2beb8a14b12d6bea42e2d1ca643bf54d79b0e0ad998fa9bc0891df99bca198dd

Analysis

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
_2beb8a14b12d6bea42e2d1ca643bf54d79b0e0ad998fa9bc0891df99bca198dd.msi
Size 1.2MB
Sample260522-fdvnaaev8j
SHA256 2beb8a14b12d6bea42e2d1ca643bf54d79b0e0ad998fa9bc0891df99bca198dd
MD5 a9dc8d5a17ca70c7ab9fc80ca7312dd2
SHA1 60f768f1126435e8573e971c9e17fff99f03c63d
SHA512 08031f771d2ebb78550aafb12bfe76cdb24dc07d5a03c293291ed8c1fadbcfe1e1e9d3eae33c10b941101aaaba324dd69251ccd3bdd4f0a0f61879b1fc8b3f0f
SSDEEP 24576:96S53tcfXVgpc4yC+sxi1jhAXoOjsIp74uuAUv1W1vm15wn10Z:96SVtgXsxi1jhA4hIp8lHN0m16nG
TLSH
T1454533CB231101A1EA069A30A44AC1F1F6BCDF617A438287A587BBDD39B67D4C74F9D4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

adware defense_evasion discovery execution persistence privilege_escalation ransomware spyware

Malware Config

Signatures

Badlisted process makes network request 13 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	4768	msiexec.exe
3	4768	msiexec.exe
4	4768	msiexec.exe
5	4768	msiexec.exe
6	4768	msiexec.exe
7	1240	msiexec.exe
8	1240	msiexec.exe
9	1240	msiexec.exe
12	1216	powershell.exe
13	1216	powershell.exe
16	1216	powershell.exe
68	1216	powershell.exe
71	1216	powershell.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1216	powershell.exe

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 2 IoCs

pid	Process
1068	IKfH5k0jt6ZN.exe
5260	Update.exe

Loads dropped DLL 6 IoCs

pid	Process
5408	MsiExec.exe
5408	MsiExec.exe
5408	MsiExec.exe
5408	MsiExec.exe
5408	MsiExec.exe
5408	MsiExec.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\Updates for Microsoft Teams v0.1016497447 = "powershell.exe -WindowStyle Hidden -NoProfile -EP Bypass -File \"C:\\Users\\Admin\\AppData\\Local\\Temp\\apWpZqQk69j9\\7I2kmeF5.ps1\" 86rxb7CgjEM6TbShvM3xWmfF/1C1YbLtoAjdiucVSB+JK571csM= 86rxb7Cg97ifDgd0bF/A9ku04ReSVQ=="	powershell.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe

Hide Artifacts: Hidden Window 1 TTPs 1 IoCs

Windows that would typically be displayed when an application carries out an operation can be hidden.

defense_evasion

Hidden Window

T1564.003

pid	Process
2728	cmd.exe

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Drops file in Windows directory 26 IoCs

description	ioc	Process
File created	C:\Windows\Installer\e58a40b.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC5F38F69A929598D.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFF8E5850A59AFAE95.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA6E9.tmp	msiexec.exe
File opened for modification	C:\Windows\SystemTemp	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\MSI6904.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFE2833E7846FB4530.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\SystemTemp\~DF697AA1F5BEB37B73.TMP	msiexec.exe
File created	C:\Windows\Installer\e58a40e.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a40e.msi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF0B7AADCA30036738.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI749E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI774E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A28831BE-8816-4C3F-AFEF-9946A38116B9}	msiexec.exe
File created	C:\Windows\SystemTemp\~DF54AA1BC04773BD10.TMP	msiexec.exe
File created	C:\Windows\Installer\e58a412.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFBA511C5AB054E834.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\e58a40b.msi	msiexec.exe
File created	C:\Windows\Installer\e58a40d.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF5E7AF3B4AF4EBE45.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6587.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI6663.tmp	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
4768	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	IKfH5k0jt6ZN.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000ab511af7d208ca820000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000c01200000000ffffffff000000002701010000080000ab511af70000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d01200000000000020ed35000000ffffffff000000000700010000680900ab511af7000000000000d012000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff350000000000000005000000ffffffff000000000700010000f8ff1aab511af7000000000000f0ff350000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0ff3a0000000000000005000000ffffffff000000000700010000f87f1dab511af7000000000000f0ff3a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Checks processor information in registry 2 TTPs 24 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\user\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedgewebview2.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134238988574486389"	msedgewebview2.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\UserEnabledStartupOnce = "0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\CLSID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.08901, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TeamsAddin.Connect.1\CLSID	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\AdvertiseFlags = "388"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\msteams\shell\open\command\ = "\"ms-teams.exe\" \"%1\""	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TeamsAddin.FastConnect\CurVer\Description = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TeamsAddin.Connect\CurVer	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\ = "AddinLoaderLib"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Key created	\Registry\User\S-1-5-21-226940941-599731907-2645636698-1000_Classes\msteams\shell\open\command	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\msteams	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TeamsAddin.FastConnect\CurVer	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\ProductName = "apWpZqQk69j9"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\Version = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\SourceList\PackageName = "_2beb8a14b12d6bea42e2d1ca643bf54d79b0e0ad998fa9bc0891df99bca198dd.msi"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\msteams\shell\open	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TeamsAddin.Connect	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Runtime = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.08901\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\EB13882A6188F3C4FAFE99643A18619B	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\InstanceType = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ = "FastConnect Class"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TeamsAddin.FastConnect	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}\	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\SourceList	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\ShowNotification = "1"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\EB13882A6188F3C4FAFE99643A18619B\SourceList\Media\1 = ";"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-226940941-599731907-2645636698-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Codebase = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.08901\\x64\\Microsoft.Teams.MeetingAddin.DLL"	msiexec.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1240	msiexec.exe
1240	msiexec.exe
1216	powershell.exe
1216	powershell.exe
5892	ms-teams.exe
5892	ms-teams.exe
5892	ms-teams.exe
5892	ms-teams.exe
1240	msiexec.exe
1240	msiexec.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
2088	msedgewebview2.exe
2088	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4768	msiexec.exe
Token: SeSecurityPrivilege	1240	msiexec.exe
Token: SeCreateTokenPrivilege	4768	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	4768	msiexec.exe
Token: SeLockMemoryPrivilege	4768	msiexec.exe
Token: SeIncreaseQuotaPrivilege	4768	msiexec.exe
Token: SeMachineAccountPrivilege	4768	msiexec.exe
Token: SeTcbPrivilege	4768	msiexec.exe
Token: SeSecurityPrivilege	4768	msiexec.exe
Token: SeTakeOwnershipPrivilege	4768	msiexec.exe
Token: SeLoadDriverPrivilege	4768	msiexec.exe
Token: SeSystemProfilePrivilege	4768	msiexec.exe
Token: SeSystemtimePrivilege	4768	msiexec.exe
Token: SeProfSingleProcessPrivilege	4768	msiexec.exe
Token: SeIncBasePriorityPrivilege	4768	msiexec.exe
Token: SeCreatePagefilePrivilege	4768	msiexec.exe
Token: SeCreatePermanentPrivilege	4768	msiexec.exe
Token: SeBackupPrivilege	4768	msiexec.exe
Token: SeRestorePrivilege	4768	msiexec.exe
Token: SeShutdownPrivilege	4768	msiexec.exe
Token: SeDebugPrivilege	4768	msiexec.exe
Token: SeAuditPrivilege	4768	msiexec.exe
Token: SeSystemEnvironmentPrivilege	4768	msiexec.exe
Token: SeChangeNotifyPrivilege	4768	msiexec.exe
Token: SeRemoteShutdownPrivilege	4768	msiexec.exe
Token: SeUndockPrivilege	4768	msiexec.exe
Token: SeSyncAgentPrivilege	4768	msiexec.exe
Token: SeEnableDelegationPrivilege	4768	msiexec.exe
Token: SeManageVolumePrivilege	4768	msiexec.exe
Token: SeImpersonatePrivilege	4768	msiexec.exe
Token: SeCreateGlobalPrivilege	4768	msiexec.exe
Token: SeBackupPrivilege	2568	vssvc.exe
Token: SeRestorePrivilege	2568	vssvc.exe
Token: SeAuditPrivilege	2568	vssvc.exe
Token: SeBackupPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe
Token: SeTakeOwnershipPrivilege	1240	msiexec.exe
Token: SeRestorePrivilege	1240	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
4768	msiexec.exe
4768	msiexec.exe
5260	Update.exe
5892	ms-teams.exe
5892	ms-teams.exe
5892	ms-teams.exe
5892	ms-teams.exe
5892	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
5892	ms-teams.exe
5892	ms-teams.exe
5892	ms-teams.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 5996	1240	msiexec.exe	84
PID 1240 wrote to memory of 2728	1240	msiexec.exe	86
PID 2728 wrote to memory of 1068	2728	cmd.exe	88
PID 2728 wrote to memory of 1216	2728	cmd.exe	89
PID 1068 wrote to memory of 5260	1068	IKfH5k0jt6ZN.exe	90
PID 1216 wrote to memory of 5216	1216	powershell.exe	91
PID 5216 wrote to memory of 5336	5216	csc.exe	92
PID 1216 wrote to memory of 2556	1216	powershell.exe	94
PID 2556 wrote to memory of 3548	2556	csc.exe	95
PID 5892 wrote to memory of 2088	5892	ms-teams.exe	101
PID 2088 wrote to memory of 5116	2088	msedgewebview2.exe	102
PID 2088 wrote to memory of 3056	2088	msedgewebview2.exe	105
PID 2088 wrote to memory of 3056	2088	msedgewebview2.exe	105
PID 2088 wrote to memory of 3056	2088	msedgewebview2.exe	105
PID 2088 wrote to memory of 3196	2088	msedgewebview2.exe	106
PID 2088 wrote to memory of 648	2088	msedgewebview2.exe	107
PID 2088 wrote to memory of 648	2088	msedgewebview2.exe	107
PID 2088 wrote to memory of 3508	2088	msedgewebview2.exe	108
PID 2088 wrote to memory of 3508	2088	msedgewebview2.exe	108
PID 2088 wrote to memory of 3508	2088	msedgewebview2.exe	108
PID 2088 wrote to memory of 2332	2088	msedgewebview2.exe	111
PID 2088 wrote to memory of 2332	2088	msedgewebview2.exe	111
PID 2088 wrote to memory of 2332	2088	msedgewebview2.exe	111
PID 1240 wrote to memory of 5408	1240	msiexec.exe	112

