Analysis
- max time kernel
149s - max time network
154s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
07/11/2026, 17:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
TeamSync_0.4.0_x64_en-US.msi
Resource
win10v2004-20260911-en
windows10-2004-x64
23 signatures
150 seconds
Behavioral task
behavioral2
Sample
TeamSync_0.4.0_x64_en-US.msi
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
24 signatures
150 seconds
General
- Target TeamSync_0.4.0_x64_en-US.msi
- Size 19.8MB
- Sample261107-wex3sszyhs
- SHA256 bcb2e1cf227dcbb1f9ec190eb9729bfcdfb8da03f84f8d3eec16ddf666cf151b
- MD5 6805ae63ab5b6e9ffe4ba94ab8e43ef4
- SHA1 3ba349bcd968d839783b059f47236101a180ee57
- SHA512 4581f367f7e347e767600d723f2e5d992fa30169493005154174f732fd6ce02a7b634c6dbcd66057b11b7d70c23d210b3889018e450d9c3d8ce0674efbe32fb7
- SSDEEP 393216:12cioc6RRf9q1NZZDmiEVvhlujdP+MemWglwzrkIbJjB2FWabgTc0YOqVeyDMB5E:h5DH4NIn8xP+Memz0kIbJj4WaUTNya5I
- TLSH T16527338B7D62E162D85F8DB6047157610A3E3D447A048D17E23C31A8FEF22C51BBAED6
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Executes dropped EXE 6 IoCs
pid Process 4680 teamsync.exe 2956 teamsyncd.exe 5364 syncthing.exe 1972 syncthing.exe 2392 syncthing.exe 2388 syncthing.exe - Loads dropped DLL 1 IoCs
pid Process 2244 MsiExec.exe - Checks whether UAC is enabled 1 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA teamsync.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\D: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\V: msiexec.exe - Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files\TeamSync\SYNCTHING-LICENSE.txt msiexec.exe File created C:\Program Files\TeamSync\Uninstall TeamSync.lnk msiexec.exe File created C:\Program Files\TeamSync\syncthing.exe msiexec.exe File created C:\Program Files\TeamSync\teamsyncd.exe msiexec.exe File created C:\Program Files\TeamSync\teamsync.exe msiexec.exe - Drops file in Windows directory 28 IoCs
description ioc Process File created C:\Windows\Installer\{FD27627C-133E-4C2B-8B95-FDC7DFA7CB8D}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF6D3B3289D3FBEA81.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Filtering Rules-CA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Part-RU msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\manifest.fingerprint msedgewebview2.exe File created C:\Windows\Installer\SourceHash{FD27627C-133E-4C2B-8B95-FDC7DFA7CB8D} msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Part-FR msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Part-IT msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Part-NL msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Part-ZH msedgewebview2.exe File opened for modification C:\Windows\Installer\e5a35e6.msi msiexec.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log msiexec.exe File opened for modification C:\Windows\Installer\MSI3DD5.tmp msiexec.exe File created C:\Windows\Installer\e5a35e8.msi msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\adblock_snippet.js msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Filtering Rules msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\LICENSE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\manifest.json msedgewebview2.exe File created C:\Windows\Installer\e5a35e6.msi msiexec.exe File created C:\Windows\Installer\inprogressinstallinfo.ipi msiexec.exe File created C:\Windows\SystemTemp\~DF8BE6F0DF5716C4E4.TMP msiexec.exe File opened for modification C:\Windows\Installer\{FD27627C-133E-4C2B-8B95-FDC7DFA7CB8D}\ProductIcon msiexec.exe File created C:\Windows\SystemTemp\~DF4D3EC0D7CD13A167.TMP msiexec.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Filtering Rules-AA msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Part-DE msedgewebview2.exe File created C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\Part-ES msedgewebview2.exe File opened for modification C:\Windows\Installer\ msiexec.exe File created C:\Windows\SystemTemp\~DFE01A17FD3192E4CB.TMP msiexec.exe - Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 1104 msiexec.exe - Modifies trusted root certificate store through registry 1 TTPs 2 IoCs
A root certificate was added, modified, or removed in the trusted certificate store registry paths.
