56d043a791def60f7f619ca93a1efc03419e1dd71e3c8b97decebcc1ad89f90f

Analysis

max time kernel
150s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 11:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
Size 7.3MB
Sample260731-m9qsja1fpg
SHA256 56d043a791def60f7f619ca93a1efc03419e1dd71e3c8b97decebcc1ad89f90f
MD5 bb7e2dee53a4bc17ce47dcf91a32a8d8
SHA1 c97885f4a6f802bc93498fb9ad86a4df8647f7f6
SHA512 51175e7becd6c992b0187575c072639b7c3189f973735fd2900c9cf83218dfedabd267cc4b6b52f28884a0b791b455e7d137e6dbc9e05ab4d59a803f124507e0
SSDEEP 196608:o0DiBKen57LpFX0ljoUkmGl/2jfXzSuerc6m7L:oBT77E6mqkmuerP+
TLSH
T1D476339C73049F22F13D8970CAF19703CC9E41351E2239937782A7F1A65BFD29A95AD8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

adware discovery execution installer persistence privilege_escalation spyware stealer

Malware Config

Signatures

Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 1 IoCs

resource	yara_rule
behavioral2/memory/4740-495-0x0000000002BC0000-0x0000000002BE8000-memory.dmp	INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 6 IoCs

pid	Process
5204	MSTeamsSetup.exe
2808	Update.exe
1244	zgqmQcC2.exe
5896	zgqmQcC2.tmp
4740	MicrosoftPhotos.exe
252	MicrosoftPhotos.exe

Loads dropped DLL 11 IoCs

pid	Process
4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
5896	zgqmQcC2.tmp
2272	rundll32.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe
4964	MsiExec.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Windows\CurrentVersion\Run\Teams = "\"C:\\Users\\Admin\\AppData\\Local\\Microsoft\\WindowsApps\\MSTeams_8wekyb3d8bbwe\\ms-teams.exe\" msteams:system-initiated"	ms-teams.exe

Enumerates connected drives 3 TTPs 45 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\B:	MicrosoftPhotos.exe
File opened (read-only)	\??\I:	MicrosoftPhotos.exe
File opened (read-only)	\??\O:	MicrosoftPhotos.exe
File opened (read-only)	\??\U:	MicrosoftPhotos.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	MicrosoftPhotos.exe
File opened (read-only)	\??\Y:	MicrosoftPhotos.exe
File opened (read-only)	\??\Z:	MicrosoftPhotos.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	MicrosoftPhotos.exe
File opened (read-only)	\??\V:	MicrosoftPhotos.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	MicrosoftPhotos.exe
File opened (read-only)	\??\L:	MicrosoftPhotos.exe
File opened (read-only)	\??\S:	MicrosoftPhotos.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\M:	MicrosoftPhotos.exe
File opened (read-only)	\??\P:	MicrosoftPhotos.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\H:	MicrosoftPhotos.exe
File opened (read-only)	\??\K:	MicrosoftPhotos.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\R:	MicrosoftPhotos.exe
File opened (read-only)	\??\T:	MicrosoftPhotos.exe
File opened (read-only)	\??\W:	MicrosoftPhotos.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\G:	MicrosoftPhotos.exe
File opened (read-only)	\??\N:	MicrosoftPhotos.exe
File opened (read-only)	\??\X:	MicrosoftPhotos.exe

Looks up external IP address via web service 1 TTPs 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	api64.ipify.org

Network Share Discovery 1 TTPs
Attempt to gather information on host network.
discovery

Network Share Discovery
T1135

Executes a VBScript file via the Windows Script Host. 1 TTPs 1 IoCs

execution

Visual Basic

T1059.005

pid	Process
2140	cscript.exe

Drops file in Windows directory 21 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5728_1090586595\manifest.json	msedgewebview2.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF9CE28101507C9805.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC2AEC9C5209B3BBE.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5728_1090586595\ct_config.pb	msedgewebview2.exe
File created	C:\Windows\Installer\e5aa7ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAAF8.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFABBFB9EFDBBF7D1E.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{A7AB73A3-CB10-4AA5-9D38-6AEFFBDE4C91}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAD6A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBBA3.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5728_1090586595\crs.pb	msedgewebview2.exe
File created	C:\Windows\Installer\e5aa7af.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIBED1.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5728_1090586595\kp_pinslist.pb	msedgewebview2.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping5728_1090586595\manifest.fingerprint	msedgewebview2.exe
File opened for modification	C:\Windows\Installer\e5aa7ab.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAA2C.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFAAA67F6324494345.TMP	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	rundll32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgqmQcC2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zgqmQcC2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftPhotos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSTeamsSetup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Update.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftPhotos.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Inno Setup is an open-source installation builder for Windows applications. 3 IoCs

Inno Setup installer

installer

resource	yara_rule
behavioral2/files/0x000e00000001c4c8-56.dat	innosetup
behavioral2/memory/1244-58-0x00000000006A0000-0x0000000000778000-memory.dmp	innosetup
behavioral2/memory/1244-492-0x00000000006A0000-0x0000000000778000-memory.dmp	innosetup

Checks processor information in registry 2 TTPs 26 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MicrosoftPhotos.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teams.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MicrosoftPhotos.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\ProcessorNameString	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teamsupdate.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\1\~MHz	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	ms-teamsupdate.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedgewebview2.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedgewebview2.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\Bios	ms-teams.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	ms-teams.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\Registry\user\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\msteams\WarnOnOpen = "0"	ms-teams.exe
Key created	\Registry\user\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-teams	ms-teams.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000\Software\Microsoft\Internet Explorer\ProtocolExecute\ms-teams\WarnOnOpen = "0"	ms-teams.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect\CurVer\FriendlyName = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ = "mscoree.dll"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\RuntimeVersion = "v4.0.30319"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ms-teams	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\1.26.16801\Assembly = "Microsoft.Teams.MeetingAddin, Version=1.26.16801, Culture=neutral, PublicKeyToken=null"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Key created	\Registry\User\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ms-teams	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ = "FastConnect Class"	msiexec.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\UserEnabledStartupOnce = "0"	Update.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\msteams\shell\open	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x64\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect.1\CLSID\ = "{19A6E644-14E6-4A60-B8D7-DD20610A871D}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\InprocServer32	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories\{62C8FE65-4EBB-45e7-B440-6E39B2CDBF29}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ms-teams\shell	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect.1\ = "FastConnect Class"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\RuntimeVersion = "v4.0.30319"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect.1	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect\CurVer\Description = "Microsoft Teams Meeting Add-in for Microsoft Office"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Microsoft.Teams.Meeting.Addin.MOControl\ = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\ThreadingModel = "Apartment"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\Version\ = "1.0"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\msteams\shell\open\command	ms-teams.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ms-teams\shell\open	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect\ = "FastConnect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x64\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\ProgID\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect\CurVer	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.Connect.1\ = "Connect Class"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\VersionIndependentProgID\ = "TeamsAddin.FastConnect"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib\ = "{C0529B10-073A-4754-9BB0-72325D80D122}"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\Implemented Categories	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}\TypeLib	msiexec.exe
Key created	\Registry\User\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ms-teams\shell\open\command	ms-teams.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x86\\Microsoft.Teams.AddinLoader.dll"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{19A6E644-14E6-4A60-B8D7-DD20610A871D}	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\ProgID\ = "Microsoft.Teams.Meeting.Addin.MOControl"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\TypeLib\{C0529B10-073A-4754-9BB0-72325D80D122}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Microsoft\\TeamsMeetingAdd-in\\1.26.16801\\x86\\"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\MSTeams_8wekyb3d8bbwe\TeamsTfwStartupTask\ShowNotification = "1"	Update.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.FastConnect\CurVer\ = "TeamsAddin.FastConnect.1"	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\WOW6432Node\CLSID\{EABAE40C-B27C-455A-B672-F234DD780948}\InprocServer32\Class = "Microsoft.Teams.MeetingAddin.View.Controls.MeetingOptionsControl"	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\TeamsAddin.Connect.1\CLSID	msiexec.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2301830172-776172150-2531349243-1000_Classes\ms-teams\URL Protocol	ms-teams.exe