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\_2beb8a14b12d6bea42e2d1ca643bf54d79b0e0ad998fa9bc0891df99bca198dd.msi
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4768

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Badlisted process makes network request
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  PID:5996
- C:\Windows\system32\cmd.exe
  cmd.exe /c start "" "C:\Users\Admin\AppData\Local\Temp\apWpZqQk69j9\IKfH5k0jt6ZN.exe" & powershell.exe -NoProfile -WindowStyle Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\apWpZqQk69j9\7I2kmeF5.ps1" 86rxb7CgjEM6TbShvM3xWmfF/1C1YbLtoAjdiucVSB+JK571csM= 86rxb7Cg97ifDgd0bF/A9ku04ReSVQ==
  2⤵
  - Hide Artifacts: Hidden Window
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Users\Admin\AppData\Local\Temp\apWpZqQk69j9\IKfH5k0jt6ZN.exe
    "C:\Users\Admin\AppData\Local\Temp\apWpZqQk69j9\IKfH5k0jt6ZN.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1068
  - - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
      "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=IKfH5k0jt6ZN.exe --bootstrapperMode
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Modifies registry class
      Suspicious use of FindShellTrayWindow
      PID:5260
    - - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.7.15&instExecTime=1779425247695&launchSrc=t2installer
        5⤵
        Adds Run key to start application
        Checks processor information in registry
        Enumerates system info in registry
        Modifies Internet Explorer settings
        Modifies registry class
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        Suspicious use of WriteProcessMemory
        
        PID:5892
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,BreakoutBoxPreferCaptureTimestampInVideoFrames,msWebOOUI --enable-features=msSingleSignOnOSForPrimaryAccountIsShared,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --mojo-named-platform-channel-pipe=5892.3468.7508344399910659027
        6⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Modifies data under HKEY_USERS
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:2088
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=132.0.6834.160 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=132.0.2957.140 --initial-client-data=0x15c,0x160,0x164,0x138,0x16c,0x7ffdd01eb078,0x7ffdd01eb084,0x7ffdd01eb090
        7⤵
        
        PID:5116
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=1700,i,11074542706001161081,4102864726986797349,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=1680 /prefetch:2
        7⤵
        
        PID:3056
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2008,i,11074542706001161081,4102864726986797349,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2020 /prefetch:11
        7⤵
        
        PID:3196
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --always-read-main-dll --field-trial-handle=2292,i,11074542706001161081,4102864726986797349,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:13
        7⤵
        
        PID:648
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3760,i,11074542706001161081,4102864726986797349,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3800 /prefetch:1
        7⤵
        
        PID:3508
        
        C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\132.0.2957.140\msedgewebview2.exe" --type=renderer --string-annotations --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26106.1911.4707.3286 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --always-read-main-dll --field-trial-handle=3816,i,11074542706001161081,4102864726986797349,262144 --enable-features=PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TerminateServiceWorkerWhenIdleIgnoringCdpSessions,msWebView2TextureStream --disable-features=BreakoutBoxPreferCaptureTimestampInVideoFrames,msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version --mojo-platform-channel-handle=3856 /prefetch:1
        7⤵
        
        PID:2332
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID a9335627-5f38-420c-ac07-419b86f23676 -Trigger SchedulerDirectLaunch -BgTaskDelay 5610
        6⤵
        Checks processor information in registry
        
        PID:5808
      - C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID a9335627-5f38-420c-ac07-419b86f23676 -Trigger EnsureTmaAtStartup
        6⤵
        Checks processor information in registry
        
        PID:5760
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    powershell.exe -NoProfile -WindowStyle Hidden -EP Bypass -File "C:\Users\Admin\AppData\Local\Temp\apWpZqQk69j9\7I2kmeF5.ps1" 86rxb7CgjEM6TbShvM3xWmfF/1C1YbLtoAjdiucVSB+JK571csM= 86rxb7Cg97ifDgd0bF/A9ku04ReSVQ==
    3⤵
    - Badlisted process makes network request
    - Command and Scripting Interpreter: PowerShell
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of WriteProcessMemory
    PID:1216
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\2khzn25g\2khzn25g.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5216
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAB00.tmp" "c:\Users\Admin\AppData\Local\Temp\2khzn25g\CSC1089902572BB47B6A357EB9775539A5.TMP"
        5⤵
        
        PID:5336
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\gtnijduc\gtnijduc.cmdline"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:2556
    - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESAD04.tmp" "c:\Users\Admin\AppData\Local\Temp\gtnijduc\CSCA641AD477D6C4047B25F1A08AD4BF9B.TMP"
        5⤵
        
        PID:3548
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding BC2C14261538040210C1BB416B8A8E57
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:5408

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:2568

C:\Program Files\WindowsApps\MSTeams_26106.1911.4707.3286_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Installer Packages

T1546.016

Defense Evasion

Hide Artifacts

T1564

Hidden Window

T1564.003

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e58a40c.rbs

Path C:\Config.Msi\e58a40c.rbs
Size 7KB
SHA256 490dc8940306c3ddc2e58e8e6be74264568914feb9b828d1c277514c2b8be8de
MD5 bc27658793d641a2483be9ce43fe5de2
SHA1 b76718f5da9165953dd446032dc7766b7d688e12
SHA512 14db48c2e71eb507b13cb7a6015362d33f245057b9cd069b5d717a87acf63cc7cc7367ff1b9aac8a4a46c9064c3afc3459e0cb55693e7f6e61bc13d07a23fc53
SSDEEP 96:3WRCWrmrZmr0CnDQ5UyM4COThqSUyM4CgjIc5zVThqTHek5wPWjKHJCVpljIe5+H:3k1EZE0CsyFPGYFPD2Y6sVp6N
TLSH
T1C0F10D517B0085E2ED961B30C7831BAA7BB2C7CDA249234F598E51242F9339D5F943BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a411.rbs

