb34f1f62c4c95496dbf3ce
SHA512 4873670d1136acbb5dbe6e62952ec5da28277bd331c3b53892ce01e1240065f5908ab20d8b2be2b8e7e786d5188063ca4f44294d3e02f3fb209b1693854fb98f
TLSH
T1A52132B3E4942777DD918146B2427B863E60517792615E4CA1CE0B1D02DB5DC5237E3A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 45086273b70baa014f729868e33b8afd16858e7097245f81f180e27e5c83bec7
MD5 4286ce1949bdc10263efbcb8cf289a69
SHA1 1546c402f1820feda9394802370b7d2e90cb4ffc
SHA512 82197a34dd547b723d6b62a679fb7ef05776c0712dba578e81dab4d699c9f62f44282720ceab130713040568ba0a0d1bef8cb97076d017ddf546cd2ad51e4f42
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 48625ec1e6d015a6e03904816cb66f89b732226032c656dd567ffeafe6650cd7
MD5 05b31217af277b1db8488c1036902ad2
SHA1 40d84322e42e9640653f57dbb2ac656340bbb254
SHA512 2f5aa1ede922da221a038f966340518d8da4960f25310066611be0a28f336c098570dc13a00bebc2bb156f42d31200c494a82f861c577cd121012764adb9b70b
TLSH
T17B310FA885ED6066DF9D157824207D729C070B2C02898B73B2FA293346F7DC050B61C5
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\wasm\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\index
Size 256KB
SHA256 3d3b34458b3415396ea795f1fde4a4df245a6ef59d111ba2a8b1995332215dd6
MD5 4c384f1f5dd35b37f6bb581d6343d783
SHA1 d024b72ffa5b03ef686c59e48f239a81f3c4b589
SHA512 ab33587ef319dd547510e18b92d5083eb07be0908e35f52e193c3c4bf0b44ec39913ade82ddea8d3515a1a53dfb023e15b1dfff3abda20bb106ee8af2c57a233
SSDEEP 3:LsOllllkll/lD9llt:LsUlEthlX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity
Size 523B
SHA256 687b1638340da10ed40b30bbd726934a768fa9e6c527c002cd5cd426c86674d1
MD5 6e458df29ca473b48d8f8ecd6e32ba0d
SHA1 55d83947c000a5e9462a15ce230c9efb79fa78ba
SHA512 e59268268a96cfa1099e12ce67f1775aa4e3efaa8ea6c12ca671d6d9a7d3269b1a69a2c72b6ee9ac0d6df4db26c0735ce6ac5614d82075c096df6712fdb79bb6
TLSH
T19EF050F351B9F85A94BC4DBB2C44BD165E77E0361085D4F4D962406C61406B70717023
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a4fb7.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity~RFe5a4fb7.TMP
Size 523B
SHA256 7cefe6ebab803a59c257a886bc01275b97092cd96f069ee943e310577d2566a3
MD5 ee053c7d2b66f993f0c91e8e24e46302
SHA1 4886387dd369d291245a7020df9ed36273e14a5a
SHA512 a69e88ab0a340100b3753ee03f8f33deccf50083ac5bc6a6a0f6bff2faebd785c14cad011e69a45d4cf88a6d205ea7b3e26c0174870dbdabbbd4c731ff8b7667
TLSH
T18DF050A35579F45BA4F40DBB2C547D155E7BE43640C5D0F4D5A3416CA0056B74717433
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences
Size 6KB
SHA256 028fab7dd551e78a82cf7108da484716579b0428e75a01f11850aa072f6bb411
MD5 90d5e8d7108788057f24d61b9828ae4e
SHA1 32a751bd07c5f4cd1cf39d8f472dc51c0905659b
SHA512 4e6ecdd2280383ac1b1fd8264f90632dd791f8ba30e84e97c6c651d0794d702db0c0c78a8e7e703aedc0fd148388c7e2bc727031585016144a6186bef3480699
SSDEEP 192:stBNGvfzZ8paRQ/S+WiFi/9ywd7xllKMC:stzgiz/VhwjC
TLSH
T18DE185539E24597B4CC7F619BA25FA56E7F610236AD00D98ABFCC71C04E66DC620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences~RFe5a40d3.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences~RFe5a40d3.TMP
Size 6KB
SHA256 fcc51c8920a86611cab84069b63f468983c3a81847619f128fe4588e4bdd565a
MD5 590b024114312f2b8e04370cc095fd7a
SHA1 127903971aa78d9fc12f106d536d6d7ae73e2adc
SHA512 6d881f9b2a9b0401a7b5596c816d5050615eb826e7720d9129179f8bd71a312f1b2aafcf26d037ccddb71f264cfaa8a8cd7f672fa44a62363df32ec8119fa6ea
SSDEEP 192:stBNGVfzZ8paRQ/S+WiFi/9ywd7xlrKM8:stz2iz/Vhwd8
TLSH
T1BDD174539F28697B4CC6E219BA25FA56D7F610226AD01DD8EBFDC71C04E62DC620780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\6c224ed2-4566-4cbf-b645-5cf857e3b5a5\index-dir\the-real-index
Size 96B
SHA256 d0462191b71a6fbf96545123585e7e2cf6b2c4cd462118e6c7dae7438d350670
MD5 87d0105d3b94b1d84732666324d7ac4a
SHA1 904572a8ff845e9aa6af4badf8cf4a02215a4196
SHA512 9c00032eb0664dee9e10469b40bc81af75e2ecad6fb0a067ac4e9a5abab5d185523d6f4b0ff426df922f225b599690859da5607572b31af6714d587a151adb29
TLSH
T12BB022080E30000AC00083BF28CB8EC0B33C2F0CCA03038AC3C083B88C2F30A00802A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fe2c.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\6c224ed2-4566-4cbf-b645-5cf857e3b5a5\index-dir\the-real-index~RFe59fe2c.TMP
Size 48B
SHA256 eccd4dd10f3601f8e14aaf740aab086eeb74abcd9e75c7f6464ede53dcc519e7
MD5 d38f37560874b889e9e9023e1a283e37
SHA1 2b2d07568202acaf568ea4d2d35eea136f6f3732
SHA512 78c28339334dd960d3b664a398b6517f72e1a9f12c9dcf9cacd8c3b06b38c3f887f2e329761df87fb2ca3de68d0491a8522bae392b2316a7ff93a89e7fb90e79
MD5 SHA1 SHA512

