Overview

overview

9

Static

static

5

2026-07-07...ry.exe

windows10-2004-x64

9

2026-07-07...ry.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260706-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    07/07/2026, 21:10

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-07_1f0bbe16ab308abb747c6505b3baf43c_elex_wannacry.exe
  • Size 2.7MB
  • Sample260707-zz4mvsfs7k
  • SHA256 78fa5bd49124fd365e7091c5185595b94cf365c53d69c9f817a3be8aa820b017
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
adwarediscoveryinstallerpersistenceprivilege_escalationspywarestealer

Malware Config

Signatures

  • Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs
  • Event Triggered Execution: Component Object Model Hijacking 1 TTPs

    Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.

    persistenceprivilege_escalation
  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 13 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 45 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in Windows directory 17 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Inno Setup is an open-source installation builder for Windows applications. 4 IoCs

    Inno Setup installer

    installer
  • Checks SCSI registry key(s) 3 TTPs 48 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 26 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 5 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 8 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-07_1f0bbe16ab308abb747c6505b3baf43c_elex_wannacry.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-07_1f0bbe16ab308abb747c6505b3baf43c_elex_wannacry.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5556
    • C:\Windows\SysWOW64\cscript.exe
      cscript.exe /nologo "C:\Users\Admin\AppData\Roaming\Teams\adddf.vbe" C:\
      2⤵
      • System Location Discovery: System Language Discovery
      PID:3272
    • C:\Users\Admin\AppData\Local\Temp\gentee75\MSTeamsSetup.exe
      "C:\Users\Admin\AppData\Local\Temp\gentee75\MSTeamsSetup.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4868
      • C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
        "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=MSTeamsSetup.exe --bootstrapperMode
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        PID:2120
        • C:\Program Files\WindowsApps\MSTeams_26163.405.4842.717_x64__8wekyb3d8bbwe\ms-teams.exe
          "C:\Program Files\WindowsApps\MSTeams_26163.405.4842.717_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=0.0.0.0&instExecTime=1783458676151&launchSrc=t2installer
          4⤵
          • Adds Run key to start application
          • Checks SCSI registry key(s)
          • Checks processor information in registry
          • Enumerates system info in registry
          • Modifies Internet Explorer settings
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          • Suspicious use of WriteProcessMemory
          PID:4060
          • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
            "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26163.405.4842.717 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4060.200.17380371655989500705 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
            5⤵
            • Drops file in Windows directory
            • Enumerates system info in registry
            • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
            • Suspicious use of WriteProcessMemory
            PID:5304
            • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
              "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x180,0x15c,0x7ffcf8475fd8,0x7ffcf8475fe4,0x7ffcf8475ff0
              6⤵
                PID:4388
              • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26163.405.4842.717 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1716 --field-trial-handle=1704,i,6530630319393931574,13789615012153818834,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
                6⤵
                  PID:2308
                • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                  "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26163.405.4842.717 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2060 --field-trial-handle=1704,i,6530630319393931574,13789615012153818834,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
                  6⤵
                    PID:6032
                  • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                    "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26163.405.4842.717 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2112 --field-trial-handle=1704,i,6530630319393931574,13789615012153818834,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
                    6⤵
                      PID:4436
                    • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                      "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26163.405.4842.717 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --mojo-platform-channel-handle=3700 --field-trial-handle=1704,i,6530630319393931574,13789615012153818834,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 /prefetch:1