Path C:\Config.Msi\e58a411.rbs
Size 357KB
SHA256 c18b885482db591c979d3ff9233f48d2a4cd31d0a7734c78d04433a215b67389
MD5 c37aa7f680cda8e96209f36c51ca208b
SHA1 bd1e2721c549828b22a98e2957630088f9e76aed
SHA512 d8f0bc3c759c401aac98e5f68355edf814f54bd6b41ffa7a6ef641bf31327ed4c24004a315232dcf271e8777cf987fda44227e1c3a3ed486d28769cec0902135
SSDEEP 3072:ze0z/XLS8SgMq+jVrrb1MMBBMolzaDhI31rS8SgMq+jVrrb1MMBBMolzaDhI31FJ:ze0zzpkp11exMpkp11ex8
TLSH
T1B6745B12AB81D9B5D87C353602717A8E703DFA634AC0BE5F8740C66C4F5A7E8E758E42
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560
Size 5B
SHA256 bebe2853a3485d1c2e5c5be4249183e0ddaff9f87de71652371700a89d937128
MD5 5bfa51f3a417b98e7443eca90fc94703
SHA1 8c015d80b8a23f780bdd215dc842b0f5551f63bd
SHA512 4cd03686254bb28754cbaa635ae1264723e2be80ce1dd0f78d1ab7aee72232f5b285f79e488e9c5c49ff343015bd07bb8433d6cee08ae3cea8c317303e3ac399
MD5 SHA1 SHA512

Submit Download

206932163209AD483A44477E28192474

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\206932163209AD483A44477E28192474
Size 27KB
SHA256 224d810b30fcbcd100aa265d553f79ceb36b6d49ff4897195c5160e6d517a190
MD5 6f299e2f4f8ec1deaa35931aa07c25b2
SHA1 0754e2b70e441f6696910430e73b1b952b9102eb
SHA512 6134d223defb3697b6227c2901d470a922816a954151ca463eccab4a8ab59dac28081e0408e01b58d516414014eeb9c240e1dfde48c283a27c568c247af159a4
SSDEEP 384:9WH+EEf/CkcowQlIlWjZPWQaP7ABEpCnR+6/YQHRQ942t7ZDFjgRs:ceEESk4QlFYBAuUg6/xWt7ZDF5
TLSH
T17DC2C4BC984C36AB91C56A71CD9B8F97DCB144A53B92F00F06A15FC81422FC6CEE56C6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 2KB
SHA256 f5ef1221b47ca29d31756c83ab42ba0976500aaecc62233face13863bbaa5af5
MD5 91810203a7bd657d47f9bc222ed7c475
SHA1 69fc6f18970365ecc7e494da82a2ac01f8dd9b8b
SHA512 fc398ada5a1bd1ee83cb4173eb41ef9b5020edd40afddfae21b317a90c108b7e98a01ec84b60f5dc46fddcf0146b7b371cfd81d5bcf64d916ea5a2098d5f8516
TLSH
T1A841D5474D3D2003EF86FAA6EAC590B924F4CF621C006F772623A258942E7A0F20925D
MD5 SHA1 SHA512 TLSH

Submit Download

86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC
Size 2KB
SHA256 71b923ef578748cb9bb100732f430603c0e831f30e21682e6ce564d89336f58d
MD5 9eb1c446d163dd727f7bad26556c21e6
SHA1 ed95f921865907e39185bd369c0559e1630f5828
SHA512 8e57fe56afd30bedc7fc726dd7e447d2be08bee999a13cd773ba8f2cead04a650ae5687db5d557f926943d01c5d6210e9fd61f0d5e48794911889ccd93a7ba7b
TLSH
T18541E8AA936C70A3682119039BE8D7773E3D8BD705A41340747698391017FF77E09C69
MD5 SHA1 SHA512 TLSH

Submit Download

0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0E663C78920A8217B4CBE3D45E3E6236_8EE09220BFB44D3E004DBA14287F1560
Size 426B
SHA256 95285a5cf787e16f7684d102a12f96169680d0cb70b1a8d9ce3d6facdd08e1f4
MD5 bba8457cdb22d96a7a1b0d3536011431
SHA1 7b27a5aa18380d4e78084480eaf318f33101a030
SHA512 948bfe214e5d0f9f2cfa336a77defe4f334521af9ce35e9397104802d3829c95748a50e74f8df42a07994ebf2272f2868cf5a952ae3c1c5d5e39d3814ce99dd8
TLSH
T19DE026246AFE8256F372ADF80BD9A225967FF062146867F2126005966A01D00ACA2727
MD5 SHA1 SHA512 TLSH

Submit Download

206932163209AD483A44477E28192474

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\206932163209AD483A44477E28192474
Size 290B
SHA256 d26debdcafbe06ddb77005bffc9db90cdd6224d18e64b19e5739d0b50fbb468e
MD5 e25b1b197e45b13a458faedcb82c7c51
SHA1 2e93e0147d06aa27d3d5f4c97235bb80b2fddba7
SHA512 b6c38938c61cd3e03df5b31c84f0a76ad0c081732ee534acecf144da039c3cba3fb94bfa98918f95cb34bd76826838b4e165ef773360b051a582fea255ac3705
TLSH
T1F9D05E29A3B40712F041C77F5DD41A23E939BC25865283850BF083493424D06BA71353
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 2a8dc70516c02888284215dd99752ad046e00192ee41eee3266e58c35b39aa30
MD5 7cccfb544641687083a4737c69b4e67b
SHA1 965517e5f17e4d1ab2837b2fb2006784165dc894
SHA512 336fc1fb9bbb7618679c74dcfd9f4f19b9bd466f52de8becbbe198283019f0049d25ab6ca84d69022f1aa117bac917a3f59ebeda68cdbfac3b048208380f7699
TLSH
T1AFE0C2213FA80604F5330B3C6C37A844AD3AB62B6E21CACD2674009C1C35FA1DA3232E
MD5 SHA1 SHA512 TLSH

Submit Download

77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77003E887FC21E505B9E28CBA30E18ED_8ACE642DC0A43382FABA7AE806561A50
Size 556B
SHA256 dd27fcc8435f9fd9f624984cea1e37fca25611844df2815cc5d60fd034199619
MD5 c74849f9cfc6e50bd6479eaa6b77a863
SHA1 9d0749060eb1d116a1ab06599acbf2baa765ba05
SHA512 7ff29093b1efc0a46667da6cbf041780a4948cdebc0e2020a82264c9f53e6b321b6147a9d35697e2fd91892a02b02fe44ca3be86e7440adad662360e7aca91f0
TLSH
T1C5F0C92815FA8115F33B9D3A43D861EFDC3BB22330445D6232D001490402E028C2132B
MD5 SHA1 SHA512 TLSH

Submit Download

86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\86844F70250DD8EF225D6B4178798C21_1FB605FD2412C4F94AD934D8134A28AC
Size 560B
SHA256 a0acbe7db93b5ef6353c418b5da2ebc1a516b5b668e26e76ddebede05a13eac8
MD5 cd8c971a281a313061fea1c69fd05b98
SHA1 c2c4e7b31b36c0bc8bdc025a0a0f84938e5132ce
SHA512 e76df934f111616501a9bdf372d5d3b7c21859a5d490060eee02ce0e4ed17f2ea7b480378fb2198b03aae4965e7920b3e53ce49cf4aeb6b11f0040aa1bb5415d
TLSH
T198F0273C16FA422AF331E73587EA559EB87EB01378196E5D0094075A0802B424D6233A
MD5 SHA1 SHA512 TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\AddinInstaller.dll
Size 35KB
SHA256 c0306045119da6aa284f77f5ae57e9a35ae473294ef6b983db909902ef860b65
MD5 077c50b05317268a4e84b0d8e18b7e25
SHA1 4e4320e74fb1d2ca46e38b7a5554547f8c0ea57f
SHA512 e61171028a7faef3e4545ddc1a6a0e9a0ba618c20db82d4cb32eae379710497b30fee3f165400ed93c2760e04c102889686a14d7f996b3664026c881e93024ed
SSDEEP 768:CJLtIDER3wlQ0Tkjb6PO59zeTzlU+9zZU:myARglQ7jQ4zeTm6zW
TLSH
T1E0F21891A7F84102FAFB6F706AB4E5422DB9BF875C70D92D1989E14D0C637C4DA2073A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.08901\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftTeamsMeetingAddinInstaller.msi

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAddinMsis\1.26.08901\MicrosoftTeamsMeetingAddinInstaller.msi
Size 13.9MB
SHA256 636115933ab2f678c8d9eaf50e79e47be094436d438565fa30b0f1ae3d7362f4
MD5 8444b913223f0ebe0d7eb0867ece55e4
SHA1 43028a51223cbea7b405b18be0a59b42f7777136
SHA512 a1617c7eab8ff2922e9ba1c4273db6917cca25d3ac886aa28ee59dee45f4dc0a406be0f5251a189fd589720635aeeba8781f0899fbd3cb080ed82ad3e7c7596b
SSDEEP 393216:PMyGsr31tl7C4WYe47SXsxbOLq5a38wnt9lTmr7:PM831jG47ZIsZOLq5a38wnFm
TLSH
T170E63353358AC932C2BA0A7826BB97556B7DBD254DF0CC0B5710BA4A2C723C01BB5F57
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 c1c576947584e5e477ac528ef4c32ec5570efad920ad56306d01eb8faecf9f4f
MD5 8d6259bf8ac8180f12da7218456ecd15
SHA1 3a852c4ae0926c69c0d36cd7f8e8f772ebe47667
SHA512 f171881a802c2a07df62fe2d83c10ade292630d0e40a5d95a24b95d999e341b99e096613c90b0f46367161691eb6c1b4f16f027d524572e8fa17b21930c6481c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 a8bbcc26c969861d64f6589244e3c3fc6a871f287c29b7abbb85044b3409a7f2
MD5 3a7595dbda628d14236d8aa8c62ac1f5
SHA1 2afc15f8348426437bb021c7f357045ac63d8c2f
SHA512 9f23b8d6efff6df670f00c27d9174d787f7e67b54603dcd7172ddbeec865db9c83e7069b788c01d315b9575c31ab50107e627cb083256f04a07464b68ba9fa1d
TLSH
T19CD0121232010238C8183173138365081808C20B444940446438D91D1E044601A124C2
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 1KB
SHA256 bea24521030286c565835793d4c3cc2ff7122f62057aab7816ab8f54437f27a7
MD5 42c4ff8bfc0febea09288905b6e07895
SHA1 8f8089514aedd403fcff6c0c2aa946bdb0836be7
SHA512 751ca3cabfcf875bd74c0a30de892167a2e3d705c1b8088a5579c562b06feb53c4633a2320f2cb774e42793cb537d5b4f61331780cf95cb39335b19910421709
TLSH
T18331A473D4A02B335CB59553F641BF5B2FA196A6C2608E8861CF4B4D12EB1CC9636C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 da027eb20e791be5b6ca98a79ed0586275a34fb57062d83166e7c57522eb277c
MD5 795836eb7a231a2e7dcabdb08f430931
SHA1 678d2b202a3281d91bc6a6da89da21c22403d4e9
SHA512 014a31979a129c7fae329f3d1d9d2085fb63ba0da96a7fabbe3b9c8aed8607ea915872d6d2a30edf0f62432471b5c9c6cd21b4658b4f6e1c093423c8f22230d0
TLSH
T12F51A433A8246B3789F28655FE457F136F7692A1DBA11F9495DE0B0D01DB29C2312C3B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 d522228f3989dd3639e650f267917a779f256e789fb5a4c851419036bafe0134
MD5 4d8abf7162a0df12fe2d95886cf5bd27
SHA1 bee6b1a955bee9b71c3b2e5c5d3a1f3a8ea789af
SHA512 8847317559725066fe95b1e71a650151a62b94838513bdca2fddfaaffc0289dec55041d84d6254d929858f6612f0720a78856d96f7512a3fb9d3ba57565b9c9f
TLSH
T1307194376964AA274DF29905FD853F167BA59233DA902FD8C9ED0F0D01DB3982352C2B
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 f06f6f8c9aa2c2718263627a5926f06419b4383af5c5de5819de96bde09f6a44
MD5 3fbf7fe874a79794bfa088f4e54f3fc9
SHA1 cf87a7b53c38fddb1045a3eb0cd2f6249bc7919b
SHA512 3fb20e67fc128e6cca68943723299f7482148f28e85c1581f3f3d80a00cdd0c6f79e7bd481b4d4784a5e37c14b13c92cd79467f8f12aeb6d24e309000a1d1f81
SSDEEP 384:zVvsrvyOiyp4+IWA1eUVWGfvvLhNbrqE7Q/UdJ64a:Z0raxyp4sQe6WGfvlQsdJy
TLSH
T189728D7606746A3B8CA5EC8ABC862E1A7FD58527D9C02FDCE5E45F0F054B2D80706917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5957ab.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe5957ab.TMP
Size 1KB
SHA256 b4e592e325a023dd8c511bca8a7b1ae731d7fa0746a19fbfd2dc27b0074c558b
MD5 dcf6a1315bffcdf6e646736f18c12077
SHA1 4f505c029cbb7ba8427cd26b16034fc8caf0df79
SHA512 b512fb83d898e69d5a4c05540ad6bc15ecc13b7ff3cbcb13cf8a88653149a47d07b36c67175aa6e675caf4f22327b8722abedfeeca78fd253db32442b69768ca
TLSH
T1C0216277C4A42B7358A54412F641BF4A2E9096A6C2608E8C91CF475D12DB5DC8636C37
MD5 SHA1 SHA512 TLSH

Submit Download

943fe8a9-da66-4965-bf66-b343ac592899.tmp

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\943fe8a9-da66-4965-bf66-b343ac592899.tmp
Size 6KB
SHA256 8ec2b80c1732872e1fc3e900bda57ac220825d5ad03a78a4efd22301c9b34e7d
MD5 0f934103a720985b5949048ca29bcfaa
SHA1 063c7717136cbeaf57d665c360f6d3d78bd90056
SHA512 46b4738e4c138a283c11af157577ad43de0da795aae539fc37de71f6ea9c2d5fb4b675a13835261fc3b36100b4a2cdee913a2781d0fae8343d11e9dd3ff03b0f
SSDEEP 192:st3p0fFZ8paNP/S+WiFVUn1wd7EPLow+MC:stZ040/VSwqvC
TLSH
T18EE197039F285A774CC7F619BA25FA12E6F6102266D10D9CABFC875C04E76DC620780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 7733c99017b2da657296c5dcd68748da5ac9a701f82c62b5212cf1084937b8b9
MD5 a28fa1d2ee886205887b49b1e6f2bdd4
SHA1 518965b61d8e8b09e803b06d5b864d7307511c1e
SHA512 2a619176fb4feae2927d6155ac9246154f36426ce5b53ca3b852b759d0e974d9469c51c2221d954b64c01e44e2840efa0a571c6a07732a7ec066fc2599fb5257
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 33810d4bf36d5dc103d88e94547c2d3e5992b9aa819457e229fbdff86ba3c722
MD5 c9e4be7dcdedcee67c9c558eb00460e1
SHA1 cc6f0363dc01cd78307a765115681153b08c2bea
SHA512 31822b3f94e8d6d8be677af8f316ae2002084dba71abf22ec43ac9d0396d870918d79aa3be2d262f17eac8dbd053ff25fb0df5fcc38ee00760145958cb2e5738
TLSH
T126313F3048DF6C52EFDF11F06724AC4283D4812A0E21EB6B5AD71108C177CE353BAE02
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnGraphiteCache\index
Size 256KB
SHA256 8ba4f026327e56ab8cc058b865c1b31a176503215d23d9454ee16271e2c9c8de
MD5 650c9b56fd6b03372790ffe9008a089b
SHA1 fb406b663f90f74059ba503457973d5d107339f6
SHA512 7bbde90739b451ab1f8399e7c257541514aad5f17cae9db4bc05ac3cc274820cfbf8927f5b9ffab33b33c2ef13737120640a156fc3553779d6754a4a876484ee
SSDEEP 3:LsOllllkll/lMVKlX:LsUlEtpX
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\DawnWebGPUCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity
Size 523B
SHA256 96a826fcfd6e3f8169bc5ac39bcd217eeaf2797c3884f0222665b33d83e4e522
MD5 32a96e22a867b9edbc89fb1ed12e8b81
SHA1 6fd2e002bff56e2b3fd08d115c74bd701497d314
SHA512 87d2ec823a68f85859ef77def088c97a670175fd064034a40944fb08d4a3af97d1080ceddf4fcb4e131c8f4116f3fb15db0e623570090e5fc9338fd178c94415
TLSH
T120F059F382B9B827E0AC09B72C14BD1A6BB7E03915C9D4F4D963426CF0115B71313432
MD5 SHA1 SHA512 TLSH