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c614000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 syncthing.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 5c0000000100000004000000001000001900000001000000100000002fe1f70bb05d7c92335bc5e05b984da60f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f63030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e814000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e6b000000010000002000000096bcec06264976f37460779acf28c5a7cfe8a3c0aae11a8ffcee05c0bddf08c620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 syncthing.exe - Reads the TCP/IP host and domain name from the registry 1 TTPs 5 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname syncthing.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname syncthing.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain syncthing.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname teamsync.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain teamsync.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MsiExec.exe - Checks SCSI registry key(s) 3 TTPs 5 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 00000000040000000463f4e358e8ea170000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c01200000000000000000000000027010100008838010463f4e30000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e841010463f4e3000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e30463f4e300000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e60463f4e300000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 vssvc.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedgewebview2.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedgewebview2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedgewebview2.exe - Modifies data under HKEY_USERS 3 IoCs
description ioc Process Key deleted \REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27\52C64B7E msiexec.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27 msiexec.exe Key created \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28 msiexec.exe - Modifies registry class 26 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\SourceList\Media\1 = ";" msiexec.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\Clients = 3a0000000000 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\PackageCode = "34E81FE4958646848B056050881FE666" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\DeploymentFlags = "3" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2FEED6BDDC1B62A5B83FA45563D94D25 msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\SourceList msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\SourceList\PackageName = "TeamSync_0.4.0_x64_en-US.msi" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72672DFE331B2C4B859DF7CFD7ABCD8\External msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\Assignment = "1" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\ProductIcon = "C:\\Windows\\Installer\\{FD27627C-133E-4C2B-8B95-FDC7DFA7CB8D}\\ProductIcon" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\SourceList\Net msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72672DFE331B2C4B859DF7CFD7ABCD8 msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72672DFE331B2C4B859DF7CFD7ABCD8\MainProgram msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72672DFE331B2C4B859DF7CFD7ABCD8\Environment = "MainProgram" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\ProductName = "TeamSync" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\Version = "262144" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\AdvertiseFlags = "388" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\AuthorizedLUAApp = "0" msiexec.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\SourceList\Media msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\C72672DFE331B2C4B859DF7CFD7ABCD8\ShortcutsFeature = "MainProgram" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\Language = "0" msiexec.