                      6⤵
                        PID:976
                      • C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
                        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26163.405.4842.717 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --mojo-platform-channel-handle=3776 --field-trial-handle=1704,i,6530630319393931574,13789615012153818834,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 /prefetch:1
                        6⤵
                          PID:3652
                      • C:\Program Files\WindowsApps\MSTeams_26163.405.4842.717_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
                        "C:\Program Files\WindowsApps\MSTeams_26163.405.4842.717_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID b6fb7d63-40f8-4fe6-b987-db6e73768efa -Trigger EnsureTmaAtStartup
                        5⤵
                        • Checks processor information in registry
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3588
                      • C:\Program Files\WindowsApps\MSTeams_26163.405.4842.717_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
                        "C:\Program Files\WindowsApps\MSTeams_26163.405.4842.717_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID b6fb7d63-40f8-4fe6-b987-db6e73768efa -Trigger SchedulerDirectLaunch -BgTaskDelay 2460
                        5⤵
                        • Checks processor information in registry
                        PID:4736
                • C:\Users\Admin\AppData\Local\Temp\gentee75\zgqmQcC2.exe
                  "C:\Users\Admin\AppData\Local\Temp\gentee75\zgqmQcC2.exe"
                  2⤵
                  • Executes dropped EXE
                  • System Location Discovery: System Language Discovery
                  • Suspicious use of WriteProcessMemory
                  PID:4156
                  • C:\Users\Admin\AppData\Local\Temp\is-9HMK4.tmp\zgqmQcC2.tmp
                    "C:\Users\Admin\AppData\Local\Temp\is-9HMK4.tmp\zgqmQcC2.tmp" /SL5="$E006C,1003146,821760,C:\Users\Admin\AppData\Local\Temp\gentee75\zgqmQcC2.exe"
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of FindShellTrayWindow
                    PID:5728
              • C:\Windows\system32\svchost.exe
                C:\Windows\system32\svchost.exe -k GPSvcGroup
                1⤵
                  PID:3540
                • C:\Program Files\WindowsApps\MSTeams_26163.405.4842.717_x64__8wekyb3d8bbwe\ms-teams.exe
                  "C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
                  1⤵
                  • Checks processor information in registry
                  PID:5984
                • C:\Windows\system32\msiexec.exe
                  C:\Windows\system32\msiexec.exe /V
                  1⤵
                  • Enumerates connected drives
                  • Drops file in Windows directory
                  • Modifies registry class
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of SetWindowsHookEx
                  • Suspicious use of WriteProcessMemory
                  PID:1792
                  • C:\Windows\syswow64\MsiExec.exe
                    C:\Windows\syswow64\MsiExec.exe -Embedding 4AA55801B7247057A321E5E74517652A
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    • Suspicious use of SetWindowsHookEx
                    PID:5216
                • C:\Windows\System32\rundll32.exe
                  "C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\7e7e4ddf.dll,Ftd2p5uC
                  1⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3740
                  • C:\Windows\SysWOW64\rundll32.exe
                    "C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\7e7e4ddf.dll,Ftd2p5uC
                    2⤵
                    • Loads dropped DLL
                    • System Location Discovery: System Language Discovery
                    PID:3752
                • C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
                  "C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe"
                  1⤵
                  • Executes dropped EXE
                  • Enumerates connected drives
                  • System Location Discovery: System Language Discovery
                  • Checks processor information in registry
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of WriteProcessMemory
                  PID:5072
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /run /tn MicrosoftToolKit
                    2⤵
                    • System Location Discovery: System Language Discovery
                    PID:2064
                • C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
                  C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
                  1⤵
                  • Executes dropped EXE
                  PID:4772
                • C:\Windows\System32\rundll32.exe
                  C:\Windows\System32\rundll32.exe
                  1⤵
                    PID:2592