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ddb211a7-4ff7-4a35-a5af-7e83063c4651\73cb100cf1fe8262_0
Size 2KB
SHA256 7b9cab0a1c850a3a61db92855e8badd181c3eee5973dbef669d58a2edcc7c923
MD5 daa7972a0cf914cc315a00ddcec956c2
SHA1 957c789a474a6030077acce093b49da627c4d41d
SHA512 62bcc844369ee666d03d25c416ccd58bdad4c341e9c5677688d6dec91ec96009052497c08f861c640ace612ccfb064a97ee98b968cbc12541c187e891723ddf8
TLSH
T17B41C76740101C5FEBC25C98504D1E7466EBEB21B6CDEDEACEED193889254C9A12D831
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ddb211a7-4ff7-4a35-a5af-7e83063c4651\73cb100cf1fe8262_0
Size 2KB
SHA256 ad1572a8addcafb12e23aa3d17368d4d1cb9221d99c8d774b87ffad1bfc451a4
MD5 0a4f7c1c4f4ec3bd8b7443bb88714dcd
SHA1 2f9160748df1beafac17c4a5434943b6ae0104b4
SHA512 2093ee0b2b947d1371296abce5635026d8ae6f5d3b06506fb28d245801bde1c330b144d0ddc2c5e48994b4534da44bd8ae32b68492797d67c3f3edf2da8b7794
TLSH
T1D241D86B40101C5FEBC25C98504D1E7466FBEB21B6CEEDEBCEED193889254C9712E831
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ddb211a7-4ff7-4a35-a5af-7e83063c4651\73cb100cf1fe8262_0
Size 2KB
SHA256 3246a5675e6febd437cc98097fa43ff998a1461f540153963963e95dd156cf45
MD5 8f726a78614d736fbba345f6a58034ed
SHA1 68d8ffe748f9b1f9a64c04e1d3dce45737514d99
SHA512 19855afbe2d4829ede794b302311908dd53a013d51a12ed31bc7b326ce9f379bdb123cb9ac9797bcde06073aadd0307454224017ff6a4e5252973e3062c58eb4
TLSH
T14741D86B40101C5FEBC25CA8504D1E7466FBEB21B6DDEDEBCEED193889254C9712E831
MD5 SHA1 SHA512 TLSH