Submit Download

TransportSecurity~RFe5a06e7.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity~RFe5a06e7.TMP
Size 523B
SHA256 3fc61bd9dbf78abf49d70c0df3b4adb63094b99d7bb7d06912dc5b8e52be368d
MD5 bb22c4b4d7f42a0a0ae83b36db0df78f
SHA1 81f0f44e5328476ff04faff1aca9fc5a68472c76
SHA512 6ddd4b477a5632d690f4b380ffc3f1a1b4cb6431dae6b148276ed38057b38b2e5bd4e04571eaa888fd83ff93bc1c418b9c8a829d334c23f5f724b1965697b220
TLSH
T1B5F059E38679BCA6946C4FB62C40BD1E7B77E03A5191E0F4D973426CE0516B71313872
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Preferences
Size 6KB
SHA256 49a0cc2b76714fa302188308c41f10bc21cdf209e2b09cf10390bd181763fe13
MD5 4a57ad04a0ed060e7e66dc995fab481e
SHA1 1de2e65d30f41b6db3e544772cc701b74e1e62cc
SHA512 bd1bc9dae4bb1af62832c4c252ee0dc0ad65c9cb231842d899fa41799e7685aba94ab44604a6e52896d3e3f490f976e31f7c79fb4ff90362d40d2fce3b57b5df
SSDEEP 192:st3pXfFZ8paNP/S+WiFVUn1wd7EPLZw+M8:stZX40/VSw9v8
TLSH
T167D1A6039F285A7B4CC7E229BA25FA16D6F6102266D50DDCABFD875C04D72DC630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\2c34e464-305d-4f3b-b103-d63d7d09bf18\index-dir\the-real-index
Size 96B
SHA256 e868e377ea5f928756ad4501b8bc6fc5f5aa9adde7a1c841a4cd800af7ebec1f
MD5 a23d2564e0496a0caa6c28f18d4c50ea
SHA1 4fd53ccc6ed1308e890b4d24f8f6b61820c8e87e
SHA512 f628b1904b5c92da0dcfadff06a384377cd8ca20d3c5fb560bf9bcf6aedf7778c4f6903ea9e216d8c45802548834037d09912729de3e933876b72bd9438fb5e6
TLSH
T1D5B002283B34481EC49487BD20CE8BD1733D2E1CD26B03D5D59496FDAC7B35A46623A5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b3d5.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\2c34e464-305d-4f3b-b103-d63d7d09bf18\index-dir\the-real-index~RFe59b3d5.TMP
Size 48B
SHA256 1ea4cf1b1dee222fad3e3f69462bd59b2c016c12efea76c191538396ef4806e7
MD5 5607eb2c6c038423748550f9c1455185
SHA1 58aece6a6289707e843237857d31ccb983575cb7
SHA512 20080d34cbe8557e32bf5cbbdcc04c8bacda1b498d465915b8a086924c07cde542306836695a24d197a45584e4a793ad0d66811a5b99e9bc088c08a075dbb55f
MD5 SHA1 SHA512

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\94eebc67-e8e7-4c59-bc58-364b260bde33\73cb100cf1fe8262_0
Size 2KB
SHA256 e4db2aac1b2d983245c7e1fb33b9d0b7a59ab6c7cfce8f18895135040658dfd8
MD5 89ed3cdafd0aa11785f9e443fe692a89
SHA1 42a213b659f82443e7b6906f21c2c5f40c2e225a
SHA512 43fbe72f7eb04a72ec9ef0983bc85107d9b8f4a5c8be138aa84f3099f53f1113d1802b29dc7e1f9ff6cfee9f289ddacadd061368294f4c9ca36fede4a5d6c44f
TLSH
T1DC41382741010C5EDA8AAD78515D1EB862EABB20F1CDECDACEEC09388C750CD742D831
MD5 SHA1 SHA512 TLSH

Submit Download

73cb100cf1fe8262_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\94eebc67-e8e7-4c59-bc58-364b260bde33\73cb100cf1fe8262_0
Size 2KB
SHA256 a631d7c1fe6c419d0b4997f375b1aea5d2f4600162bda1a5e64b6cb791d54701
MD5 fe1382b6d235f044d96ff8a599f0dcf3
SHA1 a836eeaffb82c6f09518b770ebb378f7d1423953
SHA512 e884b4da0e9751fb0e7ba493b2039bc242217dc6d5ecbae2d66b8c38ad3a66f28eced2460293d9d1da50d1b9d9988e53777b15960b863541b4a8c0eca29bca2a
TLSH
T11441382741010C5EDA8A9D68515D1EB462FABB20F2CDECDACEEC09388C754CDB02D832
MD5 SHA1 SHA512 TLSH