Suspicious behavior: EnumeratesProcesses 22 IoCs

pid	Process
4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
5896	zgqmQcC2.tmp
5896	zgqmQcC2.tmp
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4928	msiexec.exe
4928	msiexec.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe
4740	MicrosoftPhotos.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5728	msedgewebview2.exe
5728	msedgewebview2.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2808	Update.exe
Token: SeBackupPrivilege	6012	ms-teams.exe
Token: SeShutdownPrivilege	5480	ms-teamsupdate.exe
Token: SeIncreaseQuotaPrivilege	5480	ms-teamsupdate.exe
Token: SeSecurityPrivilege	4928	msiexec.exe
Token: SeCreateTokenPrivilege	5480	ms-teamsupdate.exe
Token: SeAssignPrimaryTokenPrivilege	5480	ms-teamsupdate.exe
Token: SeLockMemoryPrivilege	5480	ms-teamsupdate.exe
Token: SeIncreaseQuotaPrivilege	5480	ms-teamsupdate.exe
Token: SeMachineAccountPrivilege	5480	ms-teamsupdate.exe
Token: SeTcbPrivilege	5480	ms-teamsupdate.exe
Token: SeSecurityPrivilege	5480	ms-teamsupdate.exe
Token: SeTakeOwnershipPrivilege	5480	ms-teamsupdate.exe
Token: SeLoadDriverPrivilege	5480	ms-teamsupdate.exe
Token: SeSystemProfilePrivilege	5480	ms-teamsupdate.exe
Token: SeSystemtimePrivilege	5480	ms-teamsupdate.exe
Token: SeProfSingleProcessPrivilege	5480	ms-teamsupdate.exe
Token: SeIncBasePriorityPrivilege	5480	ms-teamsupdate.exe
Token: SeCreatePagefilePrivilege	5480	ms-teamsupdate.exe
Token: SeCreatePermanentPrivilege	5480	ms-teamsupdate.exe
Token: SeBackupPrivilege	5480	ms-teamsupdate.exe
Token: SeRestorePrivilege	5480	ms-teamsupdate.exe
Token: SeShutdownPrivilege	5480	ms-teamsupdate.exe
Token: SeDebugPrivilege	5480	ms-teamsupdate.exe
Token: SeAuditPrivilege	5480	ms-teamsupdate.exe
Token: SeSystemEnvironmentPrivilege	5480	ms-teamsupdate.exe
Token: SeChangeNotifyPrivilege	5480	ms-teamsupdate.exe
Token: SeRemoteShutdownPrivilege	5480	ms-teamsupdate.exe
Token: SeUndockPrivilege	5480	ms-teamsupdate.exe
Token: SeSyncAgentPrivilege	5480	ms-teamsupdate.exe
Token: SeEnableDelegationPrivilege	5480	ms-teamsupdate.exe
Token: SeManageVolumePrivilege	5480	ms-teamsupdate.exe
Token: SeImpersonatePrivilege	5480	ms-teamsupdate.exe
Token: SeCreateGlobalPrivilege	5480	ms-teamsupdate.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe
Token: SeRestorePrivilege	4928	msiexec.exe
Token: SeTakeOwnershipPrivilege	4928	msiexec.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
2808	Update.exe
6012	ms-teams.exe
6012	ms-teams.exe
5896	zgqmQcC2.tmp
6012	ms-teams.exe
6012	ms-teams.exe
6012	ms-teams.exe
6012	ms-teams.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
6012	ms-teams.exe
6012	ms-teams.exe
6012	ms-teams.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4928	msiexec.exe
4964	MsiExec.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2140	4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe	89
PID 4348 wrote to memory of 5204	4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe	91
PID 5204 wrote to memory of 2808	5204	MSTeamsSetup.exe	92
PID 4348 wrote to memory of 1244	4348	2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe	98
PID 1244 wrote to memory of 5896	1244	zgqmQcC2.exe	100
PID 6012 wrote to memory of 5728	6012	ms-teams.exe	102
PID 5728 wrote to memory of 4560	5728	msedgewebview2.exe	103
PID 5728 wrote to memory of 1596	5728	msedgewebview2.exe	105
PID 5728 wrote to memory of 1596	5728	msedgewebview2.exe	105
PID 5728 wrote to memory of 1596	5728	msedgewebview2.exe	105
PID 5728 wrote to memory of 1596	5728	msedgewebview2.exe	105
PID 5728 wrote to memory of 3088	5728	msedgewebview2.exe	106
PID 5728 wrote to memory of 3324	5728	msedgewebview2.exe	107
PID 5728 wrote to memory of 3324	5728	msedgewebview2.exe	107
PID 5728 wrote to memory of 3324	5728	msedgewebview2.exe	107
PID 5728 wrote to memory of 3376	5728	msedgewebview2.exe	108
PID 5728 wrote to memory of 3376	5728	msedgewebview2.exe	108
PID 5728 wrote to memory of 3376	5728	msedgewebview2.exe	108
PID 5728 wrote to memory of 3376	5728	msedgewebview2.exe	108
PID 5728 wrote to memory of 3376	5728	msedgewebview2.exe	108
PID 5728 wrote to memory of 2232	5728	msedgewebview2.exe	110
PID 5728 wrote to memory of 2232	5728	msedgewebview2.exe	110
PID 5728 wrote to memory of 2232	5728	msedgewebview2.exe	110
PID 5728 wrote to memory of 2232	5728	msedgewebview2.exe	110
PID 5728 wrote to memory of 2232	5728	msedgewebview2.exe	110
PID 4740 wrote to memory of 5724	4740	MicrosoftPhotos.exe	117
PID 2080 wrote to memory of 2272	2080	rundll32.exe	119
PID 6012 wrote to memory of 5480	6012	ms-teams.exe	120
PID 6012 wrote to memory of 2360	6012	ms-teams.exe	121
PID 4928 wrote to memory of 4964	4928	msiexec.exe	123
PID 5728 wrote to memory of 2360	5728	msedgewebview2.exe	126
PID 5728 wrote to memory of 2360	5728	msedgewebview2.exe	126
PID 5728 wrote to memory of 2360	5728	msedgewebview2.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_bb7e2dee53a4bc17ce47dcf91a32a8d8_elex_wannacry.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Windows\SysWOW64\cscript.exe
  cscript.exe /nologo "C:\Users\Admin\AppData\Roaming\Quh54cfx\adddf.vbe" C:\
  2⤵
  - Executes a VBScript file via the Windows Script Host.
  - System Location Discovery: System Language Discovery
  PID:2140
- C:\Users\Admin\AppData\Local\Temp\gentee0A\MSTeamsSetup.exe
  "C:\Users\Admin\AppData\Local\Temp\gentee0A\MSTeamsSetup.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5204
- - C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
    "C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe" --install . --exeName=MSTeamsSetup.exe --bootstrapperMode
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:2808
  - - C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teams.exe
      "C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teams.exe" msteams:?instVersion=3.7.16&instExecTime=1785496283782&launchSrc=t2installer
      4⤵
      Adds Run key to start application
      Checks processor information in registry
      Enumerates system info in registry
      Modifies Internet Explorer settings
      Modifies registry class
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of FindShellTrayWindow
      Suspicious use of SendNotifyMessage
      Suspicious use of WriteProcessMemory
      PID:6012
    - - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --enable-features=MojoIpcz,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2SetUserAgentOverrideOnIframes,PartitionedCookies,ThirdPartyStoragePartitioning,msWebView2TextureStream,msWebView2EnableDraggableRegions,msAbydos,msAbydosHandwritingAttr,msAbydosGestureSupport --gpu-watchdog-timeout-seconds=60 --isolate-origins=https://[*.]microsoft.com,https://[*.]sharepoint.com,https://[*.]sharepointonline.com,https://mesh-hearts-teams.azurewebsites.net,https://[*.]meshxp.net,https://res-sdf.cdn.office.net,https://res.cdn.office.net,https://copilot.teams.cloud.microsoft,https://local.copilot.teams.office.com,https://m365copilotchat.svc.cloud.microsoft,https://m365copilotapp.svc.cloud.microsoft --js-flags=--stack-trace-limit=50 --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=6012.4728.16886742225043729701 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        5⤵
        Drops file in Windows directory
        Enumerates system info in registry
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of WriteProcessMemory
        
        PID:5728
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView /prefetch:4 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x184,0x188,0x18c,0x180,0x15c,0x7ffa30ae5fd8,0x7ffa30ae5fe4,0x7ffa30ae5ff0
        6⤵
        
        PID:4560
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --gpu-watchdog-timeout-seconds=60 --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1728 --field-trial-handle=1740,i,269382722373275218,16609945570367441194,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:1596
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2020 --field-trial-handle=1740,i,269382722373275218,16609945570367441194,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:3088
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2280 --field-trial-handle=1740,i,269382722373275218,16609945570367441194,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:3324
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --mojo-platform-channel-handle=3664 --field-trial-handle=1740,i,269382722373275218,16609945570367441194,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 /prefetch:1
        6⤵
        