                  Network

                        MITRE ATT&CK Enterprise v16

                        Reconnaissance

                        Resource Development

                        Initial Access

                        Execution

                        Persistence

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Event Triggered Execution

                        1
                        T1546

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Privilege Escalation

                        Boot or Logon Autostart Execution

                        1
                        T1547

                        Registry Run Keys / Startup Folder

                        1
                        T1547.001

                        Event Triggered Execution

                        1
                        T1546

                        Component Object Model Hijacking

                        1
                        T1546.015

                        Defense Evasion

                        Modify Registry

                        2
                        T1112

                        Credential Access

                        Credentials from Password Stores

                        1
                        T1555

                        Credentials from Web Browsers

                        1
                        T1555.003

                        Unsecured Credentials

                        1
                        T1552

                        Credentials In Files

                        1
                        T1552.001

                        Discovery

                        Network Share Discovery

                        1
                        T1135

                        Peripheral Device Discovery

                        2
                        T1120

                        Query Registry

                        4
                        T1012

                        System Information Discovery

                        5
                        T1082

                        System Location Discovery

                        1
                        T1614

                        System Language Discovery

                        1
                        T1614.001

                        Lateral Movement

                        Collection

                        Data from Local System

                        1
                        T1005

                        Command and Control

                        Exfiltration

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        e5a9d0f.rbs
                        • Path C:\Config.Msi\e5a9d0f.rbs
                        • Size 358KB
                        • SHA256 e48fba60cdeb312b21fa6971fc9c90aee9780b1e0b49db1f45eac3cab7c19d46
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        7e7e4ddf.dll
                        • Path C:\ProgramData\MicrosoftDevKit\7e7e4ddf.dll
                        • Size 145KB
                        • SHA256 b6b660e1599576f4e3ab152de8526f403ee19f9ac02036e2f0fce94f07b708ae
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MicrosoftPhotos.exe
                        • Path C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
                        • Size 96KB
                        • SHA256 46e4b74bbc3bbbcceb1499b624c37b5f236175c92205e8081ed8303985909333
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        AddinInstaller.dll
                        • Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\AddinInstaller.dll
                        • Size 35KB
                        • SHA256 4d40809f0fe018208d825047bb01df29343ac4cd5fffd8a28e3b39840b197cb1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Microsoft.IdentityModel.JsonWebTokens.dll
                        • Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\x64\Microsoft.IdentityModel.JsonWebTokens.dll
                        • Size 66KB
                        • SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        System.IdentityModel.Tokens.Jwt.dll
                        • Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\x64\System.IdentityModel.Tokens.Jwt.dll
                        • Size 81KB
                        • SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 18dbd75e7c9bc4bc46e1c5d168587a7fe244b2b603f450b731ba177276401dcb
                        • MD5 SHA1 SHA512
                        Submit Download

                        settings.dat
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
                        • Size 280B
                        • SHA256 e2799e2a304b46da8b4903e8f7b6abd3207d0e62e08fe6ef1313806a9ea4c671
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        throttle_store.dat
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
                        • Size 20B
                        • SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
                        • MD5 SHA1 SHA512
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
                        • Size 111B
                        • SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        index
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Shared Dictionary\cache\index
                        • Size 24B
                        • SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
                        • MD5 SHA1 SHA512
                        Submit Download

                        CURRENT
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Site Characteristics Database\CURRENT
                        • Size 16B
                        • SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
                        • MD5 SHA1 SHA512
                        Submit Download

                        MANIFEST-000001
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\shared_proto_db\metadata\MANIFEST-000001
                        • Size 41B
                        • SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
                        • MD5 SHA1 SHA512
                        Submit Download

                        data_0
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_0
                        • Size 8KB
                        • SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_1
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_1
                        • Size 264KB
                        • SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_2
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_2
                        • Size 8KB
                        • SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        data_3
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_3
                        • Size 8KB
                        • SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
                        • MD5 SHA1 SHA512 SSDEEP
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
                        • Size 2KB
                        • SHA256 13e0668c63a6db55bd2e27b275cc89ab7146fe7e8d4d9714df92fdabe00f6d94
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
                        • Size 3KB
                        • SHA256 88017eceab857c5401597aedd4622d4316d927da279e9db1340d07106e2c49a1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Local State
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
                        • Size 16KB
                        • SHA256 440c6e23a543fcba7d9421e975f7ede521bb3d2725eaff9e014bcc0c9d0b5045
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        Local State~RFe5a80e9.TMP
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe5a80e9.TMP
                        • Size 1KB
                        • SHA256 0b4f4e59038224718d4a7763e8f60072aa811e37e1c19676510814383273e515
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
                        • Size 48B
                        • SHA256 732533351e70c0589f9faa98681e06a3cff50101046cd86045364ce95c6d5e71
                        • MD5 SHA1 SHA512
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
                        • Size 696B
                        • SHA256 d739fb53e83c10e97523c9a14546867b7a09fe969b0c132e1fadc195ddb4b831
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
                        • Size 1KB
                        • SHA256 5a32aabd2bcda0b7b734b954ccfc50d6ccf8863e70f20cbe18828a5c6d463b12
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
                        • Size 59B
                        • SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Network Persistent State
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
                        • Size 874B
                        • SHA256 0fecca9e8c18f7a8b43379aed54104791492eb81f86fa58238a1a3ccc55804a5
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        SCT Auditing Pending Reports
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\SCT Auditing Pending Reports
                        • Size 2B
                        • SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
                        • MD5 SHA1 SHA512
                        Submit Download