Submit Download

ad04bcd31c122994_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\94eebc67-e8e7-4c59-bc58-364b260bde33\ad04bcd31c122994_0
Size 928B
SHA256 2a6fe29447b43ae1c5707ccc9dfccf57ad29e71e125371b025def29f3779ca35
MD5 1bb5db6216ee4beb595c5b80838014e1
SHA1 d3e047efe2a9d47d72e1f4fbe6e10c3fe634943d
SHA512 fddbc6bb6d344fecec2819f49e7239df83a336b35c6e55c2f2d2cce5ef8165d7e89a4dcbb26dba30573a3ad2c727103a6cbbbe7869b13ad58665b61a6db959ec
TLSH
T11F113A1601000C1FDEA6AC6991491B7966FAAB55E1CE9DD9CDEC4938CD150C9A12DC30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\94eebc67-e8e7-4c59-bc58-364b260bde33\index-dir\the-real-index
Size 96B
SHA256 3c6c5ebf75fe1afe15475c71fa304facf8bc0498d95b69389055bcb4fa6c358c
MD5 a344ee2894a969df7f0aa3396aaca070
SHA1 de22258d07e95589b89f7bf39530c3228c141d81
SHA512 d19e7d91cd36287280b3647016ec80634bf718efb503b8477d2015aeef83d9bc387800ac3fd687f0f104744141c09f79c81231ea05ba8d33b553738d5cefbcaa
TLSH
T1D1B022F0A8000C02E22003F38BC200C0333C0FA80303032C02C00233FC223C80200020
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b54c.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\94eebc67-e8e7-4c59-bc58-364b260bde33\index-dir\the-real-index~RFe59b54c.TMP
Size 48B
SHA256 a3f7a5ea3e75cefa86d94f3995c2d592ad092c66992c67deb4b921b6ae1ba4ef
MD5 d1d96f5316ca836663e637678c5abf61
SHA1 cd73277fbaec39bad9aee45676cf11c333f02ace
SHA512 05c066a040bcad30d3a6a517cf1c645bf5c8f0caf618a0276332ea4fced99ec00a3d9ac54732bd4a1cb62d324124efe8db5a67a5aaa7417002cacae812fb3676
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 fef9a0909edb796f387e6d568e877ce993256bf3fa990b61df73fc4f5167512e
MD5 2b53207fb2e7a512edea97315df50e4f
SHA1 cc3235000964a91d84809f2a16f332a52e6df03a
SHA512 0e2e2f71dbad26fac12d2e8d43450d3235ed50029fc6a24e3e3929f8c145390b005b4cafbf93441fae81047033ab7b9bf57c382d69b6359136bc95dda2c6571d
TLSH
T129D0A77E456058155F9D499150C1E866D05B8C479505E0A04AC774503C3E5F9A91606C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 28fabb8820b9040cfbe8949a14f5870caeb53a11c4a514e8cc7b69f49dbef0e4
MD5 a3baf8239be8fa4b1761254bdfd44c34
SHA1 681abe6c09845fcddf1fe57dc59ba20c9b38a057
SHA512 6739a8740ae34316a79afaf4db389811a7068a6b9d3b0a404cff4138b36428924ab80988b199d42970d4b20db1ff201dadb32466e4198760d56040a8b902cf93
TLSH
T15CE07D2B401028255F5D469194C0D955800B4C0B5541E1A04AC6B8403C3F1F59A160DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 53acda5ac28b89dc5fb6ef3636f237b202c8bb190f28d185a36438fb59795b91
MD5 fb4a41b009d768edb5cddf501b48f6f7
SHA1 f6b05653981fe83dd5666581a4f7a41a10cb2b11
SHA512 4ffb4e2c62d7ce71a8a78f84a01eebe31dbfc7f2d19b906cadcdee743d3b784bb94c8bfba819f20ccb45fa47942e1d1dfe20cec4ea03ca245c979a45e27ca0c4
TLSH
T123D0E73B48102C290F5D079094C0D9568007484B5141F1E00ACACC403C1F1F65B1F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe595d87.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe595d87.TMP
Size 141B
SHA256 c6169d418a86fc963df857b24a05e6c974ee2370639d14f2c50bb6ba93a7b6fc
MD5 a6bf023e339f1b25771679409ad2aba2
SHA1 6f74b4cf3f5c88d01c2cc80ccd4a35439f5a4f9b
SHA512 329b3c998fc74202b2854fff3ecdd2d3ccdb1849cda28eb9a8f6146770032f9977b4d892d44e71932e83ea9d4b2c5964df2dd0c876d17000d96c5088c912eb9e
TLSH
T1B9C08C6E401008014F4D14825080E812A04ACD5B8801E09481CB3001283E5EBE1220AC
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-05-22_05-47-30.00.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-05-22_05-47-30.00.log
Size 3KB
SHA256 fe1b086fc95b6d388a9ff838d4a95351428c4496a18a0bf9919f2e0123c3db15
MD5 ff4d56e30ccacefbb612a82ee0a0e19c
SHA1 9a4c990bd3713a8022af5710b613a7b1441dc2b4
SHA512 060f4db73f735910c42e8e17150cea6b7f2ef64cf32a281b0aaba3949c9f4578b9356d0fa1cc08b260736bfe9b0cd97b46648dafb21cfe05138ab663dec01211
TLSH
T13D615C3593E941E9E00F2845E3203FB89DD9F84B71F43479FFA06E56505B2216EAC51E
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-05-22_05-47-30.01.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-05-22_05-47-30.01.log
Size 3KB
SHA256 f1abb3dad3d90b0d37ff18c1eeb1993073f16fd492d71d0005b38d1f5a580417
MD5 6400a16dfde48d1c815738593ce95bb3
SHA1 6d6f7f0ede6709ee3b6d00ea883974b4a7570bfc
SHA512 271387457587ee2367c2fc8a21f36f2f5822a248b9aa95a941f59b68a4a4f5bc12b0ef825eff7148adb0915d36b6f07b04c9532aacd789585dce3e7276e6db3e
TLSH
T193718DA492A650EEE05F188A92107FB9DEE9B406B1C430B9FF949B460747D347F6C11F
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 a31a22fd34ea2a8e759e0fe916ce57ff983a57361335b92a309ca1c926615522
MD5 6a9b924a681c5e1be67e82959aa8f816
SHA1 53d5dc80aa81345075fbdc7195243c61d37c96c2
SHA512 7fecb89460958726a4a93a9b8e2ff0d942180246d442cdeffffdad4c006c336cbd651b992d1c597d1e7f7fa1bf42d855c1993fbaad7556d981ac4178477da8f9
TLSH
T1CF51C42C0514A2BEDDC7864BB55F3E234AE741A4EFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe5954bd.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe5954bd.TMP
Size 2KB
SHA256 9059aedae41985c3bea5574bb24bdfc779a81a7950b8e3d391c3b6c2486c5888
MD5 1dfd4312dabffb5d401c38fffe675cc2
SHA1 1aa7fe1743482b829a660e74791fddd811f2c5f3
SHA512 e10fb1041d771a8d79b900cb2ec7c226f1487b78c9909d53e91c512cf53332672c7a16108797ba3b3e280fb747ce2cc9594c6deb653a321d70f4642521d515ec
TLSH
T13C51D52C0614A2BEDDC7864FB54F3E238AE701A4DFA67BD6D8AC1C1C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 770bb2ec2b6a3b1ea8ba748f2ba18e0ed02a902160e94054248577a2b1eea004
MD5 c57e987dacbf7b9767e1b84e7c7b6318
SHA1 58fb9a77b70bba22d0fee2daef1b041755aaf5fd
SHA512 b9695a3da3e1288c9219d17bb0a56c6a57c3450e65bef1e318faedc25a407a2c1d5169c9ddbe87a57b8f4d1d9c5ddc203bf8eef3433fa1e5ad1eb8b1fa597769
SSDEEP 1536:CwcSWOqX+MNv5ZBL3VNUBYDireji7YDereQrHd8l68V:j055VMC
TLSH
T1FCA551A41845BAFDEB8AC2B867381F18B5FC8DB78C415025DBDDE60D70A346673138A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 155B
SHA256 841e319cf1f27b6a53974708cdca81501faa66a7a0a7367bcad1d16f582b32bc
MD5 0721677618ed38cdf1614cefc90f52c3
SHA1 45bfbe89673ea2c04b010179ab091f003e16743a
SHA512 e733598113ae65666f9fb76bf86b82cd1c19b954881db55f59c379ec1c58d16c2671f49de3fdccc654875fd4618222e601f06fe53d1edce2236cd4f062ae77a1
TLSH
T161C09B461576C179EF77251C805B63555D4C55F4E7247285C4B91452F9414C3743F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe596b43.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe596b43.TMP
Size 155B
SHA256 2bfef485370d6cd3d06af87a90f129c435f34561040904f36ad3f124cb5219d0
MD5 cf92997c19287b84479930eb45399a73
SHA1 c2d167085cac5d53a83ba2e5439fdcc7a0b18191
SHA512 ef9c4fa6e307d13a036a1b485aa149e0b0256392dc3c77b075ace73a6b30e2a54c74ef4158f9cc0bfc09d888a1feb93ffe979846b278481b2c53b532f99e43a0
TLSH
T188C09B451576C179EF77261C805B63555D4C55F4EB247245C4B91412F9414C3753F4CF
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 32B
SHA256 ccc8055c23ad77c9dd924bda6cc703289f794c97e84d99ceecfc79f3bcbb1127
MD5 0510df2d52a7dbe89c99b3baa09d23e6
SHA1 bcc0e3626443b1d49bfca79eaa19094f310f6997
SHA512 77c6c0d323b11f66f121b4f8ee1f250e1e4274fe9e19f8946f4e42824cb94a3e5061defff8ec98f0d5cb240107f8926d9a597169345515eb68e32a2dadd78523
MD5 SHA1 SHA512

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 1a23358539cae4306c8af41a2595cb189b91d15ed90b1f05b7fbc2f1a1ed295d
MD5 5163477a9f04bd3aa3edc8f060871783
SHA1 a93abefb3b586ac9b866e128be49db8da00a8922
SHA512 1bef1cddd2961a0fd6aca69def5176642289b318f3ba7d9a14bea01ab013d20272f926d198f8e7a658a5bef874237837ea04e79b9bd44dc16739248b1831d1c1
TLSH
T1EBC02B160E1761330B500A10C6BBBCC2C1893C97016018A0423AC04C0B182FF7140706
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 37aff3a47595796d09a79f9162ff77c3f3eb59eb59377f4c1aa84a21b846e460
MD5 5f15ed8599a952868fc89d24074181fa
SHA1 fcc8f66c4d8eb9373cd9efa63b8cdd02b0242ba5
SHA512 7141d4421f0beee3d072be411a99d51e4b70627a6b99f48b0e2527b2174bf4010a5d9710a1559add9fb71d9086353b861f6d4df206492f5a056810f8183c40a5
TLSH
T179E0C01B4F4665BB8D011000CDB66DC0E6F43E66D2E9509553BF85180B211F7648031B
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe595421.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe595421.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.4MB
SHA256 2446b85a1c001c0920ff8e218e5aae69224af54c53fac4f64c5cc02abb60b879
MD5 dcd93307ee04f60891886906340dac01
SHA1 5c04aece7475f893eb4821997f4ad7e783db49e0
SHA512 69821539b930ddeffb329180286a9250e874d5fdba05d5005b9feabb061caac64e437ae329e814515d455a32bf2ebb3c7ed25ae329f6c59df238ca6375a91789
SSDEEP 49152:cwpN1pVhhlk9u7CXGtZxRz9DT0gzq8UdYb0UnE:cwpJhlk9u/7TzJpxUNUE
TLSH
T145B55A10ABE88E2BE4BF1BB6B57101510BF6F9866772F78F160C60782E933548D52763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 9KB
SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
MD5 18cf95269eab6519867f9c240ea57c6b
SHA1 7026775355daf1cf1a49d380d7cdd7785a6278e0
SHA512 873c83d15803396a636a09349313f90e2a1a9aa8e1a41b474f898ec0b6580b107f3e3763e8e1613f8cb9d7c611a21762ce712824b68de9ae48be73425f045096
SSDEEP 192:FTaPIYtYvIOnHW+pYt6wRpy6/WVkiS3s20AbCWGShWMeqf4:Fl8YQO2+pQDfykakiS3pb/1tw
TLSH
T14212AE53DBC9B884A0509FF7AD8C201A670381554D6458DBF9BA34AB350603A7B6E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 bd006b75c9534274629a1fcf5aea8944ecd0291523fac401da6b5910a28e2ddc
MD5 18c4bfc7b5908843311812761e1edb48
SHA1 d516e4258e844cefcd45871a60a0fb37d4999b74
SHA512 70bc01a483a183777ec95a5185198987eee5f00913761f3e3bf2222be63473f32ae030285dffedf23d25b851c7abab1fe89f9b02211fb40fe2ea33d5c76dffe3
TLSH
T17890026483618C40C5197295646A5460C46219906825826C84149440A91851009E1D12
MD5 SHA1 SHA512 TLSH