        PID:3376
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --disable-background-timer-throttling --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --js-flags="--stack-trace-limit=50 --harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=en-US" --mojo-platform-channel-handle=4328 --field-trial-handle=1740,i,269382722373275218,16609945570367441194,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26 /prefetch:1
        6⤵
        
        PID:2232
      - C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe
        
        "C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView" --webview-exe-name=ms-teams.exe --webview-exe-version=26183.1903.4892.4448 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=4924 --field-trial-handle=1740,i,269382722373275218,16609945570367441194,262144 --enable-features=MojoIpcz,PartitionedCookies,ThirdPartyStoragePartitioning,msAbydos,msAbydosGestureSupport,msAbydosHandwritingAttr,msSingleSignOnOSForPrimaryAccountIsShared,msWebView2EnableDraggableRegions,msWebView2SetUserAgentOverrideOnIframes,msWebView2TextureStream --disable-features=msEnhancedTrackingPreventionEnabled,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:0d596a59e8915878bea1af71a068eef6dd16cd26
        6⤵
        
        PID:2360
    - - C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -EnsureTmaInstallation -AppSessionGUID 5598d5af-4729-40b9-bb16-1d7dcc741e8b -Trigger EnsureTmaAtStartup
        5⤵
        Checks processor information in registry
        Suspicious use of AdjustPrivilegeToken
        
        PID:5480
    - - C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe
        
        "C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teamsupdate.exe" -RegisterBackgroundUpdater -AppSessionGUID 5598d5af-4729-40b9-bb16-1d7dcc741e8b -Trigger SchedulerDirectLaunch -BgTaskDelay 1590
        5⤵
        Checks processor information in registry
        
        PID:2360
- C:\Users\Admin\AppData\Local\Temp\gentee0A\zgqmQcC2.exe
  "C:\Users\Admin\AppData\Local\Temp\gentee0A\zgqmQcC2.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1244
- - C:\Users\Admin\AppData\Local\Temp\is-HA7S7.tmp\zgqmQcC2.tmp
    "C:\Users\Admin\AppData\Local\Temp\is-HA7S7.tmp\zgqmQcC2.tmp" /SL5="$B01E6,1022596,821760,C:\Users\Admin\AppData\Local\Temp\gentee0A\zgqmQcC2.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    PID:5896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1664

C:\Program Files\WindowsApps\MSTeams_26183.1903.4892.4448_x64__8wekyb3d8bbwe\ms-teams.exe
"C:\Users\Admin\AppData\Local\Microsoft\WindowsApps\MSTeams_8wekyb3d8bbwe\ms-teams.exe" msteams:system-initiated
1⤵
- Checks processor information in registry
PID:2692

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\9e314ca7.dll,dLXs4hgCwCw
1⤵
- Suspicious use of WriteProcessMemory
PID:2080
- C:\Windows\SysWOW64\rundll32.exe
  "C:\Windows\System32\rundll32.exe" C:\ProgramData\MicrosoftDevKit\9e314ca7.dll,dLXs4hgCwCw
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:2272

C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
"C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:252

C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
1⤵
- Executes dropped EXE
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4740
- C:\Windows\SysWOW64\schtasks.exe
  schtasks /run /tn MicrosoftToolKit
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5724

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe
1⤵
PID:2572

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding C9884F5DA6D98B8BB4CAB47FCAC38F46
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Visual Basic

T1059.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Network Share Discovery

T1135

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e5aa7ae.rbs

Path C:\Config.Msi\e5aa7ae.rbs
Size 358KB
SHA256 923e316f9004c5f40882f24dcb26f7619599746a4f052dcc38ac04f436472531
MD5 47791030dc9ec962ab108cfec0b93a80
SHA1 f7cf5f948623a58b4fa74db7f1424ae26adc4588
SHA512 72a42252df2c491e672bbceaa61102a3e2ac672ba0f6129b585cf52fd427c72b18506dd0cc3ec114337146dff858f6d5569075d16656914a4dde69846e6d6b2f
SSDEEP 3072:2eSzDNoS8SgMe+jVrrb1MMBRMoly1DhI4S8SgMe+jVrrb1MMBRMoly1DhITskfav:2eSzCVkp11O39Vkp11O31
TLSH
T17E746C12AB41CDB2C87C357202B07A9D713EF6672AC1BE9F8B04D6680F567D4F319A52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e314ca7.dll

Path C:\ProgramData\MicrosoftDevKit\9e314ca7.dll
Size 145KB
SHA256 7028ae19b5019049600c30833aac6bb0a19ae41b3a908e79e2d7f6aa1a2ac4a3
MD5 bea4093c3ea1270cad31f7d619895410
SHA1 b42fc5f30d1c50797cf2470da47df69b5f9ba029
SHA512 19ebf179ffc6557a77da41b31c3208dc9003ca9626213de65fc3c304c714c9dfda9b18953bcbb4793f4329501019b21f1ec6c7184fc9ad7a9b4690c31e21b73b
SSDEEP 3072:d1U+y/dpYoBlRo8lvmwgsGVtpFXV3WDg2nIjyRoww4wcdcv:d1Ujdp588dVGrADg2IeKn
TLSH
T1C8E38C4079C1C072D5BE28340AB9DB724B3D79501B78CDCB67D45EBA9E306C0AA35E6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MicrosoftPhotos.exe

Path C:\ProgramData\MicrosoftDevKit\MicrosoftPhotos.exe
Size 116KB
SHA256 7557e8d113abaac3ec4bf74befe13167b993d9da37e7aa9cdc4c79d4cef9079d
MD5 31a5c11460f89ae28276938f22cc6572
SHA1 3391b4c192206e24e51db62bdcbf566f1c19f391
SHA512 dffef5ce38acf4019c47edf5a436bd7b58b62530b56151eab4f52eb594f847534ccd8370e9c3efa37ede05fccb454b1e270a2686bf69ca3f5fa0492bfa8015d2
SSDEEP 3072:zUhWBPhyr9Y7q5Ur7YJR6sqxZRplHPX9iAB2:YYph8cHYJRAjlv6
TLSH
T17DC3020FF321C421C461B9B12605EA7EC955101A2BF2D0175729AFF5B4D3BFD69338AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 471B
SHA256 39014cccf3ff51ab83f0a781e8b0e37ac01a7bf6b35a54ff5ff3b476f85c2a77
MD5 8c1c2cd8621ae3ef54e34e03e2627e0f
SHA1 940762ea08fd64b670ac50ca38f63b53be931fe7
SHA512 3912231931b6c6e6a6b4f184928e11e860f4f0ff4f8632453c59e094595a55c9c0714e9bc188aedfc2a38f619762a0b2ced173b27becef3f7c0950ed1bacc747
TLSH
T167F0D45340BFE0E13D875CDD1DF81A7F1824CADB00D866C9642944B1C59437CD71A479
MD5 SHA1 SHA512 TLSH

Submit Download

E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E2C6CBAF0AF08CF203BA74BF0D0AB6D5_EAF5D55D93603A879FA973006301F24F
Size 412B
SHA256 20a9919ebe13873a2c580f4fe2808abd4fee4342ff5359b9b594cc4b55b7e289
MD5 c2a1121fe35c98fdf114cd80757ca49e
SHA1 e821687881072f60ca505cbbdd9b7a322114f379
SHA512 4bbbc611ee1c28fe523116dd1102453394f1f58aefb0ee4f6b6c3c9cf6b67e5641b74cd18a87fb8906f59a61b5a42546287bc8dc6057c02139f62a482cfd81ae
TLSH
T102E0C02415F7411DF0F1C13547DA7524885AF0228810A2B11BD017046706B84FC22E34
MD5 SHA1 SHA512 TLSH