                        TransportSecurity
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity
                        • Size 523B
                        • SHA256 24f2669f4ccfe066fc3d7e20f72bdb41f52653001d467b423afa7a539b3b32df
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        TransportSecurity
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity
                        • Size 523B
                        • SHA256 8a8af781c3648ea0e81b46e20635e11807c8fa36bac61ebae7f5bb0a5fbaac3c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        TransportSecurity~RFe5b0c51.TMP
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\TransportSecurity~RFe5b0c51.TMP
                        • Size 356B
                        • SHA256 e5440e62181067c5a7315e53d62dce7fb79578f88739c966f9c17ba55b99c0f1
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\29d50ba4-47e5-4dda-8b17-5ed1a20a38d8\index-dir\the-real-index
                        • Size 96B
                        • SHA256 c0f87803257fed4cbe776bc08959ec7cbcfad87d8c4d196bf230d8ce92417a33
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        the-real-index~RFe5b3516.TMP
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\29d50ba4-47e5-4dda-8b17-5ed1a20a38d8\index-dir\the-real-index~RFe5b3516.TMP
                        • Size 48B
                        • SHA256 fa5637bf00251c2c15865b6ad4b1c68930249698897c7fe1ef9a37b087686749
                        • MD5 SHA1 SHA512
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\56e4ae4a-87f4-450a-bd16-ce62ed112fbe\index-dir\the-real-index
                        • Size 72B
                        • SHA256 bc6e1635e63a76b8bea9ec26cced6fa2007d205961c56dbac185ca74ac45c57c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        the-real-index
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\56e4ae4a-87f4-450a-bd16-ce62ed112fbe\index-dir\the-real-index
                        • Size 96B
                        • SHA256 2bafd500a0b07fde968261bb297d68c75d8815f3a7687fd55f31c90426c20b14
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        the-real-index~RFe5ae2c0.TMP
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\56e4ae4a-87f4-450a-bd16-ce62ed112fbe\index-dir\the-real-index~RFe5ae2c0.TMP
                        • Size 48B
                        • SHA256 f8f048134efd60401972084b6a8b3876029e06a82b99f509de514ed0363ffd06
                        • MD5 SHA1 SHA512
                        Submit Download

                        index.txt
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
                        • Size 221B
                        • SHA256 549000eab58cf429e2bb3920bf701902073a99af160a072566398718885e8e23
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        index.txt
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
                        • Size 293B
                        • SHA256 58c08b1becebbeba7fd38ca3bceb4bde3efd05b8a3af0744813c140638176f6a
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        index.txt
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
                        • Size 287B
                        • SHA256 5f7559ae9bdbbb7a9bcba4814eaf844734c7d912323b408d7424fb1c1d2b0f00
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        index.txt
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
                        • Size 289B
                        • SHA256 ca5be7c63d52a9e6d8a77c374192a3d48e28b904c5ec5bd13234cace9637fb2d
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        index.txt~RFe5a88c9.TMP
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe5a88c9.TMP
                        • Size 141B
                        • SHA256 ea6b2cde08ee24fb40cb2915361bcf142411aa239aee74b09f0ba08076ad2526
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        f0204c23-a799-435a-bbc0-8615954a84e2.tmp
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\f0204c23-a799-435a-bbc0-8615954a84e2.tmp
                        • Size 6KB
                        • SHA256 2a2fb3f8da96e61b50a570508b0bd9b828ec2df1f55065c786072b3b95ca70b5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MSTeamsUpdate_2026-07-07_22-11-26.00.log
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-07-07_22-11-26.00.log
                        • Size 3KB
                        • SHA256 dddceaf87c1c4eed83053fd644edc5f028808e72dfa787befd26241be7389f31
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        tma_addin_msi.log
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
                        • Size 2B
                        • SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
                        • MD5 SHA1 SHA512
                        Submit Download