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\C72672DFE331B2C4B859DF7CFD7ABCD8\InstanceType = "0" msiexec.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\2FEED6BDDC1B62A5B83FA45563D94D25\C72672DFE331B2C4B859DF7CFD7ABCD8 msiexec.exe - Modifies system certificate store 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 syncthing.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0 teamsync.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 0f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf157614090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c06200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a0b00000001000000180000005300650063007400690067006f00200045004300430000001400000001000000140000003ae10986d4cf19c29676744976dce035c663639a1d0000000100000010000000280cf6042c30a2646644ba7286a3aa97030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df02000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 teamsync.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1CBCA5DB2D52A7F693B674DE5F05A1D0C957DF0\Blob = 19000000010000001000000076935b5c5a037216daaf8aac76df42c1030000000100000014000000d1cbca5db2d52a7f693b674de5f05a1d0c957df01d0000000100000010000000280cf6042c30a2646644ba7286a3aa971400000001000000140000003ae10986d4cf19c29676744976dce035c663639a0b00000001000000180000005300650063007400690067006f00200045004300430000006200000001000000200000004ff460d54b9c86dabfbcfc5712e0400d2bed3fbc4d4fbdaa86e06adcd2a9ad7a53000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b060105050703080f00000001000000300000000b043572c899dec43efd590cfce610cf443a6315925ebfe589f7506907e44824608489581c7ca0e041458514cf1576142000000001000000930200003082028f30820215a00302010202105c8b99c55a94c5d27156decd8980cc26300a06082a8648ce3d040303308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f72697479301e170d3130303230313030303030305a170d3338303131383233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374204543432043657274696669636174696f6e20417574686f726974793076301006072a8648ce3d020106052b81040022036200041aac545aa9f96823e77ad5246f53c65ad84babc6d5b6d1e67371aedd9cd60c61fddba08903b80514ec57ceee5d3fe221b3cef7d48a79e0a3837e2d97d061c4f199dc259163ab7f30a3b470e2c7a1339cf3bf2e5c53b15fb37d327f8a34e37979a3423040301d0603551d0e041604143ae10986d4cf19c29676744976dce035c663639a300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff300a06082a8648ce3d040303036800306502303667a11608dce49700411d4ebee16301cf3baa421164a09d94390211795c7b1dfa64b9ee1642b3bf8ac209c4ece4b14d023100e92a61478c524a4b4e1870f6d644d66ef583ba6d58bd24d95648eaefc4a24681886a3a46d1a99b4dc961dad15d576a18 teamsync.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4856 msiexec.exe 4856 msiexec.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 1 IoCs
pid Process 1996 msedgewebview2.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1104 msiexec.exe Token: SeIncreaseQuotaPrivilege 1104 msiexec.exe Token: SeSecurityPrivilege 4856 msiexec.exe Token: SeCreateTokenPrivilege 1104 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1104 msiexec.exe Token: SeLockMemoryPrivilege 1104 msiexec.exe Token: SeIncreaseQuotaPrivilege 1104 msiexec.exe Token: SeMachineAccountPrivilege 1104 msiexec.exe Token: SeTcbPrivilege 1104 msiexec.exe Token: SeSecurityPrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeLoadDriverPrivilege 1104 msiexec.exe Token: SeSystemProfilePrivilege 1104 msiexec.exe Token: SeSystemtimePrivilege 1104 msiexec.exe Token: SeProfSingleProcessPrivilege 1104 msiexec.exe Token: SeIncBasePriorityPrivilege 1104 msiexec.exe Token: SeCreatePagefilePrivilege 1104 msiexec.exe Token: SeCreatePermanentPrivilege 1104 msiexec.exe Token: SeBackupPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeShutdownPrivilege 1104 msiexec.exe Token: SeDebugPrivilege 1104 msiexec.exe Token: SeAuditPrivilege 1104 msiexec.exe Token: SeSystemEnvironmentPrivilege 1104 msiexec.exe Token: SeChangeNotifyPrivilege 1104 msiexec.exe Token: SeRemoteShutdownPrivilege 1104 msiexec.exe Token: SeUndockPrivilege 1104 msiexec.exe Token: SeSyncAgentPrivilege 1104 msiexec.exe Token: SeEnableDelegationPrivilege 1104 msiexec.exe Token: SeManageVolumePrivilege 1104 msiexec.exe Token: SeImpersonatePrivilege 1104 msiexec.exe Token: SeCreateGlobalPrivilege 1104 msiexec.exe Token: SeCreateTokenPrivilege 1104 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1104 msiexec.exe Token: SeLockMemoryPrivilege 1104 msiexec.exe Token: SeIncreaseQuotaPrivilege 1104 msiexec.exe Token: SeMachineAccountPrivilege 1104 msiexec.exe Token: SeTcbPrivilege 1104 msiexec.exe Token: SeSecurityPrivilege 1104 msiexec.exe Token: SeTakeOwnershipPrivilege 1104 msiexec.exe Token: SeLoadDriverPrivilege 1104 msiexec.exe Token: SeSystemProfilePrivilege 1104 msiexec.exe Token: SeSystemtimePrivilege 1104 msiexec.exe Token: SeProfSingleProcessPrivilege 1104 msiexec.exe Token: SeIncBasePriorityPrivilege 1104 msiexec.exe Token: SeCreatePagefilePrivilege 1104 msiexec.exe Token: SeCreatePermanentPrivilege 1104 msiexec.exe Token: SeBackupPrivilege 1104 msiexec.exe Token: SeRestorePrivilege 1104 msiexec.exe Token: SeShutdownPrivilege 1104 msiexec.exe Token: SeDebugPrivilege 1104 msiexec.exe Token: SeAuditPrivilege 1104 msiexec.exe Token: SeSystemEnvironmentPrivilege 1104 msiexec.exe Token: SeChangeNotifyPrivilege 1104 msiexec.exe Token: SeRemoteShutdownPrivilege 1104 msiexec.exe Token: SeUndockPrivilege 1104 msiexec.exe Token: SeSyncAgentPrivilege 1104 msiexec.exe Token: SeEnableDelegationPrivilege 1104 msiexec.exe Token: SeManageVolumePrivilege 1104 msiexec.exe Token: SeImpersonatePrivilege 1104 msiexec.exe Token: SeCreateGlobalPrivilege 1104 msiexec.exe Token: SeCreateTokenPrivilege 1104 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 1104 msiexec.exe Token: SeLockMemoryPrivilege 1104 msiexec.exe - Suspicious use of FindShellTrayWindow 17 IoCs
pid Process 1104 msiexec.exe 1104 msiexec.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe - Suspicious use of SendNotifyMessage 15 IoCs
pid Process 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe 4680 teamsync.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1104 msiexec.exe 4856 msiexec.exe 2244 MsiExec.exe - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4856 wrote to memory of 2244 4856 msiexec.exe 89 PID 4856 wrote to memory of 4600 4856 msiexec.exe 95 PID 1104 wrote to memory of 4680 1104 msiexec.exe 98 PID 4680 wrote to memory of 1996 4680 teamsync.exe 99 PID 1996 wrote to memory of 5628 1996 msedgewebview2.exe 100 PID 1996 wrote to memory of 5784 1996 msedgewebview2.exe 101 PID 1996 wrote to memory of 5784 1996 msedgewebview2.exe 101 PID 1996 wrote to memory of 5784 1996 msedgewebview2.exe 101 PID 1996 wrote to memory of 5784 1996 msedgewebview2.exe 101 PID 1996 wrote to memory of 4244 1996 msedgewebview2.exe 102 PID 1996 wrote to memory of 5132 1996 msedgewebview2.exe 103 PID 1996 wrote to memory of 5132 1996 msedgewebview2.exe 103 PID 1996 wrote to memory of 5132 1996 msedgewebview2.exe 103 PID 1996 wrote to memory of 6124 1996 msedgewebview2.exe 104 PID 1996 wrote to memory of 6124 1996 msedgewebview2.exe 104 PID 1996 wrote to memory of 6124 1996 msedgewebview2.exe 104 PID 1996 wrote to memory of 6124 1996 msedgewebview2.exe 104 PID 1996 wrote to memory of 6124 1996 msedgewebview2.exe 104 PID 4680 wrote to memory of 2956 4680 teamsync.exe 105 PID 2956 wrote to memory of 5364 2956 teamsyncd.exe 106 PID 5364 wrote to memory of 1972 5364 syncthing.exe 108 PID 2956 wrote to memory of 2392 2956 teamsyncd.exe 109 PID 2392 wrote to memory of 2388 2392 syncthing.exe 111 PID 2388 wrote to memory of 4180 2388 syncthing.exe 112 