Submit Download

ad04bcd31c122994_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ddb211a7-4ff7-4a35-a5af-7e83063c4651\ad04bcd31c122994_0
Size 928B
SHA256 c47a18c578859ff25c098c36ca03eaf5f759e78b7fe912dc573389314316993d
MD5 00b8be47e1c05585510307151ea4e6d2
SHA1 0045a6576a49ef00b91883ba8a8f4a911b0cb68e
SHA512 fea5c5ceebc1ba5a49fc5af063b4fc8293620b4f0813b643716d2d6cf939c25e4dc8ed8588cdc8ddea848e5399617609e7999af3a4133e5395506fb508bf1561
TLSH
T1C4110A1605001C1FDE92ACB9900D1A7AA6FA9B55E1CEEDD9CDEC4A38DD550CDB12EC70
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ddb211a7-4ff7-4a35-a5af-7e83063c4651\index-dir\the-real-index
Size 96B
SHA256 efcd2f3c5f84274a1e25e9bf8c75e02fad095a0854006caae66908630c504b5f
MD5 a647ad11268e93a4fc4644ba702938e5
SHA1 8c4ff19c41d8cba931f6ed48ec4f2722dd6b30ce
SHA512 77ca690d955811b222918af4215cbcd4c1ae04091969574e1bb4bfe01749b98efe14ac9bc60d261c2e768654439c4522b640906b626c7f931aa8e0566dc70d51
TLSH
T1E6B022E028000002C00803F3AAC200C033BC0FFC0303032C02E0022FBCE23C082C0000
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59fee8.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\ddb211a7-4ff7-4a35-a5af-7e83063c4651\index-dir\the-real-index~RFe59fee8.TMP
Size 48B
SHA256 483d34ed733984b11fad5fa71a41dddbdfdf667d65ed53578313ff4aeff5cb8c
MD5 79fb5e1a453071c57ba8d7ab503f9c14
SHA1 98592f538f483ed240f9b4c902c46a9497ba4a4f
SHA512 5a24bb597eb0bb2d56dbef5d4a34fdb540d64fd5c12bc260985fa7a0bd6014fe12f82014529a97b945eb9ca0b5c6070421fe1f7b15fb65dbc9d18e41d17ff5ab
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 a61fbecb61d81a6ce17c99ef010088bcdc45d78efe1e5be4acbce68afefc4620
MD5 96083c7af3b0acee292865693535121b
SHA1 dc01ffd4093bf9a4e8a017ffb0d40cd542b674f7
SHA512 8eed362c2aef4ecaf174387f24d1f81d0f414972b127adc490769a58dc2fe7e513f98dbb1709e56091a55f0974d891fd65a6f9ec15c431bd50c7a82196e0d4ee
TLSH
T1D1D0A71B811408224B4855C0D1C0E4A6E08D4D0B9D5AE154EE87A814B97E5F1DE06579
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 56a18bdd821cec2a725264d1ea96dc6996201670164632d9d32bea6d446e5ef2
MD5 86c84cbe0c3e54fdb9e7c44f63daeeb6
SHA1 c892f344f912b93d8832cc1592e3a139bf0ac86d
SHA512 863d6682d5917884e4a4adc93f30e988152a06f4c554373f353b22d32e6fb73cd18ac4c39b4cd156ec2948cf05d4506967f0ff7bb2d298734dd43a1d5b853ddb
TLSH
T1CAE07D0741000C368B08088591C0D6D5D1454C1F8D81F160ADD2A808BD3F7E2DE064E9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 9a33f47c0eb15f87260935549f0397f7554fdc9932f0df006bbeff2a169d4e40
MD5 6703b67949f54c825a0877b0307ac78c
SHA1 3fbba60d22a0d7606d9d93de40195878fde5e62a
SHA512 c7022c7b15f126d14a9a3953da0b153288ddee403dd457874933de478368c992e29cdf9f96c9ee4753e623dc545df5af6689d35a0169b531180b4c86921add80
TLSH
T135D07D1785000C3A4F496480A5C0D6D5D145451F8A91F150ADD68C08BD3F6E2DE064BA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59a8b9.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe59a8b9.TMP
Size 141B
SHA256 17dec4aebc8d75fbd9754c8aa34e928a12de0f9f6863f5e8b29c04ebbe7c6078
MD5 7b263257bc7b21922dcc35dc6ac96fde
SHA1 34965ba3fa70173e11748505dbde2bb68c3f8c99
SHA512 6440cb939f0cb4c317e7766aadf772ea88f96a6048b617d44adbe6d9ae4d74f857c1e570479ebe11952f795c4d4c418819c168ae4a2eb2db43a57bb80f7d89b8
TLSH
T158C08C1F8104080A4B0494819180D416F00C4E0BCC42E494E88B7440B43E0E6B6139BC
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-05-22_05-48-20.00.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-05-22_05-48-20.00.log
Size 3KB
SHA256 d885c717d096ec93e8cba0bb212d28c365243471f1662608567fae6cdf336c89
MD5 8dad7f39d8194e35d49d8881f8eacbb6
SHA1 58667eec2b772966c5e98a175fdc621eb39d86fa
SHA512 9010818d92956711dbc557d98598c1c4acc96aa35dfcae2a25443f18e1e57ebbf347b11b66cfeb542b6375489b913b59571e81c6e1bc3e8ff893d6c84886ff2a
TLSH
T19561257993E680D5F44F285AE3103FB44BDBF88661D835B9BEF0BE4E4009121A9BD11E
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 a31a22fd34ea2a8e759e0fe916ce57ff983a57361335b92a309ca1c926615522
MD5 6a9b924a681c5e1be67e82959aa8f816
SHA1 53d5dc80aa81345075fbdc7195243c61d37c96c2
SHA512 7fecb89460958726a4a93a9b8e2ff0d942180246d442cdeffffdad4c006c336cbd651b992d1c597d1e7f7fa1bf42d855c1993fbaad7556d981ac4178477da8f9
TLSH
T1CF51C42C0514A2BEDDC7864BB55F3E234AE741A4EFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe599fa1.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe599fa1.TMP