Submit Download

AddinInstaller.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\AddinInstaller.dll
Size 35KB
SHA256 4d40809f0fe018208d825047bb01df29343ac4cd5fffd8a28e3b39840b197cb1
MD5 c46985c1bae0c78c59c1a71aba231d96
SHA1 75f5c4273ae908ee5f051e25c5fad43090a8959b
SHA512 f9c435dec84fb06b92a64a4309717adfb9a1382e48a42810bca638b3b60576aa433def377f5f4cb0e232d2819e29207f4527ab27b6e5d84a8343d8842d53ff43
SSDEEP 384:XBlT5P3LVITaIJN+g0fAA3MSYlhx40dGCtucaGAh0RXki+R9zCfnVO2y4GlNmt15:7JLNIDER3wl00QCgbh0c9zCu+3P9zm6
TLSH
T1DBF21791A7F88107FAFB6F706AB4D5022DB9BF865C30D96E15C5A14D0C63BC4CA2173A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Microsoft.IdentityModel.JsonWebTokens.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\x64\Microsoft.IdentityModel.JsonWebTokens.dll
Size 66KB
SHA256 041946c132c0561ce8d0a1b0f74eb979d69660deda241bef4a0570f1cd1d9289
MD5 622623a04c985eeaa82d2a1f15d508cf
SHA1 f6e6bcc42d1e1bf0dc7d635beb4a1f063a4f2b66
SHA512 46027876fd165c8399e3896ab6bcba034bb69cc5e67c68fadb40101db05eb81882b12f86bfb75845155bb94d08c9c7d1c97461f1677b0cbe6b71e3a8358a6f81
SSDEEP 1536:gm6516C0z6v8JyJNPk2DuttJ6gDEkeLJu1FzaO:gmqEC0zhyJNPktDXiMWO
TLSH
T1BB630685A7EC8354F6FF3B316AF1510158BABD8AA839E74D1D80D29F2D23B408B50776
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

System.IdentityModel.Tokens.Jwt.dll

Path C:\Users\Admin\AppData\Local\Microsoft\TeamsMeetingAdd-in\1.26.16801\x64\System.IdentityModel.Tokens.Jwt.dll
Size 81KB
SHA256 15aa3a16426b1281f0a4cecafc2a054bb29b7f3d09b3048f048ebf67c4f53e1a
MD5 ef26e784474ef5ee4c86225829784bd6
SHA1 db058e83d7b6cde77821d9da640f7b169fd80e07
SHA512 7621855326125262ffa2de6577d79fbc20f60f0aad3aa6fd42006ab806438cf262e18cabb802eacb1337b7de424fa32c543b8315436d05e519a29458405ef706
SSDEEP 1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gq:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0l
TLSH
T19B8391043BFD5649F2FBAF3D68B054050976BE5AAC31D78D1DA0928E4873F809A60B77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 b318126d75ab836f097b02c2e602ac5dee5cf251311e0a4998c5875a3f61f112
MD5 c167e47370335ff342cca408e039dec4
SHA1 69bff22464ffc508975fb5bfabd68b70ff26a93d
SHA512 a7b5a5c2e96bafdd0a001467f361265063a937ebb87c3f1620b1fcde98e82423d53ec9bfd73487a200d49db2aa62371536216f188192300b6367fccc48d2df16
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\settings.dat
Size 280B
SHA256 3d7944510bb4fd580bf3c714be6ab4770b766f7115b0f874d2650636e9854d4c
MD5 e1068e5e707e60addbd37b46831bf701
SHA1 33859c229b9fad144cfadab6d412d79bf2ada068
SHA512 c83df98773466c36199479c4c772c7c6b747d469167e982f992e2d87c855e6cf27a5e1973e5baa0d3f432bac5b50466768f2610f314694f7bbf00d4c756ca6f1
TLSH
T134D0121232214134C01020730812B1080581C30B40154010D47EC92D1A480595D03442
MD5 SHA1 SHA512 TLSH

Submit Download

throttle_store.dat

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Crashpad\throttle_store.dat
Size 20B
SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
MD5 9e4e94633b73f4a7680240a0ffd6cd2c
SHA1 e68e02453ce22736169a56fdb59043d33668368f
SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension Scripts\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Extension State\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Default\Shared Dictionary\cache\index
Size 24B
SHA256 fbcfe23a2ecb82b7100c50811691dde0a33aa3da8d176be9882a9db485dc0f2d
MD5 54cb446f628b2ea4a5bce5769910512e
SHA1 c27ca848427fe87f5cf4d0e0e3cd57151b0d820d
SHA512 8f6ed2e91aed9bd415789b1dbe591e7eab29f3f1b48fdfa5e864d7bf4ae554acc5d82b4097a770dabc228523253623e4296c5023cf48252e1b94382c43123cb0
MD5 SHA1 SHA512

Submit Download

data_0

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_0
Size 8KB
SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
MD5 cf89d16bb9107c631daabf0c0ee58efb
SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
SSDEEP 3:MsFl:/F
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_1

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_1
Size 264KB
SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
MD5 d0d388f3865d0523e451d6ba0be34cc4
SHA1 8571c6a52aacc2747c048e3419e5657b74612995
SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_2

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_2
Size 8KB
SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
MD5 0962291d6d367570bee5454721c17e11
SHA1 59d10a893ef321a706a9255176761366115bedcb
SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
SSDEEP 3:MsHlDll:/H
MD5 SHA1 SHA512 SSDEEP

Submit Download

data_3

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\GraphiteDawnCache\data_3
Size 8KB
SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
MD5 41876349cb12d6db992f1309f22df3f0
SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
SSDEEP 3:MsGl3ll:/y
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 2KB
SHA256 a170e5d531506fd4826bf9043aa2a2c4a428297baccd3cf160873f49280eb980
MD5 9069b64d135cbaa4bf04b79b7b25942b
SHA1 48c8c6ed22979b3867ab00ed4df532e5f8b6a5f6
SHA512 4528a1ee7de79b3f0dc7f2c41ede0eb68cf5fc09b51aaf80be19fddffc28d88836a4fb640996fd619621e7ddfde43dbce7d09a8b0aae3887674a7441f804ef1c
TLSH
T1DF5195337864AA3B95F65709BE4B3E239E768063EA512F11DADD0B1800D776C2302C33
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 3KB
SHA256 60596099146cc0f1da4331a917badfa94f96a48dcaf7954d1e3b7479a8467ea0
MD5 75ef2fe2940fb362c6f4e50a5b296eaf
SHA1 934399d99f98eba31a5fb7fd6bf6979a81e6f488
SHA512 cb95e6a2df4c7f2f98e1771d8e1660e336325adc2f4e66521b013356bab7d0a1797300e7f225ac01784c97d8abd8f01be7debfc777179999de18873da552cb0d
TLSH
T1FF6185376974A93B5DF69B05BD8B3B16ABA54023E5953FA5DAEC0F0D01D73982302C23
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 4KB
SHA256 bea5ba4cf85cabdf24fdb33191da4e50c486fd86da925f65a3aec7eaacbccbe3
MD5 350489ec6e55b587ec569e07e8ffa50d
SHA1 93216af7c85acc217ab7a24928d7e5090f7f2a67
SHA512 61e2f2c73c7b3b18ee707d259706bd94823ff6f93d75ffe4f10b61aa3b08f03de49b5ed88a0c206a27803a79ff251e576adeed34029f18b29084f23b4660b326
SSDEEP 96:nNkGS3fnmV+h58kh/cI9URoDotowxs8kh/cI9URoDotoUGy5VvB980e6ZAZutaZL:nNBSP3xeoDUlceoDUTX980Lty7/
TLSH
T18391652A6574A96B5EF6AA05BD863B0677E54033E5C53FA9C6FC0F0D02973D81342C13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State
Size 16KB
SHA256 7494bf130ee4be684b420f82585905f6e071f3b63d711311902e3ccf2a335d26
MD5 15b7395dd36a42269cff83c71d461834
SHA1 ac5ad21b90b24148bdcc327f06b53f6cb7f8b5f0
SHA512 936effae271389ad8a4bc489a1fc96d542ca9e38b15642ad7f5bf89a197510e9e1b02b2559b3d7b4a6eda9965309cb3af3c48d620052e87dd7dc556d7ac88fb2
SSDEEP 384:3+aQikB+z/xvxjg/qhEwNBSiRVi9/LtasOz9zI:G/UxvxjgC+6G9paTFI
TLSH
T1A2728D2B65787D2766F3A6047E4A574B9AF98473D0C27EB8C9F95F0E16873D40302812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State~RFe5a1704.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\Local State~RFe5a1704.TMP
Size 1KB
SHA256 0969c73d71b98e94fe39ad9bfa0372969651c35084c44b4feefa1fab9bc6d8b9
MD5 b43c5c9a1f3c8b726e9eb864d4e06033
SHA1 b14505e088264a1b1001f1a54dbd382e2e34ed42
SHA512 3717abf92b3816adbb457f58bef0c817d2fbeeb29fb3b0e1d9f9200ecf55f7a4f4b7f18daac442bc46103aa8c382cc62a217f8ac8ea097a51fb6cb28a31f9cc4
TLSH
T1582165B3A9B44A37B8A5731677077E1B5E614067D2504D00A5DD8B1D11E37ACAA13C32
MD5 SHA1 SHA512 TLSH