Submit Download

2khzn25g.dll

Path C:\Users\Admin\AppData\Local\Temp\2khzn25g\2khzn25g.dll
Size 3KB
SHA256 d6b9eda0f1b7777938bbc756b79522b24bc1b3aa2e4d900ba16ead2d56db62c3
MD5 c2207b2d4269b171a0ec065d7bb9a214
SHA1 fcfe1bc34bab2a2f0f98a3b8eb3306486ba29eac
SHA512 62050e35a350a439a4de313ed70b2fec6830c8dfe991e4180d2bcb15dd40fe717f19f4acb144915cae79c70674606926c606d0504b1b7bede01b32d2547d3e20
TLSH
T12271DE1A93E80AABF0A707356EF7432677B4FC109F63A36E49C0021DAC706600931BB1
MD5 SHA1 SHA512 TLSH

Submit Download

CFG6661.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFG6661.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 726B
SHA256 81d28a3a6e1a4d3a779ba620c70c5ab292f41f8872098a0a954a6dd11a4f45ee
MD5 7521b6624df73ce029f5274ca8cd1934
SHA1 f63a4025829044ccc33702afb33e2b5e87598cf1
SHA512 53c274979d3dc1d92a934bf79d43a025b2d25bc98195a5ab469ef9b0f2c76eefd5d836cb633b11e4c611a9c279b2d481fa95a2cc85c16f8881b668c0156d38bd
TLSH
T1BE012D5A0EA4025F97D03136A35099CEBBBB6553220175C1D3E4C64426C38F75BF6D81
MD5 SHA1 SHA512 TLSH

Submit Download

RESAB00.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAB00.tmp
Size 1KB
SHA256 fd123f8d84b31f7b4039f7bd86626a4543a1c295deedd6ca4a5ae57d9bdf9fe3
MD5 1a1c1a7089035f91d31d259393239772
SHA1 6d909a3c22f613a3b48bf6c00d6cb132ad78d396
SHA512 bbc3b386d49dd0caf2d1f215cee2df9e0b62cd6bf19f7709c1deccb9d4372dd160c3d9abf411f9ab6b6d29ee5529ca73d7239c448a570c14b225dcd45450fc06
TLSH
T11221660993EC470FF1775732ADF9076F9234FDA4DFA2935A8580422C2C51544EEA0A73
MD5 SHA1 SHA512 TLSH

Submit Download

RESAD04.tmp

Path C:\Users\Admin\AppData\Local\Temp\RESAD04.tmp
Size 1KB
SHA256 f81c7ce3d569e9172255634fada948124779ef22634c1a9fef25b0253a4ccb77
MD5 d6eff7919cb8a93efcdc7c81daa22211
SHA1 83ff42f36a49292737649617c8bb3f56c484fe6b
SHA512 ecd8097aaa5829b06988ab411c1526a9247c80f4f529375b34c1f3c46f93dad30a31535fbf4343111b60355148a944e5f0330f6d4fed537eb8e514532c40cb0a
TLSH
T119216A0593E9471FF0B34732A9F5171F9135FD54DFA6535A8440522D2C51604EEA0B72
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eoypfvi5.1mv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eoypfvi5.1mv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

7I2kmeF5.ps1

Path C:\Users\Admin\AppData\Local\Temp\apWpZqQk69j9\7I2kmeF5.ps1
Size 44KB
SHA256 d436d0d51f6f6cc12485f57fa9d29df0f80ccb5ca1c3b1beefdd676ab38b482e
MD5 10141a4ea2f27d9a594d1e5e44a4731d
SHA1 e6d2d0a7b6b041c6a46bbc88bdc8568e08c0bd05
SHA512 f1e469b72d909ee332427ff2eb3c120adc47055d755fa1924410394e1e689400cc4932fdd4b49306be6a2a12e4290eb3e138e0cfd6a43a248479537aef2e5462
SSDEEP 768:OlXBrJHkA3crjhZlU3UDVarLIU8Q21Hkhgd881CkA4C6g58eds0tziH6iFNw+a8m:ABVEhcEgJ8Q2Wi88YkA4TC8ks0tuH6i+
TLSH
T19E230237BE014DA110BFD038F26A0A50815DAD66234DC776F6FDD54172AA391EA0FD3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

IKfH5k0jt6ZN.exe

Path C:\Users\Admin\AppData\Local\Temp\apWpZqQk69j9\IKfH5k0jt6ZN.exe
Size 1.3MB
SHA256 a574173f6f46428bfbf852c9b9da1ed6ab4bdf11064fe719040ffffb271511be
MD5 205182ce5e6ed46f2d839064ddf4c7dc
SHA1 7a2804a7c37f47384fd17db42cc1a39b23924cec
SHA512 a6074b2ffae3272e512c66d38026a563c3722685fae5d305dd7295da3f373912ad0ad061a0df896f53cbcd7b5ed35d5db10adf0ef7272b657fe174c1271bb419
SSDEEP 24576:YmPjS7HX11V1/hpz4yF+sxtigrZ4Psb0iK7GO6L361scQm1wUnDAnEoOqd:l+31bxAsxb40o9gTYkm1ZnEnEG
TLSH
T11E5512127782C472D6B229324A68C672967DB9211F248BDF53D8165CCEB42C1CB36FB7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gtnijduc.dll

Path C:\Users\Admin\AppData\Local\Temp\gtnijduc\gtnijduc.dll
Size 3KB
SHA256 7f41c2c567ff0f5e983ffb1b87b8c358af6db06793cf91ecf050d9415f333369
MD5 d40ebed042467b737e0a447d06fa5a67
SHA1 c5768e36ee492fc2a5e05a58cbd6b5c2fc9f850b
SHA512 d97c1193683a81674b58694266cfc9422d4265d23a01eebbcb737ff445a4e77fc6b1a98f3508c809534979f3a4de8110c52dec00f0b5b736d2a012b83fa44e58
TLSH
T1FD51CB1A93E8466BE4B747346EF603122678FC209F379729198402AC7C617642D21FB1
MD5 SHA1 SHA512 TLSH

Submit Download

MSI6587.tmp

Path C:\Windows\Installer\MSI6587.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI749E.tmp

Path C:\Windows\Installer\MSI749E.tmp
Size 113KB
SHA256 cdb195012fa5d3cfb80f8ea9fb23348c8749720d7e3a20cb7774cfd717f2df36
MD5 8fa4088a730b967d85df562fd5ef7d5e
SHA1 629db9229f4a4a691e14f38f4dbffba157fa1ce9
SHA512 1037170aed40aa33a4f983e168ae91247c23768fa502877d0b872a462d04fd5687cc50056add6419e3637306ae15beb1cfd04a51f126109faece09087ec16fb2
SSDEEP 1536:xS8CWyksWMcdMWBpjr+UsgtFmVrrXL1MgbIurgnIMolaeB8DhIm+uBSw:xS8SgMq+jVrrb1MMBBMolzaDhI31w
TLSH
T19AB39D41BA908432D5FF2D3C1578DA621E3E79701FE09DAF175851B90EB43D0AB38E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58a40b.msi

Path C:\Windows\Installer\e58a40b.msi
Size 1.2MB
SHA256 2beb8a14b12d6bea42e2d1ca643bf54d79b0e0ad998fa9bc0891df99bca198dd
MD5 a9dc8d5a17ca70c7ab9fc80ca7312dd2
SHA1 60f768f1126435e8573e971c9e17fff99f03c63d
SHA512 08031f771d2ebb78550aafb12bfe76cdb24dc07d5a03c293291ed8c1fadbcfe1e1e9d3eae33c10b941101aaaba324dd69251ccd3bdd4f0a0f61879b1fc8b3f0f
SSDEEP 24576:96S53tcfXVgpc4yC+sxi1jhAXoOjsIp74uuAUv1W1vm15wn10Z:96SVtgXsxi1jhA4hIp8lHN0m16nG
TLSH
T1454533CB231101A1EA069A30A44AC1F1F6BCDF617A438287A587BBDD39B67D4C74F9D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 24.6MB
SHA256 eb1415d442452e68343795fe0a651255bf8a5cbaed107a1d203b99e6ca42f4a8
MD5 4b552563ffc3153b6b38de050c30b763
SHA1 9466f3ade9e68e098d5caf15a944de33fd83a3e1
SHA512 5a37a87e2b201ac4e4d7d282a5308dbf92f1cec0e7fe5ce4807bae2280aefecbafff20a93919fa44cf8c41d20a6beeab80dd8805ff4947c28629bfda0ecc01ec
SSDEEP 24576:a2gmSp1UdoO/vvTLjWouhknavK5jQI8iGmrtX50ohTa40UM9oDJfrFyvR:v
TLSH
T1D747E32432F92210E7F79E3C68F06A67493E7D5B9C15DE8D05421F4E0A61BB0E872F5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{18a4194f-bee5-4d6d-b259-ca66aabbdace}_OnDiskSnapshotProp