Size 2KB
SHA256 9059aedae41985c3bea5574bb24bdfc779a81a7950b8e3d391c3b6c2486c5888
MD5 1dfd4312dabffb5d401c38fffe675cc2
SHA1 1aa7fe1743482b829a660e74791fddd811f2c5f3
SHA512 e10fb1041d771a8d79b900cb2ec7c226f1487b78c9909d53e91c512cf53332672c7a16108797ba3b3e280fb747ce2cc9594c6deb653a321d70f4642521d515ec
TLSH
T13C51D52C0614A2BEDDC7864FB54F3E238AE701A4DFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 cda5de01a116425db94edef9f87104872bce6965075cae4845e7411421e311be
MD5 19ba97765756e12d026647b263eb721c
SHA1 8b279b668223f5e5deb9fb32c07e193eb99c72a0
SHA512 440e6e423dc7a2594463e4d30c0fd38f373525994baa69af38a205a5f43bef67fcf72cba673dd0a7e3ffb05d0ddcad9df33bddd87e28543638f85a5daf61b138
SSDEEP 1536:roWSWmOX+MNv5ZBL3VNUBYDireji7YDereOrHd8v6Qj:KI55Viw
TLSH
T174A561A41845B6FDDB8AC2B9673C5F28B5FC4DB78C415025EACDEA0D30A346673138A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe59b6d3.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe59b6d3.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 4KB
SHA256 68976da10a68d732d697944e1a4d7cb7f118c15399f0ac2b5e9afa69ac568f09
MD5 24a9f12a90c378bfa27a476282d530b0
SHA1 670f00cffb5f132a8361e0a6723ec34a92a21580
SHA512 29c870995cb4c5c33486f4495e71ea84915c868faa52ead093e48dd96043523611da4b41b0d7e71ca6958198fe0bfef50e43537d9f1c543365f04ad46dad86b9
SSDEEP 12:KGk2W8C/qtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbf:KGZW8Sqt8VtbDBtDi4kZERDf
TLSH
T1D0810CC121B8B120E09A21BBC9B31366073E91A50433926B29B35892DCC188AE42A1FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 b09493ff5631b97156b62f6a256dea94026871e134b58dfc5366e74ee1a44ec1
MD5 ee3829f91161f0d494c075f484e157ec
SHA1 7db6ce13c060be0e49e5f334c0023004a4df9638
SHA512 1d23bc7612b745c2d78a73528668a3e20abbb19ea09d71da90da5f257bf691fd62b722a89704cd93bb0c951c7ad49ba809e85a6fa6c5b01fa4e3cc4d54dee060
TLSH
T111C02B160E1761330B540A00C5BBBCC2C1CE3C9701201860423AC04C0B186FF718060E
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 2f4215afd5d9872975dde91e3372dd4f3f50602a470afaa7613b079e1d8b8dc4
MD5 17c9d556afb336a308edc5f8fb9d7e7d
SHA1 8797779b51bbad1b58741b7b1925a1798f29ca50
SHA512 b4ee377bc0fb35015e991ddc3bd458e84d9892908548729bd30374e187ce134f4b9e4b54cbea4729ff1902da309acf8386faeec9f0fe6536f510da5e508f5a1d
TLSH
T1E3E0202A1D273BBB0B854604CD775EC1C6F9750D82A0808252BFCA9C071B1EDA280755
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 8d873e327d67ad1032b6343e2ed53a3d208519d9a31bf2a6781b8c74ca8122b4
MD5 70d98a4961108bbc862d4e80a023d1cd
SHA1 9a212dfe69577f10178bd0d261adcbc21524d742
SHA512 111875b3aa6a7a6c9f279c86c407eb5ca6158a3069488ce65d9e1cc2756c9be030737360c6295a71e030b0ec3d8f1f94ef4838ef56b49baee4579e30ffdaac65
TLSH
T187E0202A1D273BBB0B854604CD776EC1C6F8750D82A080C252BFC69C071B1EDA240755
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe599ec7.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe599ec7.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.4MB
SHA256 2446b85a1c001c0920ff8e218e5aae69224af54c53fac4f64c5cc02abb60b879
MD5 dcd93307ee04f60891886906340dac01
SHA1 5c04aece7475f893eb4821997f4ad7e783db49e0
SHA512 69821539b930ddeffb329180286a9250e874d5fdba05d5005b9feabb061caac64e437ae329e814515d455a32bf2ebb3c7ed25ae329f6c59df238ca6375a91789
SSDEEP 49152:cwpN1pVhhlk9u7CXGtZxRz9DT0gzq8UdYb0UnE:cwpJhlk9u/7TzJpxUNUE
TLSH
T145B55A10ABE88E2BE4BF1BB6B57101510BF6F9866772F78F160C60782E933548D52763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 9KB
SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
MD5 18cf95269eab6519867f9c240ea57c6b
SHA1 7026775355daf1cf1a49d380d7cdd7785a6278e0
SHA512 873c83d15803396a636a09349313f90e2a1a9aa8e1a41b474f898ec0b6580b107f3e3763e8e1613f8cb9d7c611a21762ce712824b68de9ae48be73425f045096
SSDEEP 192:FTaPIYtYvIOnHW+pYt6wRpy6/WVkiS3s20AbCWGShWMeqf4:Fl8YQO2+pQDfykakiS3pb/1tw
TLSH
T14212AE53DBC9B884A0509FF7AD8C201A670381554D6458DBF9BA34AB350603A7B6E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 75a613a30fc8e20d4edac1e7574655becd2a1e71dc95a29d4e688e33e55f3bb8
MD5 809831b9a888477fc5b7ef66cf718d6d
SHA1 d6efc2775815894a20ae150296b250e8a7201247
SHA512 ccc954a24287711d9b5e4ef35a829828b20f2f7af1f19abe58aaaabd1a5c90901502cd5920fc851250af5a94b256e6c2c39614626dd44fb9e0b25e91e57dc4fa
TLSH
T13E900455C57D13F7C1D0435D00445C775F5751715400C01CCD0714D5DDD11370040D74
MD5 SHA1 SHA512 TLSH