Submit Download

439f3201-d693-4786-aa71-e69f171fe655.tmp

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\439f3201-d693-4786-aa71-e69f171fe655.tmp
Size 6KB
SHA256 b9c821e2452de1413b383a57d1b243e9e5e27650ce4850f740489eeb17efff5d
MD5 5e3fd82b0b0dfe25108414e92ab08a8a
SHA1 bc1323397ccfc466dda3fc554fb96dc90ea18dd1
SHA512 1615b62c82c6d024237ce1bef6506825d8aa93f95b81bb2df66c1e2b8f7c707dfe01c52d65fb406ec275dc6728d7667229a45b9ecec8dc32f564df0f67b8a8f9
SSDEEP 96:stMRUBuFzb9bkMo5h16ZEjgs7/x+6Mb+4m+4Kmuec0+4GO1ejey+4rK+gzrl28XE:sttgjohgsV+FFgfGOQjf2fG6K
TLSH
T122D194466A28697F4CCAE116FB24B613E2F56033B5912D59EBF8861C04EB6DC6307C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 324fe5b6fae42a1afd002b7e42cee82882d3a512b6bc4e1fede1599687bd609d
MD5 0d238d5b0028bf91d1849be568623ce5
SHA1 f4364cc0244ac92b0940ce45767539b9bd08840e
SHA512 caa1a60a6cfe06f017e46600fee304956c7fca9a4b966548411557624a07c2e7768d4f494c7cfe33e6fa632d51df9530573eb22573d97603d817dd77e14e5494
TLSH
T1BB312D4CA5E7AA84CFA890B0C6950E0BBDD0D165CA0FD3871E90504DC32F6C381B9647
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 cf3278c7f129c802dfa2ca5d0d4167c051c21b34af753ff0f00c65f7b7a8f3e8
MD5 8799c17d3561d73758a3aaa306d0670e
SHA1 dd08f4f334de86046d3d7d733c8bdd65d4bf3ae6
SHA512 f4083969326ef45e2e9b081f72f03c124086f4bafc9016be55decc735baf9fd32dbb847378cd3f39f2b556a077846c0df0dc244b76491c77161eb9795fdf78d3
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
TLSH
T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\Network Persistent State
Size 537B
SHA256 58f0d7e61e0bfe2140f00bdfadd8dcd6c49b8de205fdd10dbb7e609083966dcb
MD5 bed1934bb67530ede3c547748aabb942
SHA1 351fa2196176cfdad6915f9c02c1aa9baa42946b
SHA512 084388ec73e71f5206f38da89c9299cf6a428d3d516526d1b1c251446f1b85556718a457e885b82b7692cbfc04c496c0d29e92ffd707560fa9a63dc83fd079c7
TLSH
T120F046B7073018AE8A4482E41A18DE1BEE6C0153030C68788684BE73D273062E006647
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\84fefc88-3d58-4b43-8d56-a8a444b10603\index-dir\the-real-index
Size 96B
SHA256 9f531b3afdcc6c28ab45b98f505f777d5c4f0276420a64760d6bb7cb4f40cf85
MD5 1424cca2fc3362544c433f77a3e2c5b1
SHA1 8635a6571d8aef301323a6c7f38aa11b99d0e9f7
SHA512 6f24688fc37dae377730c84946fd0eb2265ba48f57c8e5cf9fc15a3387c9f606d340a538f9a1388e6830acf0367231df2b332ef0ba883a4e24e6f44e69ddcd36
TLSH
T10CB0041D07304035C00157FF1545C5D1737D1D1CD553535171545574CC7D757415137C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a75dd.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\84fefc88-3d58-4b43-8d56-a8a444b10603\index-dir\the-real-index~RFe5a75dd.TMP
Size 48B
SHA256 ca06a275f6eb4f06feab41ad2c31d1ca2362c165651c227acfa54fb30c2f4037
MD5 ec8670e0bfb0a7985807dbc3a7ed1015
SHA1 19d6b9290358214628a66df6b97a1f6f0b64e544
SHA512 79377da3b8f04eff6829d94d7e5020e166347833eed00b96239c28862a468dd62934450ea5bd3a065354fdb6103e5f1449c714059d423604570cd4c0bd532cdb
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\88cbe483-fd80-4376-ad4e-24c261542227\index-dir\the-real-index
Size 96B
SHA256 ca100b2e9be0abedfae1028f103010f07ff379bf6f5d9d098292a64b727d8409
MD5 94870e3bf59c003af63cefb95eb61801
SHA1 c397a86ffffdf10bcfce2820e4df9d1e03fcfaa0
SHA512 ab714d5f660af7a83b708fedba125e924e1267346a54d88db16a00a9f992637cc996d9988895867f967e8e86857edd661ba443ed47bc6f2f6e1e6fcfc3aa7cb1
TLSH
T1A8B002E4AD105996F22607FB9BD215C0373C0FE847435B2E67D419ABDCA63C486D1152
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a7744.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\88cbe483-fd80-4376-ad4e-24c261542227\index-dir\the-real-index~RFe5a7744.TMP
Size 48B
SHA256 786a457341488cf7281198253088316023f2def487bd848ea81903bfa95738d8
MD5 c8f6d273d129d8aef186d168328c6738
SHA1 6d749753cdde741aa20ecd2a1104f279d3a1d8b5
SHA512 9d7189c696e87ff3286aac3ff096b1421650b58493e6f0cf5a57da75fcea5a97483133edcc09624cf21d91ddaf1d98ab79354da25ab3cbaa228d35e7ca9fa0da
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 221B
SHA256 a4803bcb46777ef25fc2e91813a77ed8e539b07b08bcd96a5891dfc1ef142fd7
MD5 5066f25c691389e096446f33f3cf53c1
SHA1 ff593d677a3c17bd4009967a7588de0773daef99
SHA512 821a0da153518d7d2eade41fe93860048f2314582cff26d3836ae58e5798265cb5c568b51ad368b82ef190d10f1be878ff926f8b883f5bc8f8982c72aace97cb
TLSH
T144D0973E84303C226F4C488280C0E02340898D4B0646F0504D4AA040387F2A087024B8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 293B
SHA256 c9e496027c08e6e1fb1aa07f1c99a60e1177c50a8a49377f41f44a6e6d46c579
MD5 09b063e87841a497d6a576e1c4a1bbb6
SHA1 b5eb41b57fbdbb715849fe5323afcae0a1667658
SHA512 9cdd39f4f90b873d5a8890356b21428bb8aeccd915b13a8941829de0301a06d890c001cfc03ec5325d3838c37326a2cbb4bbe5c70246cbca47c9995a5b9ec4c5
TLSH
T11FE07D2F51303C264B4C4C8691E1D01B40454D5F5681F0A04955EC44387F1E5C6038FA
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 289B
SHA256 9814edd2c4d25b189fdd356e2b54f964a037c62bde3565db07748e4efa4eabcf
MD5 acf9ebf8ab8eb3026b202bea3339d337
SHA1 0ce7bc18ebe75cd55739577dc8e95b31d06c553a
SHA512 708adb8f255184b7a4cbf45a40a2b70459d9e8eeefa6ba5773457c0fd27c36f1de28030372e00c041f768609b245e68dbd662f9aebf82332db6804ac98d96034
TLSH
T1E3D07D2F9A346C2A4F4C4D81A1E1D01B4145858B5682E09049558804386F2E596038BB
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a1dda.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\EBWebView\WV2Profile_tfw\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt~RFe5a1dda.TMP
Size 141B
SHA256 10a7b7711ef14152a383028bf8797dab43ee799d3a1a57f63756db38170d139d
MD5 9eef1c7a148a4096e9dcc69c9dca98d9
SHA1 82b8f860584bb0431d5deb2ad2be7fa70b019d01
SHA512 17b8fb57738d25b89e52b9d1181b2e93c755fa9d3b66e3c03f07163d46199b4d93097bf8dd2082a2f671632024a3cf3a2da457e75b7300554a5010072c4cf908
TLSH
T115C08C7FA63028068B48208291C0D023A08E8E8B4902A090848AB084383E1A5A3035A4
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsUpdate_2026-07-31_12-11-48.00.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\MSTeamsUpdate_2026-07-31_12-11-48.00.log
Size 3KB
SHA256 bd2cec3b72c19c9e20cb98ac50a5f6e751015375334bc475c168bb4307a9010b
MD5 1fc122c040b63dcca5bf50aca244a279
SHA1 d81bced7c430814a6649a97622dc19bfd786612d
SHA512 91c448b4938fecf92cfa4466024aacaed57cc668f17014914732dbede5b7e0a1c840fb06486a55d7f9dbc093eb724e94fa201a202cdf942fb8de6ca9455d0314
TLSH
T1CD616C5201CE4454E4CF18BAE8103B19CDDDF09EA2E8347A7FB06B9E571955ABB3C12E
MD5 SHA1 SHA512 TLSH