PID 1996 wrote to memory of 2896 1996 msedgewebview2.exe 115 PID 1996 wrote to memory of 2896 1996 msedgewebview2.exe 115 PID 1996 wrote to memory of 2896 1996 msedgewebview2.exe 115 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\TeamSync_0.4.0_x64_en-US.msi1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Program Files\TeamSync\teamsync.exe"C:\Program Files\TeamSync\teamsync.exe"2⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --embedded-browser-webview=1 --webview-exe-name=teamsync.exe --webview-exe-version=0.4.0 --user-data-dir="C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView" --noerrdialogs --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --autoplay-policy=no-user-gesture-required --disable-features=msWebOOUI,msPdfOOUI,msSmartScreenProtection --enable-features=MojoIpcz --lang=en-US --accept-lang=en-US --mojo-named-platform-channel-pipe=4680.5948.3825570222447973738 /pfhostedapp:843038fbe4edf47cbe688c0a36025b4d7d0de0e13⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=crashpad-handler --user-data-dir=C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView /prefetch:4 /pfhostedapp:843038fbe4edf47cbe688c0a36025b4d7d0de0e1 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Crashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=122.0.6261.139 "--annotation=exe=C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --annotation=plat=Win64 "--annotation=prod=Edge WebView2" --annotation=ver=122.0.2365.106 --initial-client-data=0x104,0x168,0x18c,0x108,0x194,0x7fff8a665fd8,0x7fff8a665fe4,0x7fff8a665ff04⤵PID:5628
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=gpu-process --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView" --webview-exe-name=teamsync.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAAAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --mojo-platform-channel-handle=1732 --field-trial-handle=1736,i,12413128033478026585,8744821920916003236,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:2 /pfhostedapp:843038fbe4edf47cbe688c0a36025b4d7d0de0e14⤵PID:5784
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView" --webview-exe-name=teamsync.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2216 --field-trial-handle=1736,i,12413128033478026585,8744821920916003236,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:3 /pfhostedapp:843038fbe4edf47cbe688c0a36025b4d7d0de0e14⤵PID:4244
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView" --webview-exe-name=teamsync.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2412 --field-trial-handle=1736,i,12413128033478026585,8744821920916003236,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:843038fbe4edf47cbe688c0a36025b4d7d0de0e14⤵PID:5132
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=renderer --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView" --webview-exe-name=teamsync.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --autoplay-policy=no-user-gesture-required --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --js-flags="--harmony-weak-refs-with-cleanup-some --expose-gc --ms-user-locale=" --mojo-platform-channel-handle=3076 --field-trial-handle=1736,i,12413128033478026585,8744821920916003236,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /pfhostedapp:843038fbe4edf47cbe688c0a36025b4d7d0de0e1 /prefetch:14⤵PID:6124
-
-
C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe"C:\Program Files (x86)\Microsoft\EdgeWebView\Application\122.0.2365.106\msedgewebview2.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --noerrdialogs --user-data-dir="C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView" --webview-exe-name=teamsync.exe --webview-exe-version=0.4.0 --embedded-browser-webview=1 --embedded-browser-webview-dpi-awareness=2 --edge-webview-custom-scheme --no-appcompat-clear --mojo-platform-channel-handle=2100 --field-trial-handle=1736,i,12413128033478026585,8744821920916003236,262144 --enable-features=MojoIpcz --disable-features=msPdfOOUI,msSmartScreenProtection,msWebOOUI --variations-seed-version /prefetch:8 /pfhostedapp:843038fbe4edf47cbe688c0a36025b4d7d0de0e14⤵PID:2896