Submit Download

SQKqjgW3.ps1

Path C:\Users\Admin\AppData\Local\Temp\39QBoaFa00wu\SQKqjgW3.ps1
Size 43KB
SHA256 9f8e837a294b265a0ad9dfe3fa080b12311bb0e53f8ea0078535c6e9b74953a5
MD5 37073dd9d5333d2ac454a22a0f9eda77
SHA1 c6bc17dd38b3d2be301fe98a501d1ce9aacdf5ee
SHA512 c133eb3fb610c71dbc1cac003a37c4c0a66e8dbaf20216f5c9c7efc57b1e17d5956d3ebbdd5dc6462fb7f98be32e7980773ee422f5059f1baee5b3aa2e3adc36
SSDEEP 768:OhDMKL35RUzAhrxffESDzD5R3DiTHCoua21ZD2JNaPe9JPKe66/yPSxqjb6:6L35uMcSD5sTHCrTqNaPe9JyS4Hjb6
TLSH
T1EA13E127A91B94BC9E765A552642801CBB54EBDF70732CE5F598CAC231EEDCE40238E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VGIcF8yFH0YG.exe

Path C:\Users\Admin\AppData\Local\Temp\39QBoaFa00wu\VGIcF8yFH0YG.exe
Size 1.3MB
SHA256 a574173f6f46428bfbf852c9b9da1ed6ab4bdf11064fe719040ffffb271511be
MD5 205182ce5e6ed46f2d839064ddf4c7dc
SHA1 7a2804a7c37f47384fd17db42cc1a39b23924cec
SHA512 a6074b2ffae3272e512c66d38026a563c3722685fae5d305dd7295da3f373912ad0ad061a0df896f53cbcd7b5ed35d5db10adf0ef7272b657fe174c1271bb419
SSDEEP 24576:YmPjS7HX11V1/hpz4yF+sxtigrZ4Psb0iK7GO6L361scQm1wUnDAnEoOqd:l+31bxAsxb40o9gTYkm1ZnEnEG
TLSH
T11E5512127782C472D6B229324A68C672967DB9211F248BDF53D8165CCEB42C1CB36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CFGFAC1.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFGFAC1.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