Submit Download

tma_addin_msi.log

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\Logs\tma_addin_msi.log
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download

app_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json
Size 2KB
SHA256 57d97b69e6676701b0a96dd8a0668d584f78142535f5837cc5e84161b12708a8
MD5 824978d68f162a5eb86efdfd2f5b2960
SHA1 4401f2bb14b170ebd3b040051e2d2bc3c6776385
SHA512 60ac675b834bb03e79445276802d80f64a7f1a6279d5dc8ac8bcb7eff41d9c7a2b9824de879fd798ce7f4b8d48fca6f701a63b30c051e1bdd5c9c11e4cfa76d0
TLSH
T12951D52C0614A2BEDDC7864BB54F3E238AE741A4DFA67FD6E8AC181C19821FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

app_settings.json~RFe5a10e9.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\app_settings.json~RFe5a10e9.TMP
Size 2KB
SHA256 fcb6899a7705e4e330024cdb0199e071892fe0d12469d5cb9accddb3a705d1b2
MD5 56df44154f4261077901832014d243dc
SHA1 df4a4fb570e9fcfd5eb9a128f4e0435954c29af9
SHA512 c40c689df3c3c6f3ca4e7e0fdd0ef7f14374c21d0439c4463c166f3969ffbb8ba5f556d8336464063a160f9192ce3e9696fd8a83c9b94c5468ff782bffd2f87d
TLSH
T14A51C62C0614A2BDDDC7864BB54F3E238AE741A4DF667FD6E8AC5C1C59820FD1321497
MD5 SHA1 SHA512 TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 0e6697b9bbb4d33308f1452f7bb190759784cf613d21a7744202a4b9a6382097
MD5 37032021dfe8a076d3a820b14582a15f
SHA1 053272a393f7549168bd14e2dfbe2ef0ad91210a
SHA512 7907a7ca40ba7dd07819da44be6d39351708405e6675c22fa0a92c74f67fd8d5e2f23edfe7470d776e9a3513884e79f4d611d24b81c6b246b089ed999f4e3985
SSDEEP 1536:wsA+LRzfK15OAJRL5uVdUBYDireJi7YDerefrHdffyFXazVTp:7NV5B
TLSH
T112A550A41844A6FEDB8AC2F8673C1F18B5FC4DB788415024EADEDA0D706746B73138A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecs_settings.dat64

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\ecs_settings.dat64
Size 2.0MB
SHA256 edb5bb099cc6fb3d8c9bb41823ff983137362f9d1d03a9ab53c641401b0fbf69
MD5 bd1d2aaaf73279ed39c6528d67e68b93
SHA1 e91f5f75e9f46f04d753052bc1b3d66020691c3e
SHA512 a312db97b64d12bba9a7503eda96a7d6f018d6f21ba970b1068396a86fd3455c65ce9610333b4032687c6cd5017c2f7552935ad371ba0374d68841145f6bd4d4
SSDEEP 1536:mLA+LR8+K15OAJRL5ujUBYDireJi7YDere5rHdffyFXazVzp:/epZ
TLSH
T1DCA550A41844A6FEDB8AC2F8673C1F18B5FC4DB788415024EADEDA0D706746B73138A7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cloud_settings.json

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json
Size 154B
SHA256 cd7f02f72b0c4b167374dcc295c30acb5d90d56c91dc8619e4c848d42dedf25b
MD5 6b284df7273f237e30829adf6461bbdc
SHA1 7e0590fbb967191cfe9cf8d8f4c43548baf9766d
SHA512 01bbabf43b8713d0341df35ef26ffe26ed0bd7ca55017bef538935e053267dbae48770e0320905df11cb69d4c18b91dd38220efd907859a025af1065aaf7b135
TLSH
T1E4C02B421436C175FF73251C404B33141C0C11F0D724228580BD0401F8008C3743F0CF
MD5 SHA1 SHA512 TLSH

Submit Download

cloud_settings.json~RFe5a2df7.TMP

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\cloud_settings.json~RFe5a2df7.TMP
Size 154B
SHA256 d0d9f92181138474a07cb257841d6367425bbbf6f7bd49ed9ed7a832594438c3
MD5 379a2b6aeb5bc4f2d9b492aff71bb9dd
SHA1 acbec06e2d40630ed6ba703656036ad2344bb9c5
SHA512 2256801a70c62db701de36d671a7bfaf16c9327a7399f3184bf05223b89d5da85154a4f12ee6ef296b5eaa9de18544ea4298b062e259ba9602835bfae60ae1b9
TLSH
T170C08C411036C175EF722618400B23141C0811F0DB24224580A90401F9004C3642B08F
MD5 SHA1 SHA512 TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM
Size 24KB
SHA256 ca08a85cac38f7022e51cc142c43e018c96a2b28bf8b83cabcf63be5d5910dc5
MD5 4c5681334fbd4e29fcd6458bb04dac8c
SHA1 e5f174ea634339db001072dfb3e8fd55784efe66
SHA512 5b66fcb8c7a4c2ef55ad985cf6f28fdeb0bd07824962bd1d5d9084dfb50cbb24ee1a8649a17ba0fda5d733e990178cca481eff043d68081fca41ebecaa44049b
SSDEEP 12:TjWqtZeY4syJttJxUSo0x9DdN1tDEX4vcImm5RyZkFv4sbMS+e:TCqt8VtbDBtDi4kZERDEe
TLSH
T10EB2ACC266B86061E05D11B7C8B21366173AD1A9043383632DF254A19CC28CA98355FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal

Path C:\Users\Admin\AppData\Local\Packages\MSTeams_8wekyb3d8bbwe\LocalCache\Microsoft\MSTeams\tfw\dGVsZW1ldHJ5X29mZmxpbmVfc3RvcmFnZV9ST1dDT01NRVJDSUFM-wal
Size 8KB
SHA256 0955dd7a4cf82a1195c4d8f0390300bfd942cd8964c334aa861f4c4379b6f0bd
MD5 b48f83eff17dffe85f5ba41e25d85c31
SHA1 bce1cf7aa341e4f75cb1c17992027902d205c88a
SHA512 63d5d566026ec05a99fbadaa42446c86435797fb07c5d8de6798af25754d909a91a9d7471dda2bd7b8f784eab324ffd2f91dea8922077f022f55af2c8937f477
SSDEEP 24:KUVSqt8VtbDBtDi4kZERDixaiqt8VtbDBtDi4kZERDf:XSO8VFDYMkaiO8VFDYML
TLSH
T12302F1C175787061E05A61F7C9B31367173AD1A6043396A32DF258929CC19CAD4251FF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 143B
SHA256 4b8733e78f73761ffcaaab651debde632897e437512a15cbb88491d45e23aa5f
MD5 c8dab1c752ea484fecd5704326ae13a1
SHA1 2bf0d353f5105406873ed124b9424f834cd9af5a
SHA512 612327511422f5525860e0fb3e5468938a424ef9fdca6936e69a5b64736240e7ec8ef724f3892c86e0d452ba7d009f06fad8f90e18bb93d46bfbd708c0c07907
TLSH
T13AC02B060D0B65330BD00E00C9BBBCC2C1C87CCB053018314979D04C1B182EFB000146
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json
Size 361B
SHA256 a703bf0a3c0821dda761415dc209853863b5d0db03f132cf9ec28e4395c6b405
MD5 c69028724ec22c54da857eb5c04c911e
SHA1 90f3b473d97e582aa00d975278f7f9b907506f67
SHA512 1303c65dcf92465199248d9fcd4069fb748af6299710ee6b3a89056403f68923d3c501061c6f414f7d60fd532d03c52472cfe33fa0c92e65f851aa23451b5253
TLSH
T1C9E0C07E4821B83302A42600CD655D40D0D5B9CAD6A0E1D122BD910D2B250FD6504656
MD5 SHA1 SHA512 TLSH