-
-
-
C:\Program Files\TeamSync\teamsyncd.exe"\\?\C:\Program Files\TeamSync\teamsyncd.exe" serve --api-port 49914 --token wjx3yRzvecXrwYvDDAjRjsgovf6fH7imtSADobed --exit-on-stdin-close3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2956 -
C:\Program Files\TeamSync\syncthing.exe"C:\Program Files\TeamSync\syncthing.exe" serve --no-browser --no-restart --home=C:\Users\Admin\AppData\Roaming\TeamSync\st --gui-address=127.0.0.1:500644⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:5364 -
C:\Program Files\TeamSync\syncthing.exe"C:\Program Files\TeamSync\syncthing.exe" serve --no-browser --no-restart --home=C:\Users\Admin\AppData\Roaming\TeamSync\st --gui-address=127.0.0.1:500645⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
PID:1972
-
-
-
C:\Program Files\TeamSync\syncthing.exe"C:\Program Files\TeamSync\syncthing.exe" serve --no-browser --no-restart --home=C:\Users\Admin\AppData\Roaming\TeamSync\st --gui-address=127.0.0.1:500644⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Program Files\TeamSync\syncthing.exe"C:\Program Files\TeamSync\syncthing.exe" serve --no-browser --no-restart --home=C:\Users\Admin\AppData\Roaming\TeamSync\st --gui-address=127.0.0.1:500645⤵
- Executes dropped EXE
- Modifies trusted root certificate store through registry
- Reads the TCP/IP host and domain name from the registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2388 -
C:\Windows\system32\route.exeroute print 0.0.0.06⤵PID:4180
-
-
-
-
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4856 -
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 4BA286EB51481EF3374811B1988A5FB8 C2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2244
-
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵PID:4600
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Checks SCSI registry key(s)
PID:2508
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
2Install Root Certificate
2System Binary Proxy Execution
1Msiexec
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Config.Msi\e5a35e7.rbs
- Size 10KB
- SHA256 4cc0c06b0af568aabc70eac7a7152ba880e808b68ca5164891b0296fd2aea680
- MD5 cd0dddb4fd06d3be6e1697e23bc4714e
- SHA1 534927e2d977f7ae8f049141ff45eba2629dfcf7
- SHA512 2acd47bb6fa2ef69f857de5b63614339bfc842c1b4fd6ba5ed51fe2ee28c887aa47090670aed9da1d320a54f4c05e93cb42462a74c293ae226ce3102a3926169
- SSDEEP 192:9s9Fokkz6j01nCjlf2GQf2muA3M7WxiNpwp/:9s9Fokkz6jiefufvQNo
- TLSH T1CD22FF42A600C6D2FDD61B34C7074B207BA3D6D9A708630F3A8D45716F97B942EE86DE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TeamSync\syncthing.exe
- Size 26.2MB
- SHA256 e33d934db704c9a3c7c46488d34ba655d676ac17234f01f3025740ffa4655dae
- MD5 320aca8c755bb8d7f86973bcab223aaf
- SHA1 70896ea13fe2a24fe5daeb629b880d3f0352d02b
- SHA512 8496da12bdf66644a977aaaab9a31028bd862a6a108bfce4552cd1dcf26ebe0a9ab05884f35e7192295c6321b47294382315be601b7d48c1f536bf63838954f7
- SSDEEP 196608:0q1kPORistrhZvq++eAWt3mesZdRP9BHi//eII6APJWrE:VkGJhZi+XvtLYdx9BH6/eJWrE
- TLSH T1A1575A53F86A58E5D0ADD530C6628512BFB17C999B3023E71B50F6202F7BBD06EBA344
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TeamSync\teamsync.exe
- Size 16.1MB
- SHA256 6bc1db82069df150daaf9604fc632dc7be7e76d761ddb413b4fde57d7fce7297
- MD5 88e74aff7964afac051853ae287dd3b0
- SHA1 9aeea6dec3ad16f5d8358a3a5f5a362e8d75779e
- SHA512 ed1cb3f7ff0555c93f4675cbd224e107287d9ba7f608e74b3beea9833d4ed3baa2deaf1a8d9a3542f012a502788e508bd362bbdf7c872c2454d1eb33de6743a1
- SSDEEP 196608:ckE5Og5CITfEJld9pPEJM9SPngGvg8FP/S5UDg6ZNfG47k:cWJld9pPEJM9SPngGNFC5UU6ZNfG47k
- TLSH T1D007E7257B5A99ACD09BC474838B8662097134CB0B35B9FF44C496383F7ABF52F38259