RES9BAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9BAE.tmp
Size 1KB
SHA256 8a73c89a40d8ab21a8b7b0ada5140cdba9a982e91da9fb6cb5650d0f84ce819b
MD5 5958733205142ef79cabd59204196085
SHA1 882555cdc5c02def3717fcadf6820aea571d1373
SHA512 faee79d4f3e9ab02ca3f0648977ea745a5edf0e81653165ddac1de47b23326dc399f3e6fbd4e62cfd9693968620dbaa4283a6917fc2df82d5243f8a18720540d
TLSH
T1DD21AA0553E8431EF0734732AAFA071F9174FDA4EFA2535A894042282C40504EEE0BB2
MD5 SHA1 SHA512 TLSH

Submit Download

RES9D06.tmp

Path C:\Users\Admin\AppData\Local\Temp\RES9D06.tmp
Size 1KB
SHA256 d4dbb864174409e55fb8f04a01869e35b14224826b3288c78b037ce3114d1e6a
MD5 3283915b8bb91605f3dfa2a448454496
SHA1 d47b12d76e7e23dc44a364af22a8b89a698fc7d9
SHA512 d9d9e3b234503a5a2faa3e3abb0157774fc5cd336d35bc50d9a152d531feb6e4d6ea651b41670a7e2e070c7581c8b75e74997aa5e2ed5d73d88e2cca82fa5d3d
TLSH
T1D121CC0583ED471EF0732731A9F5132FA274FD64EFA1935A8840412C2C11108EEA0FB2
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_sh4itabn.ojc.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_sh4itabn.ojc.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

nov23jzv.dll

Path C:\Users\Admin\AppData\Local\Temp\nov23jzv\nov23jzv.dll
Size 3KB
SHA256 73efd05ac98d22b32f6ec59b819ea31afdc1f6a85732df5dab3d13b8d5244bfa
MD5 95e62dafb28463657fc359bb253bea6c
SHA1 da39c9899bdb3f171934193f1f8295613621414a
SHA512 de8472adc0e84f3ff44662cd25892efa5dbc4a2b5bfc0f1cfcd3b35b748115a8573f2ec314232f506bf824524a617ffa09465700995d6b24952cdf9e22cf2f11
TLSH
T14071DE1A93E8066BF0A707356FF7472677B4FC509F63975E4D80011DBC616600A71BB1
MD5 SHA1 SHA512 TLSH

Submit Download

xt4jqopm.dll

Path C:\Users\Admin\AppData\Local\Temp\xt4jqopm\xt4jqopm.dll
Size 3KB
SHA256 c840a0d8c6dee75033fc1c6b81e85b936895ccee388c13b22d7ea8c8f74c8bbe
MD5 e34c6379d351097996e19519365309e1
SHA1 32184c3c0a00d28a59382aafc55e808efe619575
SHA512 734d1601ed56e2f3599ff468f6299645cc20db9ec9e1f01a78fe69dd997cc86df57bdb803b9b37e335cd484502627c861debdab5c6f67878cba2c374cfae6190
TLSH
T1B551DD1697E8466BE4B75B346EF3035223B8FC109F77971A1D84026C7C617642D21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

MSI814.tmp

Path C:\Windows\Installer\MSI814.tmp
Size 113KB
SHA256 cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36
MD5 8fa4088a730b967d85df562fd5ef7d5e
SHA1 629db9229f4a4a691e14f38f4dbffba157fa1ce9
SHA512 1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2
SSDEEP 1536:xS8CWyksWMcdMWBpjr+UsgtFmVrrXL1MgbIurgnIMolaeB8DhIm+uBSw:xS8SgMq+jVrrb1MMBBMolzaDhI31w
TLSH
T19AB39D41BA908432D5FF2D3C1578DA621E3E79701FE09DAF175851B90EB43D0AB38E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFA07.tmp

Path C:\Windows\Installer\MSIFA07.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588fc8.msi

Path C:\Windows\Installer\e588fc8.msi
Size 1.2MB
SHA256 31e75e9b008b16b2ba7861082e6d80e18d2cc928153b395816ba353812e759da
MD5 82073ed5c2844a193911be73a2a68727
SHA1 4c1d23d040bd1c41bf87b935a76cce8ca0fda1dc
SHA512 8021948bc0925ce036780afe0ad12c118cfe052c2cfbc18783b5e4360e9e69dc8b88f50eecf9e79845532a9ee5e3b15ae99027a228ea46ac9da5dc84c2981e67
SSDEEP 24576:gQ19m+op2rY4yp+sJMvtMv7vfRYqp8O1TQy4e1SLXm1xUctK:D9m+HsJqz4f1sFkym1mct
TLSH
T11A4533A1730080E0DAC61D3AA445E316B87D9C592FA1C9C6C65FB2CCDF76BB0529F5E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e588fcf.msi