Path \??\Volume{f71a51ab-0000-0000-0000-d01200000000}\System Volume Information\SPP\OnlineMetadataCache\{18a4194f-bee5-4d6d-b259-ca66aabbdace}_OnDiskSnapshotProp
Size 6KB
SHA256 ba694b0594c1172830b0d27696e921999ebde4accd254f3d4e00dba4914e426f
MD5 5d26a8fd25bee3142855a3810bc17f6a
SHA1 d472ac5eb91d86ee05dadd690c54bffad584c990
SHA512 68a09673a998db5e14e9c64a366bbb041f58bd4ae06215b194efab2fa366aaef6a03852be4e570dc47d76d5cfb86a554958dfac366f50a7200d5d6c67ba1d665
SSDEEP 96:F/NsTvc8DD84LTHzbOHXOHBlBRQ88Sc9XE56tOSVQpuN:Reb++ZVmN
TLSH
T1EFD199185AF54711E2B3AB3129F18557A877B911EF33CB8E0298638E2670A10F875F5F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2khzn25g.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\2khzn25g\2khzn25g.0.cs
Size 571B
SHA256 cb2e610345ebe0a15a0399f07b7a919e5f77b1689a523c80e531539c965e4e0d
MD5 d9ba7429abb22c214518d431d33588d5
SHA1 2ace9c25bbc4ab5ee2ef641e86af4f8c51f4c561
SHA512 c33db25eff6d38e8dc97dbb518d25f16597df4d7c085b27a4946b0e3c91740cda4c49c9bb7c197c35cf3377048aa080e7da6569e1bd9dbf31bfb8bce0a972e55
TLSH
T1DAF0F63457CFED6518D24425AC99E49C457702291279BC50F6FF1322DE8720472722A5
MD5 SHA1 SHA512 TLSH

Submit Download

2khzn25g.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\2khzn25g\2khzn25g.cmdline
Size 369B
SHA256 0b263edbdec046c1fa3d3fabf98419983b9522be7a68e20ad73d137ad60439de
MD5 7c7058ec5d3bf6b31d962b3117d1d659
SHA1 eba57a43a3ab84ef23871787aa84b6aa0d54552c
SHA512 d4d473a85d804f831f7ba719fd600f8dc4dd81c0c2b9bb67dade37b2808bfaa15a4affdb358ae94c7dbe81d96a12a37a445889d65e6f76a9b0240f56a22191e5
TLSH
T124E0682A425ECA7E43DD100BA9B9C5AC827207432AC03F88D440891ED23700627D1753
MD5 SHA1 SHA512 TLSH

Submit Download

CSC1089902572BB47B6A357EB9775539A5.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\2khzn25g\CSC1089902572BB47B6A357EB9775539A5.TMP
Size 652B
SHA256 a901f697b233aed6a765015b897689ac654f118f64393c27f8a6535490141a5c
MD5 a7fcee274c10f3aa7783dd6f7a719225
SHA1 0983b33a01ac5a00c40a7744e9a6c2f853a1dc72
SHA512 9f5f5ed47dd50269a25d2744fa966e561832ddd233707b7c308c5d25950ecfeb682bd76031bea78014f2f0d86dc17acfaab130dce44372292bb52550e132ee8b
TLSH
T1C1F05E0D63F8020EF0F78B31BDF6436391A8BC65DE3293ED5580031928649149962FB2
MD5 SHA1 SHA512 TLSH

Submit Download

CSCA641AD477D6C4047B25F1A08AD4BF9B.TMP

Path \??\c:\Users\Admin\AppData\Local\Temp\gtnijduc\CSCA641AD477D6C4047B25F1A08AD4BF9B.TMP
Size 652B
SHA256 ca46bee0bf773beb8bb98b229e6e37dbcfe0ac73c0a0d758c3862718adf89832
MD5 bd681466591664e9719d2e3e1e588e04
SHA1 6f6b925e2209b0ea5a1cc6b4d8ab84dadbb0f7ca
SHA512 1d1be77be597c8d875cd251beeda566f4be394c2adcb87a8dd5b4b42b940aa1bfb0c2c736600aebf6aeb90a10eb3b3f36b722860cee55d66f17b087f694025f1
TLSH
T167F0540A63F8420EF0F34B31BDF543679569BC65DE3293ED5880135D1C746109961F71
MD5 SHA1 SHA512 TLSH

Submit Download

gtnijduc.0.cs

Path \??\c:\Users\Admin\AppData\Local\Temp\gtnijduc\gtnijduc.0.cs
Size 54B
SHA256 662247a7818fb3714e25460a8fba0d58bb6b1811813de2ae604e2ce87c3c0058
MD5 d933553db0bda098a207f24940b56955
SHA1 669223944f2befe4828e61274299c2a813e2d0b1
SHA512 ef54a056ea8f2ba9d6bdfefd631ff642fd30b0fe69d1ef02fe0157cc90e4fb3ecea59ef5632dd556f757cfccb3a5f907e147294f5c458a8fe9461eb0a0ddac1e
TLSH
T14090021C8304552C51D541096DB4F0470C72611E1264A808A84713415D8D090B2793B2
MD5 SHA1 SHA512 TLSH

Submit Download

gtnijduc.cmdline

Path \??\c:\Users\Admin\AppData\Local\Temp\gtnijduc\gtnijduc.cmdline
Size 369B
SHA256 7d09e436092647ad104cf15eb2457aae19a34b56a4bba4377f75177e429ad616
MD5 44d600fd4a8f82a66dd9fc617552fd2c
SHA1 ab367b5f5fb9303793f6e430ea94bb6e7e1c2a69
SHA512 f8ff7c930734882602d45f56f78705efea59f5631161d9dacfe480ed1801c1e8c8b85b2bd243dd9dd9ffdc294d02b4592186a06cb399641b954a4d09a58df3f4
TLSH
T1EAE0C03A4346C67F09DD100B216DC5ACCA7207432B507FC850498C1ED11704027E2FA3
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1216-74-0x000002B5EFCF0000-0x000002B5EFD12000-memory.dmp

Download

memory/1216-109-0x000002B5EFD90000-0x000002B5EFD98000-memory.dmp

Download

memory/1216-92-0x000002B5EFD20000-0x000002B5EFD28000-memory.dmp

Download

memory/3056-201-0x00007FFDF9A20000-0x00007FFDF9A21000-memory.dmp

Download

memory/3056-929-0x000001BD99DB0000-0x000001BD99DD9000-memory.dmp

Download

memory/3508-340-0x00007FFDF9A20000-0x00007FFDF9A21000-memory.dmp

Download

memory/5260-111-0x0000000006E20000-0x0000000006E46000-memory.dmp

Download

memory/5260-84-0x00000000055E0000-0x00000000055EA000-memory.dmp

Download

memory/5260-77-0x0000000004E90000-0x0000000004EAE000-memory.dmp

Download

memory/5260-93-0x0000000005680000-0x00000000056E6000-memory.dmp

Download

memory/5260-75-0x0000000000340000-0x00000000005A2000-memory.dmp

Download

memory/5260-95-0x0000000005D80000-0x00000000062AC000-memory.dmp

Download

memory/5260-114-0x000000000BB00000-0x000000000BB38000-memory.dmp

Download

memory/5260-115-0x000000000BAE0000-0x000000000BAEE000-memory.dmp

Download

memory/5408-887-0x00000000055D0000-0x000000000560C000-memory.dmp

Download

memory/5408-886-0x0000000005570000-0x0000000005582000-memory.dmp

Download

memory/5408-873-0x0000000005530000-0x000000000553A000-memory.dmp

Download

memory/5408-869-0x0000000005390000-0x00000000053AA000-memory.dmp

Download