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\TeamSync\teamsyncd.exe
- Size 6.3MB
- SHA256 469c5a08f81d515cdfddfd742787d31529ee23cd8c79e36d7a597fc69a3ec079
- MD5 4ffd37cfb9fde40780923138a87d3d91
- SHA1 9052bdd86bf574627bbf7e61a8f553a0a200cbfb
- SHA512 120cf82bd998ac04a8765306936cc367cbacd024579a7607f47fb91656cf929935f73d5bd8342989ed4fd5cbce6a30a32add739bc22bac074377f245c94a8668
- SSDEEP 49152:pirvmciwyzO6VfWgWuliVFx3ZMp52eBf5AA/ykrEw5EBJ+Ooew4qpXghSacVE:HzTOMNp52e8xaEB64uw
- TLSH T13D664A43FCA545E4C0AAE63586629253BA71BC485F3127D72F60F7282F76BD0ABB5700
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSync\TeamSync.lnk
- Size 1KB
- SHA256 45fa030a3edcc2596e9a2f20550ea53d8c65606e7dc841bcd64c41bef0025f4e
- MD5 ff5fb60882ea36d1541dd06d76308b84
- SHA1 03ffb4245f5ba647248105058045255781479f3f
- SHA512 329a72e515d5ab71390f521c41705a932d004c3931039aa9693d88f3e519c8f66ef7567bf8cb62da0133b4ba9f4680feb698f66af280bd73fc0f945b0242a162
- TLSH T11941A20157ED076AE3736BBA766206218F72FC11DD684F2F418542861964941ACBEF3A
- MD5 SHA1 SHA512 TLSH
- Path C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamSync\~eamSync.tmp
- Size 1KB
- SHA256 2ad0f702bb448c84d0ae7ade64671acbd10386260fc56ebc63bc6124ff7b78d0
- MD5 cf233483227fb717c6c81cbe0fb558c7
- SHA1 8cd16c0090b2514fa2c61273a8283d10a4985db2
- SHA512 6ba48664bd259892bbbef128215e28d9271862389f24fb6365ece7bec042ade2ad13db5a76031fe7111c765823907fbe5442cb4463abb4b1575c8e84f3f28fc1
- TLSH T1CF41F30167ED0766E3736BB6367106228F72FC11DD684F2F804442C61D649409CBEF2A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\MSIC828.tmp
- Size 132KB
- SHA256 7f47d98ab25cfea9b3a2e898c3376cc9ba1cd893b4948b0c27caa530fd0e34cc
- MD5 cfbb8568bd3711a97e6124c56fcfa8d9
- SHA1 d7a098ae58bdd5e93a3c1b04b3d69a14234d5e57
- SHA512 860cbf3286ac4915580cefaf56a9c3d48938eb08e3f31b7f024c4339c037d7c8bdf16e766d08106505ba535be4922a87dc46bd029aae99a64ea2fc02cf3aec04
- SSDEEP 3072:Kx2YbpcgwmiTPJDnCO+DATkURBnrskNwPj2:XXgwmY1CPx2XG2
- TLSH T1DBD39D02B5D0C473D9BE09390870DB229F7EB930DF909EDB636856699E702C19E35A37
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\2f11e5ff-9959-46d1-aef2-1b995ee9c965.tmp
- Size 15KB
- SHA256 0bba79b5b3603b88fcbb0b0153e259a56049380dfc26f5d53f150d104f6a5af0
- MD5 fa7cc8e9372ccd07259932847822ed11
- SHA1 20fa0b28ef7fa56aad2e79d192741848fde02bfe
- SHA512 22d8bbd197557168c98373dc2550390b464d5d6e5fc372b3094eb1ef487cd89a508c9d1c71311bf12f71d71f1d0a39eca16b6de10d6c444a1097b094d483b095
- SSDEEP 384:v+OBqImmJvGBLx3NaFMJFNNBS5odEWvLoig6rO:ucvGtlNDska
- TLSH T17E72AE7A2C256F237CFB8909BE8D678BCB65A253C0D177D4DCEC5F0E416E1442392916
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\33b95fd9-ea16-4f01-b4ec-36a69e83464c.tmp
- Size 2KB
- SHA256 8d5903b10573efad58393bbba8a7385c231c77992bbed5c37e2d404e534412f8
- MD5 6669fe75593cf9bcd084bd57a62f8779
- SHA1 b1768366ae76753952daa89731f5c16521389d13
- SHA512 b8eecbcaadf2f9e749441960f9e2b93cb6a8d73ec20865066b336359820dcba5e7148d93c2066461ebb818041ee2fd35fdc0818f28db572206a3f47013cf8526
- TLSH T1305195337810AF33EEF65A4879163F67CA39906196622F509AEC0B1C01C635D3381C3B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\5d2e0abf-ebd2-425d-a3ee-e782ccaebbf7.tmp
- Size 3KB
- SHA256 ef6641f9360235a2fad216d535c31f3559257b49dd3305c506b5ed2b67c14d6e
- MD5 72dcce9ba476a5366021a70c10c6755e
- SHA1 e8d063280bc0e666add31b158264ada28f17e7b2
- SHA512 e60e7343ce6fab1aead585acd5adc8f9690f9104b8f8adaab1334870ffb20e850315fc02ac7188723d656a099b29716b2167ceecd02e32c7da32e77e31e8c163
- TLSH T1E96184366974EE379EF69A09B8463B16E7659023D5923F94DAEC0F1C01D73982381C27
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 ff48012a393e495b5ada8b3476ee2e1e6cf048ad9825827295971f0a6cd3058f
- MD5 ef48d9be0131dc0f4ec9d3937103538b
- SHA1 9f169ff95804f18a8d3887ebe35d01b967780d93
- SHA512 7a38d2fa813c2b22312b4cff852fa084780be8dbf6a19cb7245fc2ced0d4b82b237939b6fe8881406bdb913a99491d12fb99702c1b63cedcd282ea7921a10512