                        app_settings.json
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
                        • Size 2KB
                        • SHA256 8a62baa661e1cf2ac700c44289305d8dbe228b4baa83410aaae3a52708759c8b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        app_settings.json~RFe5a7a42.TMP
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe5a7a42.TMP
                        • Size 2KB
                        • SHA256 084291f3ed2cca242e743f905f1344424395ce8c2f3fb9584ea6a030708a1eb5
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        ecs_settings.dat64
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
                        • Size 2.0MB
                        • SHA256 87c21e30ba25061a7852ffd00e68ace099cbd2ea58af68040ae094507ce42bb1
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        cloud_settings.json
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
                        • Size 154B
                        • SHA256 cd7f02f72b0c4b167374dcc295c30acb5d90d56c91dc8619e4c848d42dedf25b
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        cloud_settings.json~RFe5aef34.TMP
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe5aef34.TMP
                        • Size 154B
                        • SHA256 d0d9f92181138474a07cb257841d6367425bbbf6f7bd49ed9ed7a832594438c3
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
                        • Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
                        • Size 24KB
                        • SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        tma_settings.json
                        • Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
                        • Size 143B
                        • SHA256 81254e53eec78fd81dec0d91151a4beb45a5a4f3ea7539989f68e6fa14e40dd8
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        tma_settings.json
                        • Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
                        • Size 359B
                        • SHA256 73c65f1457b771dff984d49526890dae9c214a927b461901abd705b5aeeb3477
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        tma_settings.json~RFe5a77f0.TMP
                        • Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe5a77f0.TMP
                        • Size 124B
                        • SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        Update.exe
                        • Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
                        • Size 2.4MB
                        • SHA256 57b83b3e87f7893533725ef2b65998380d441f2703d8f762c37476ac2feed323
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        downloading.gif
                        • Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
                        • Size 9KB
                        • SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        .ses
                        • Path C:\Users\Admin\AppData\Local\Temp\.ses
                        • Size 53B
                        • SHA256 e765488aa3e43b6c6f89698537b63a54ed8bf01314a62392433a0432fd57a600
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        CFGA0E5.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\CFGA0E5.tmp
                        • Size 150B
                        • SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        meeting-addin-t21-msi.log
                        • Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
                        • Size 1KB
                        • SHA256 caad26b915298c05ea4145d1164908be4a6a680c74b01284dd764e1c0155c86c
                        • MD5 SHA1 SHA512 TLSH
                        Submit Download

                        MSTeamsSetup.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gentee75\MSTeamsSetup.exe
                        • Size 1.3MB
                        • SHA256 52ab9768aeed9e5e99636cdc61be377566a8489897724228a21cd057f1c65147
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        guig.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\gentee75\guig.dll
                        • Size 20KB
                        • SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        unppmd.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\gentee75\unppmd.dll
                        • Size 8KB
                        • SHA256 d6f3429b8ffe80e1bc023de22bc23d9b4d384d89a9b22db51aa27c804581642d
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        zgqmQcC2.exe
                        • Path C:\Users\Admin\AppData\Local\Temp\gentee75\zgqmQcC2.exe
                        • Size 1.9MB
                        • SHA256 c49d5453efcaaf637ce889ad1429499144a4d185d83dfe975402e22fa66bfbfb
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        genteert.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
                        • Size 60KB
                        • SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        zgqmQcC2.tmp
                        • Path C:\Users\Admin\AppData\Local\Temp\is-9HMK4.tmp\zgqmQcC2.tmp
                        • Size 3.3MB
                        • SHA256 174a79d951cdf00b65a987e5a1e8aa628481b0f1fa0fad667fb4bc66e88f2013
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        1949ab3c.dll
                        • Path C:\Users\Admin\AppData\Local\Temp\is-PULHS.tmp\1949ab3c.dll
                        • Size 104KB
                        • SHA256 f9c684aa1f1cb47580f45d387f0fa956cb95bed7a13b3c0778d30be0062027bd
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        adddf.vbe
                        • Path C:\Users\Admin\AppData\Roaming\Teams\adddf.vbe
                        • Size 9KB
                        • SHA256 4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MSI9FDB.tmp
                        • Path C:\Windows\Installer\MSI9FDB.tmp
                        • Size 298KB
                        • SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        MSIB1C0.tmp
                        • Path C:\Windows\Installer\MSIB1C0.tmp
                        • Size 114KB
                        • SHA256 a97a4223b0d8d59f4a7ad04e84d4c2016804e8f0fecee8b1496d19d2127f7469
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        e5a9d0c.msi
                        • Path C:\Windows\Installer\e5a9d0c.msi
                        • Size 14.0MB
                        • SHA256 cba6e50a9d5d453771bcef4d193bebfa565febbd74a77821c2cb7954b969f77a
                        • MD5 SHA1 SHA512 SSDEEP TLSH
                        Submit Download