Submit Download

tma_settings.json~RFe5a0f15.TMP

Path C:\Users\Admin\AppData\Local\Publishers\8wekyb3d8bbwe\TeamsSharedConfig\tma_settings.json~RFe5a0f15.TMP
Size 124B
SHA256 d651df9b25e7b36f5492d15050c5281f0519042cbc4b40742332d10fe220d90c
MD5 98d8595a47c9f70033706bb441d55a86
SHA1 162943310d516c7f44341af615241bbcd08f5c87
SHA512 c7c81b6d80d0a868eaff3193e53f24c0eeeb25d7cf8d4df1b0d0aec14a4ef5f402e290ff5c9640cc3687462f8a9ccd4957715e823e9a50f38d635b7a7dc44e1b
TLSH
T1B9B092161D0AA6735BA00A10C9BBAD82C2D96D9A06642861857AE49D0B286DEB10064A
MD5 SHA1 SHA512 TLSH

Submit Download

Update.exe

Path C:\Users\Admin\AppData\Local\SquirrelTemp\Update.exe
Size 2.4MB
SHA256 fccdc07fb399838b345838400cc086f59221297e4ad237911513e974ed71d468
MD5 99bce53f81997c05e348d174126b3a6a
SHA1 c9bc67638cfd2274a776cb596158d064c08f4d44
SHA512 22bee232ee15b0f03a9f1ea31b0f8b49b2e0b1c09341f2df502493ca242406a9b57e10c60a661fa46d9c51ffd108cf583fc852bc762fd499cf34a3d5889f0519
SSDEEP 49152:AizoKjTAkibv0W2XhnQAcEz9xU0gzHCUZ5nEb:Aiz7Ribv0WUnvznEiUZ5Eb
TLSH
T1E0B55A10A7E88E2AE4BF1BB6F57101510BF6F98AA772F78F160C60782E933548D51763
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

downloading.gif

Path C:\Users\Admin\AppData\Local\SquirrelTemp\downloading.gif
Size 9KB
SHA256 effcd4e74fe3fe14ab9fe2916ad97eaab7ea9294aeb4c3310406cc2ae195d39e
MD5 18cf95269eab6519867f9c240ea57c6b
SHA1 7026775355daf1cf1a49d380d7cdd7785a6278e0
SHA512 873c83d15803396a636a09349313f90e2a1a9aa8e1a41b474f898ec0b6580b107f3e3763e8e1613f8cb9d7c611a21762ce712824b68de9ae48be73425f045096
SSDEEP 192:FTaPIYtYvIOnHW+pYt6wRpy6/WVkiS3s20AbCWGShWMeqf4:Fl8YQO2+pQDfykakiS3pb/1tw
TLSH
T14212AE53DBC9B884A0509FF7AD8C201A670381554D6458DBF9BA34AB350603A7B6E3BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.ses

Path C:\Users\Admin\AppData\Local\Temp\.ses
Size 53B
SHA256 6953c4d17ff53afc8409357176b1fc883b45ed32753292014cfeeb668ea46368
MD5 ff15e69bd8d4b70fe0ee83f3b3959232
SHA1 d6b0bf808a72c13b88102d6049a3261b6a18bb60
SHA512 a4dd84643747f249c07678f531a8118dad8666e0e79906baf9aad2bd61371c23f27f6393ad0c08500ffefab827a59569907aa8be12651472ddb31a0c9be81453
TLSH
T1919002755C0412585788FDC40D95414D7B4E513C959DD1042064C96991864064144444
MD5 SHA1 SHA512 TLSH

Submit Download

CFGAAD8.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFGAAD8.tmp
Size 150B
SHA256 02375fa63b79648ed6bb419c08f78ba9032ee22ba7170250e24427f47fddfa4e
MD5 2be48f533744efa173a2ede37ea8031e
SHA1 41fad4dd24cc97a3d3056b026ca8056c9e4b9e3f
SHA512 f49495311687f2a1af4ff60f8ff304d3ccddcd66effc36dfcfd71de91ee86a405c14c3f9bd81240cca76d4de1f4abd3259a7af6d53b2c3737c8963123d6f6815
TLSH
T174C02B09402C7D37EC230F579112CD12FFF003616034000CE01FB72B021006D5306306
MD5 SHA1 SHA512 TLSH

Submit Download

meeting-addin-t21-msi.log

Path C:\Users\Admin\AppData\Local\Temp\Microsoft\Teams\meeting-addin\meeting-addin-t21-msi.log
Size 877B
SHA256 b48bc80a572878b1b779e184ff1d4fd171eb4432d45b71d5a0ec2597c345fba8
MD5 bbb4c5feaddb6f3e281c5e813b301985
SHA1 d3d55174b9868a540c6e3e07e0ee0b489b75fde7
SHA512 e11ad97a058c53746d1ad9ac4e24c2e460977fd1bf6984ef6d31180588aab5ae1a68719db9fc25e7f1dcea5934cffa5b35a21345a487db2623e08b70a7fcd608
TLSH
T155119BCAC658A71946D010051B6099AEB3BEE1C723027182EFF4CA0473014F28A2A0DD
MD5 SHA1 SHA512 TLSH

Submit Download

MSTeamsSetup.exe

Path C:\Users\Admin\AppData\Local\Temp\gentee0A\MSTeamsSetup.exe
Size 1.3MB
SHA256 e0b0a89c449acdb6ac9eb181dbf1be6ca0824ea215429ddcc927703086a0e608
MD5 425f32686744df3d826acdddecc89aab
SHA1 d80428d65e2ec8432963159aa2edd40f6e365bae
SHA512 19e7e320ec29bc705be110a51fa260797a91efd9dd805010286efb8427fbe8d00fede5035cc9de176b9b2136646448d1236f78517ad9cd792071ca3b78a6a264
SSDEEP 24576:FmPjS7HX11VQrCINkE1O67IkwtL/bwx79x94J3bJmDQY2XJSlanwxAnEoOq:m+31bgNt8IIkI/bCj4J3bJDdlnwmnE
TLSH
T1DE55121176C28032D6B305320B78E6729A7EB8211F659AEF53E4125CDE346C1EB35F7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

guig.dll

Path C:\Users\Admin\AppData\Local\Temp\gentee0A\guig.dll
Size 20KB
SHA256 624f4c25504ba431f450d8ecee2e2d0a4d87b95f7fa0b72db43f057ca021c328
MD5 ddd4a31094764a9deb6a82c8658fd9c5
SHA1 4c098a5b44aca27b13222dd64903d3fb286fc274
SHA512 45e2b5373ceb9b92dcd1d23a0b2410b5562d2a59c2a0d4dbca1c51f6264bc4659370ae3c170662bb8d316c3dfc0439874b3354ebf1ecd7ea27de125b4975ba6e
SSDEEP 96:Vp+rqxZxbVbQosZK61Oi0sIqUWfNBd8HwoO6EVV2JVdY0l4RSID1/Qw/g3ATg:+OLOK6UsPnzB6aVd0AD1/Qw/g3
TLSH
T17D92D6B672D148F3D0CF17F00A622BAE6BB58420177578A64A134BCE96A6641F926B02
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgqmQcC2.exe

Path C:\Users\Admin\AppData\Local\Temp\gentee0A\zgqmQcC2.exe
Size 1.9MB
SHA256 ceeb2c2901bc48ae4004982986bc406f172a96f21d203a15797de98cfab8acb9
MD5 2c5740ef82708d4956838cc6a13e11cf
SHA1 577fa764732f042b718a393c16cfd4ffd05cee52
SHA512 319e267486201acfbd930b428403aff3ea548bfbf5273df32b0cf878109a2728577cbfbd078a168b1becbf7dff8f3d8af35f2640108e4c58d2762f078637acb7
SSDEEP 49152:BxXXm66O7MEX8OEaZKSEohy/SsDlMCsdbFqZ4:BxHX7RXxEaZHEoMVDqvqC
TLSH
T19695DF13B2CB613FF0BE8A364A77E222553BBA6165124C6797F8086CCF261D41D3F646
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

genteert.dll

Path C:\Users\Admin\AppData\Local\Temp\genteert.dll
Size 60KB
SHA256 54c0da1735bb1cb02b60c321de938488345f8d1d26bf389c8cb2acad5d01b831
MD5 6ce814fd1ad7ae07a9e462c26b3a0f69
SHA1 15f440c2a8498a4efe2d9ba0c6268fab4fb8e0a7
SHA512 e5cff6bcb063635e5193209b94a9b2f5465f1c82394f23f50bd30bf0a2b117b209f5fca5aa10a7912a94ad88711dcd490aa528a7202f09490acd96cd640a3556
SSDEEP 768:BVPbKk9022j0efXs6X8zqk3pT3oMapzxc7Ep+DnSIiacDwGpr1a:BVTK+022j0V6mqMozpzxcXOpwEr1
TLSH
T16A536D03678600F5D6526A7A342F7277FB34DFE742E6C6836F69DC902D221A1A52A1C3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b92d20d9.dll