Path C:\Windows\Installer\e588fcf.msi
Size 13.9MB
SHA256 636115933ab2f678c8d9eaf50e79e47be094436d438565fa30b0f1ae3d7362f4
MD5 8444b913223f0ebe0d7eb0867ece55e4
SHA1 43028a51223cbea7b405b18be0a59b42f7777136
SHA512 a1617c7eab8ff2922e9ba1c4273db6917cca25d3ac886aa28ee59dee45f4dc0a406be0f5251a189fd589720635aeeba8781f0899fbd3cb080ed82ad3e7c7596b
SSDEEP 393216:PMyGsr31tl7C4WYe47SXsxbOLq5a38wnt9lTmr7:PM831jG47ZIsZOLq5a38wnFm
TLSH
T170E63353358AC932C2BA0A7826BB97556B7DBD254DF0CC0B5710BA4A2C723C01BB5F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.1MB
SHA256 c17a95bfaf888bb634d2b0a6addf017e56c4101a1f64ee5522ae19158eeefc5e
MD5 b6971c29960a8da5fe80ddc6b0f32ffa
SHA1 b717019b3e4f4b3a1b1b3ccce578a0b68bad7cd2
SHA512 14ab2c5c32605d6d5476deb30afdf8d7f59ad29fd44ab7147784f80fda92de05ca3952fa3088cd7287e969eff6abc57e1324e8d026f66f18d4208eb9bde9ba46
SSDEEP 24576:0u8m+1zYdoO/vvTLL2L+ema/qCkTzFbC39md5k6lT0aKusyWYvFCztAhO:f
TLSH
T1BF47C52476F92100E7F79E3CACF06A2359397D5B9C19EE8D05411F4E0922BB1E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{3114bf8a-4544-43f0-8320-b22523cf6f8d}_OnDiskSnapshotProp

Path \??\Volume{4588d6e0-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{3114bf8a-4544-43f0-8320-b22523cf6f8d}_OnDiskSnapshotProp
Size 6KB
SHA256 ba0787185979a92b41e2547308be7721528bd0935b9ee1c73c120fe99b951998
MD5 f740467d00f439455363067589189df6
SHA1 4155971b6731a3bb540688f33ab602a3aae74a4c
SHA512 829c0a35936dad668ea41e9625f238bbf4dc03c6b24fcbac76ed508a3ded0969489ea17f3662cb9389261c49decd995163d64cf6a2555303e2c7313641bac3c1
SSDEEP 96:FVUBAnvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:7Fb++ZVmN
TLSH
T1FCD1A8085AF54711E2B3AB3128F18557A877B911EF33CB8E0298238E2671A10F835F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CSCA1ADCABA3A6A466585B315FB63D177D.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\nov23jzv\CSCA1ADCABA3A6A466585B315FB63D177D.TMP
Size 652B
SHA256 4f39882be8700084324a66b5d7e5522d253724aa5122f26707d8a82b94609419
MD5 5942eec568e82b1f58c9a95f84ed4cf5
SHA1 21d9e8d786ee194bc2ae19528abce0ba8783e23d
SHA512 f97599c27171a840e9adc96d804d4f4fb1bdaa0a62950683899472bccd908e792185191adeed3704820caf389224670c75650455711d88d056a80372eea63184
TLSH
T15DF0540963F8020EF0F34B30BDF5436391A8BCA5DE3253ED54800319186451096B1FB2
MD5 SHA1 SHA512 TLSH

Submit Download

nov23jzv.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\nov23jzv\nov23jzv.0.cs
Size 571B
SHA256 cb2e610345ebe0a15a0399f07b7a919e5f77b1689a523c80e531539c965e4e0d
MD5 d9ba7429abb22c214518d431d33588d5
SHA1 2ace9c25bbc4ab5ee2ef641e86af4f8c51f4c561
SHA512 c33db25eff6d38e8dc97dbb518d25f16597df4d7c085b27a4946b0e3c91740cda4c49c9bb7c197c35cf3377048aa080e7da6569e1bd9dbf31bfb8bce0a972e55
TLSH
T1DAF0F63457CFED6518D24425AC99E49C457702291279BC50F6FF1322DE8720472722A5
MD5 SHA1 SHA512 TLSH