                        memory/976-961-0x000002972BAF0000-0x000002972BBA2000-memory.dmp
                        Download

                        memory/976-566-0x000002972BAF0000-0x000002972BBA2000-memory.dmp
                        Download

                        memory/976-257-0x00007FFD1ABE0000-0x00007FFD1ABE1000-memory.dmp
                        Download

                        memory/2120-41-0x0000000005A00000-0x0000000005A66000-memory.dmp
                        Download

                        memory/2120-38-0x0000000073770000-0x0000000073F2C000-memory.dmp
                        Download

                        memory/2120-40-0x0000000005940000-0x000000000594A000-memory.dmp
                        Download

                        memory/2120-37-0x0000000005210000-0x000000000522E000-memory.dmp
                        Download

                        memory/2120-36-0x0000000000500000-0x0000000000762000-memory.dmp
                        Download

                        memory/2120-57-0x0000000073770000-0x0000000073F2C000-memory.dmp
                        Download

                        memory/2120-54-0x0000000073770000-0x0000000073F2C000-memory.dmp
                        Download

                        memory/2120-53-0x0000000073782000-0x0000000073783000-memory.dmp
                        Download

                        memory/2120-49-0x000000000CB00000-0x000000000CB3E000-memory.dmp
                        Download

                        memory/2120-50-0x000000000CAE0000-0x000000000CAEE000-memory.dmp
                        Download

                        memory/2120-35-0x0000000073782000-0x0000000073783000-memory.dmp
                        Download

                        memory/2120-46-0x00000000071E0000-0x0000000007206000-memory.dmp
                        Download

                        memory/2120-43-0x00000000060E0000-0x000000000660C000-memory.dmp
                        Download

                        memory/2308-565-0x0000015D85880000-0x0000015D85932000-memory.dmp
                        Download

                        memory/2308-200-0x00007FFD1ABE0000-0x00007FFD1ABE1000-memory.dmp
                        Download

                        memory/4156-65-0x0000000000470000-0x0000000000548000-memory.dmp
                        Download

                        memory/4156-558-0x0000000000470000-0x0000000000548000-memory.dmp
                        Download

                        memory/4156-519-0x0000000000470000-0x0000000000548000-memory.dmp
                        Download

                        memory/5072-564-0x00000000028C0000-0x00000000028E2000-memory.dmp
                        Download

                        memory/5216-761-0x0000000004C80000-0x0000000004CBC000-memory.dmp
                        Download

                        memory/5216-760-0x0000000004C20000-0x0000000004C32000-memory.dmp
                        Download

                        memory/5216-747-0x0000000004BE0000-0x0000000004BEA000-memory.dmp
                        Download

                        memory/5216-743-0x0000000002A40000-0x0000000002A5A000-memory.dmp
                        Download

                        memory/5728-557-0x0000000000860000-0x0000000000BC4000-memory.dmp
                        Download

                        memory/5728-538-0x0000000000860000-0x0000000000BC4000-memory.dmp
                        Download