Path C:\Users\Admin\AppData\Local\Temp\is-CKLJU.tmp\b92d20d9.dll
Size 104KB
SHA256 2c43dc8031cf4a3192f71d410ec699b5253e48f8d1d185e0fa2c1d945967300f
MD5 4eef8e41c2385b9ad55e05760f55e167
SHA1 41aadc7bd0e15d81376b1c697e4247a281b218f7
SHA512 b8a3d83a87685bb0c493a8b07100b7d5653ac5e853d3fd4310614a5cce5b89e8170786f8603c771f4c4dd8823e499cff624c98664fa0d83b775539a5733aae3f
SSDEEP 3072:njjoZ1J3hcHwDzrVrT4cKJFdTgO8Z6CjTO4Md5sA:njjoZH3hcQDzBjYF91mBjqsA
TLSH
T1A5A36B40B5C1C072D5AE167E8828CB758B3FA820DF615DDB73545ABE1E342E1AF31A1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

zgqmQcC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-HA7S7.tmp\zgqmQcC2.tmp
Size 3.3MB
SHA256 174a79d951cdf00b65a987e5a1e8aa628481b0f1fa0fad667fb4bc66e88f2013
MD5 6b43973e1b89f2be3703919ccb9913dc
SHA1 c8eb439107a299e57e150f09c76dda98a0f29381
SHA512 97faffd1588384e8fcafbba0251167de8efa1e25e818aef0e28d8e8395fe21a55a76bdf8a23d5510cd0f02d2ed7516164b963d6432dbaea9442f0dfaa49d1c91
SSDEEP 49152:cDwGHAkqMu7Ht6SCiGognuzsDaarpQAB1KkX/q52guQk3332C:cMGdPvuzEVTBoPdur3339
TLSH
T143F55C23F24D693ED05B3E3D673792A4987B76602D128C57A7EC3A4C4F391812E2A747
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adddf.vbe

Path C:\Users\Admin\AppData\Roaming\Quh54cfx\adddf.vbe
Size 9KB
SHA256 4ab61a28fb3175a523e528c1d6964d6005afcde98c5c2bda11b96023e7762822
MD5 9a61b0b598accb28f85ef37a3ddb0ac9
SHA1 be606c84b9adc32097377ebe7181a38f705bbcfc
SHA512 b5fd3086e299419228f7225f39e8fc5111fd17985a1408de64b083e5d077b4bfb003679d3ff0de609dc506937fedecdf1f30a0aa81a168fda5305783aec06943
SSDEEP 192:UK/4eC2uWB9XN5JLoQUlYf0Kd7IeHpySDdKwi9SK6DLXkDxW:ZQP2uyb6S0KlzHpySDo7SK6DIxW
TLSH
T1E612195C021093408EFC9172ADCB19AE771FDE9046C96991E58CED8CF5DE2BC40AE7E5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIAA2C.tmp

Path C:\Windows\Installer\MSIAA2C.tmp
Size 298KB
SHA256 da1fe86141c446921021bb26b6fe2bd2d1bb51e3e614f46f8103ffad8042f2c0
MD5 684f2d21637cb5835172edad55b6a8d9
SHA1 5eac3b8d0733aa11543248b769d7c30d2c53fcdb
SHA512 7b626c2839ac7df4dd764d52290da80f40f7c02cb70c8668a33ad166b0bcb0c1d4114d08a8754e0ae9c0210129ae7e885a90df714ca79bd946fbd8009848538c
SSDEEP 6144:ruAOGlvgiHqfcTmGZ8009t0svTPxmx4yAyA5bDB+urH+nPAMyoZ3:iclvgiHAcTmS80g9vTMx4yAyA5b0urH0
TLSH
T12D548D517BD19032E2FE05307979A6A22ABEB8305CF0CA5FD794156D5E706C0AB28F37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIBBA3.tmp

Path C:\Windows\Installer\MSIBBA3.tmp
Size 114KB
SHA256 a97a4223b0d8d59f4a7ad04e84d4c2016804e8f0fecee8b1496d19d2127f7469
MD5 b6d17ac9c08a829a2fa594ec24bb9d71
SHA1 0772528a16419b52d254fe8f4715fec7251fb280
SHA512 c81e4b16cd95fd1044f1dae88b318910086cd7fdfe35a4403b78bf174f72eed341f3278592fe67d62c0b7e14c7cc03814cb4f9c45e0f0387d5ac42c7674c5263
SSDEEP 1536:VS8CWyksWMcdMyBpjr+UsgtFmVrrXL1MgbIurgnQMolQJs8DhIwc:VS8SgMe+jVrrb1MMBRMoly1DhI
TLSH
T1B3B39D11BA908432D4FF2D381578DA622E3E7D701FE09DAF175456B90EB43D09B39E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5aa7ab.msi

Path C:\Windows\Installer\e5aa7ab.msi
Size 14.0MB
SHA256 cba6e50a9d5d453771bcef4d193bebfa565febbd74a77821c2cb7954b969f77a
MD5 863cbb9994e7ed7be1c128d0b52df781
SHA1 4bf5bc588c0908fe70c82153499fed75008e9adc
SHA512 1289d8494da8fb0605c564105ac40f72fb8f7f5ab83a553403cd364fc9744098f35823d4ee85b470f66fc468a8373e131dd9d3bb882b7cc8c938df954c643427
SSDEEP 393216:aM1Ds9X1ZZBN18AKBye47SvhiSvNv2QI6j35Tcrx:aMY1XD1CyZFSZq6Rc
TLSH
T1D0E6335279425932C1BA0D34287F9B081B7E3E752DB1488F9B64F64E2C727805B79F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1244-58-0x00000000006A0000-0x0000000000778000-memory.dmp

Download

memory/1244-492-0x00000000006A0000-0x0000000000778000-memory.dmp

Download

memory/1596-644-0x00000288CAE50000-0x00000288CAEF9000-memory.dmp

Download

memory/1596-543-0x00000288CAE50000-0x00000288CAEF9000-memory.dmp

Download

memory/1596-139-0x00007FFA53B80000-0x00007FFA53B81000-memory.dmp

Download

memory/2360-951-0x00007FFA53650000-0x00007FFA53651000-memory.dmp

Download

memory/2360-952-0x00007FFA53410000-0x00007FFA53411000-memory.dmp

Download

memory/2808-32-0x00000000003A0000-0x0000000000602000-memory.dmp

Download

memory/2808-42-0x0000000007080000-0x00000000070A6000-memory.dmp

Download

memory/2808-36-0x0000000005820000-0x000000000582A000-memory.dmp

Download

memory/2808-39-0x0000000005FA0000-0x00000000064CC000-memory.dmp

Download

memory/2808-34-0x0000000073AF0000-0x00000000742AC000-memory.dmp

Download

memory/2808-33-0x00000000050A0000-0x00000000050BE000-memory.dmp

Download

memory/2808-48-0x0000000073AF0000-0x00000000742AC000-memory.dmp

Download

memory/2808-47-0x0000000073B02000-0x0000000073B03000-memory.dmp

Download

memory/2808-46-0x000000000C5C0000-0x000000000C5CE000-memory.dmp

Download

memory/2808-37-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/2808-31-0x0000000073B02000-0x0000000073B03000-memory.dmp

Download

memory/2808-53-0x0000000073AF0000-0x00000000742AC000-memory.dmp

Download

memory/2808-45-0x000000000C5E0000-0x000000000C61E000-memory.dmp

Download

memory/3376-564-0x0000019C69E70000-0x0000019C69F19000-memory.dmp

Download

memory/3376-269-0x00007FFA53B80000-0x00007FFA53B81000-memory.dmp

Download

memory/3376-929-0x0000019C69E70000-0x0000019C69F19000-memory.dmp

Download

memory/4740-495-0x0000000002BC0000-0x0000000002BE8000-memory.dmp

Download

memory/4964-873-0x0000000005260000-0x000000000529C000-memory.dmp

Download

memory/4964-872-0x00000000031F0000-0x0000000003202000-memory.dmp

Download

memory/4964-859-0x0000000003040000-0x000000000304A000-memory.dmp

Download

memory/4964-855-0x0000000003000000-0x000000000301A000-memory.dmp

Download

memory/5896-489-0x0000000000320000-0x0000000000684000-memory.dmp

Download

memory/6012-533-0x0000019A4E730000-0x0000019A4E8D3000-memory.dmp

Download