Submit Download

nov23jzv.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\nov23jzv\nov23jzv.cmdline
Size 369B
SHA256 ec44d8fa1273fd5c295ec4c967e91e5d87ab1733adf736bc08af3aca9c496b15
MD5 852ae1dd896efe2887f6de46e3b604fc
SHA1 a852a529ef6a9b778166ee9c2757762b96d0a26a
SHA512 1b67e8ea46e43a5b2cf255914f5fdc20135b02e0c0ae127e7cbef56b3d9aa2550f4ab9b5938ea7e09d94bf31630c308f228daec3bfd242fec60f8590db08b826
TLSH
T1B8E0C02A42CFC2BE01DF1207236EC4ACC2B2478329507FC49080C48DE2178002BF1741
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1AD1E61841A34516B217266AC0A65A7A.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\xt4jqopm\CSC1AD1E61841A34516B217266AC0A65A7A.TMP
Size 652B
SHA256 a173ea25222e3ed8750deddcc61d71ef8fbb972619e3361a6d28bf411af33e4f
MD5 cafbfb742eac2e6e1401058d10e0a00a
SHA1 2317cf55ab8af2cfc1e6735962d949b31bfcd64c
SHA512 a0d0b9016f5a98c059e7f28dcec361cbb6bec69313e1c87a9989812d5a0c06bbc23a1743bd76fa9c13a2f83c6f17cb9a084a362953be02265463338047593cb5
TLSH
T1C5F05E0967FC520EF0F35B30BEF6936391A8BC64DE3293ED2850132D28645148962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

xt4jqopm.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\xt4jqopm\xt4jqopm.0.cs
Size 54B
SHA256 662247a7818fb3714e25460a8fba0d58bb6b1811813de2ae604e2ce87c3c0058
MD5 d933553db0bda098a207f24940b56955
SHA1 669223944f2befe4828e61274299c2a813e2d0b1
SHA512 ef54a056ea8f2ba9d6bdfefd631ff642fd30b0fe69d1ef02fe0157cc90e4fb3ecea59ef5632dd556f757cfccb3a5f907e147294f5c458a8fe9461eb0a0ddac1e
TLSH
T14090021C8304552C51D541096DB4F0470C72611E1264A808A84713415D8D090B2793B2
MD5 SHA1 SHA512 TLSH

Submit Download

xt4jqopm.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\xt4jqopm\xt4jqopm.cmdline
Size 369B
SHA256 d4ea47daeef0f3d865dfdbf02cc3e68c7320236d48ca1195070987d09ee714b2
MD5 60552414cd91d58dacc4ef4437ac73bf
SHA1 91db596674c6e43abd7f95ad08f20acff4b3443a
SHA512 cbf526e140497a7fea5f66f5c8cc5ce81e7420078af194a96d95ad6d78ea09c0acc57992c51b7c6a65520505e563d8bb3bcf9283a985847264e674e1e949540c
TLSH
T1D0E0C06F4386C27D19DD1607297AC4FCC3720F436A813F9460844C8FD13704027D2742
MD5 SHA1 SHA512 TLSH

Submit Download

memory/744-196-0x00007FFF44140000-0x00007FFF44141000-memory.dmp

Download

memory/3420-69-0x0000000005E60000-0x0000000005E6A000-memory.dmp

Download

memory/3420-70-0x0000000005F30000-0x0000000005F96000-memory.dmp

Download

memory/3420-72-0x0000000006620000-0x0000000006B4C000-memory.dmp

Download

memory/3420-67-0x0000000005730000-0x000000000574E000-memory.dmp

Download

memory/3420-66-0x0000000000CA0000-0x0000000000F02000-memory.dmp

Download

memory/3420-105-0x00000000077F0000-0x0000000007816000-memory.dmp

Download

memory/3420-112-0x000000000CE40000-0x000000000CE78000-memory.dmp

Download

memory/3420-113-0x000000000CE20000-0x000000000CE2E000-memory.dmp

Download

memory/3488-101-0x0000022452410000-0x0000022452418000-memory.dmp

Download

memory/3488-65-0x00000224390A0000-0x00000224390C2000-memory.dmp

Download

memory/3488-88-0x00000224390D0000-0x00000224390D8000-memory.dmp

Download

memory/3612-214-0x00007FFF44CD0000-0x00007FFF44CD1000-memory.dmp

Download

memory/3612-215-0x00007FFF43530000-0x00007FFF43531000-memory.dmp

Download

memory/3612-713-0x000001F619910000-0x000001F619940000-memory.dmp

Download

memory/4424-965-0x00000000026B0000-0x00000000026BA000-memory.dmp

Download

memory/4424-978-0x0000000002860000-0x0000000002872000-memory.dmp

Download

memory/4424-979-0x00000000048D0000-0x000000000490C000-memory.dmp

Download

memory/4424-961-0x0000000002670000-0x000000000268A000-memory.dmp

Download

memory/5472-332-0x00007FFF44140000-0x00007FFF44141000-memory.dmp

Download