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Crashpad\settings.dat
- Size 280B
- SHA256 f6be8127d4345fcab2923b1150cc89b432096c4864f354b433867c61c6e66654
- MD5 23316684df1a4c1ff7f6845c6df173c5
- SHA1 c88d599530ae9ef7f57e45b7364b27f28815ca8e
- SHA512 0b6bb3b925a1bb1ea6b62f596f490d8f5859ae58e1cc0a11aa97988cbca23c6c6675982adf7308bdf30afd1d2746718d5e497a6457fb9d76de7d3a5b80355933
- TLSH T139D0122376414134C410203301D2A10C0880D10F40C64101543A951D2B040651A12491
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Crashpad\throttle_store.dat
- Size 20B
- SHA256 41c91a9c93d76295746a149dce7ebb3b9ee2cb551d84365fff108e59a61cc304
- MD5 9e4e94633b73f4a7680240a0ffd6cd2c
- SHA1 e68e02453ce22736169a56fdb59043d33668368f
- SHA512 193011a756b2368956c71a9a3ae8bc9537d99f52218f124b2e64545eeb5227861d372639052b74d0dd956cb33ca72a9107e069f1ef332b9645044849d14af337
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\690a6cd4-ae92-4408-aa5c-326fd9fa8b3d.tmp
- Size 6KB
- SHA256 bef292155f549bef396493bf15084ff13a8855d73513d77b4ff838c44efe15d3
- MD5 339399f6c0468ed727fb4fa2b9d32393
- SHA1 b1f6c13c3d904b28e94e4aa632514ccfddf5f5b3
- SHA512 d26e0e46359975296bd4a8ba17e237da82a1a942275c5e5110466d054713c786615d6e74af593820909bb5694343a4a45b166f5572cba1a80bfd8779ea17184b
- SSDEEP 96:stF/dZamibXb9lhkl1o5h16Z0AAs7/x+6MhmuecJAmEZ1ejeWK+g1FP28XM1C7K:st5L9+hYonAAsV+FdAmEZQjmXFPG6K
- TLSH T1D4D185025E24BD7B4CC6E209BA39BA47E2F6907265D21E58E7F8463C04DA6CC631790B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\Code Cache\js\index-dir\temp-index
- Size 96B
- SHA256 ad200638881c5dba3a795e403855ad3cef5d042c41e7199561b2650dbf81cf46
- MD5 7789666cd28c504720da7f2fec7070ab
- SHA1 70bfb3aaed5103da2453488fa8eab4a3f69bab87
- SHA512 6931224aafe17390d409e11697d06d6104d269dad18aeaa3f773bea3fac063b8c900ae1285117cf49f772b67a6bfbb67f2cbac6bb2ead7fa2025d264364baf42
- TLSH T1EDB0015A44ADA412D3C45B7117C6354975B20DA62AAB1B42989D41AAE96234A8202419
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\Code Cache\js\index-dir\the-real-index
- Size 48B
- SHA256 23234427f8fbb158ec8433425404174774d68fb2694e7c14e72d73d6fc748d76
- MD5 dae3fd9456f04a13e095a4ba639e05b3
- SHA1 07e4d013c71a31ba54a0e5c823c24aff376203f2
- SHA512 ee941a3f9b18c3f612b7053f99f0ff08efcab9b0d31f1272c01a4f28d8012225c7db9f1813d481632cec5c254a355e7e24e19d310d00df10adeafa6ce7e3c2f8
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\Network\Network Persistent State
- Size 59B
- SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
- MD5 2800881c775077e1c4b6e06bf4676de4
- SHA1 2873631068c8b3b9495638c865915be822442c8b
- SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
- TLSH T164A0026A99622D881B4A83902B18B547807B0445230982FDE43877A8415616D5C2C855
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\Network\a2cc17e7-b7d8-4e66-b50a-cc1b64f7f02a.tmp
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\Sync Data\LevelDB\CURRENT
- Size 16B
- SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
- MD5 46295cac801e5d4857d09837238a6394
- SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
- SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Default\Sync Data\LevelDB\MANIFEST-000001
- Size 41B
- SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
- MD5 5af87dfd673ba2115e2fcf5cfdb727ab
- SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
- SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\GrShaderCache\data_0
- Size 8KB
- SHA256 d6a5fe39cd672781b256e0e3102f7022635f1d4bb7cfcc90a80fffe4d0f3877e
- MD5 cf89d16bb9107c631daabf0c0ee58efb
- SHA1 3ae5d3a7cf1f94a56e42f9a58d90a0b9616ae74b
- SHA512 8cb5b059c8105eb91e74a7d5952437aaa1ada89763c5843e7b0f1b93d9ebe15ed40f287c652229291fac02d712cf7ff5ececef276ba0d7ddc35558a3ec3f77b0
- SSDEEP 3:MsFl:/F
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\GrShaderCache\data_2
- Size 8KB
- SHA256 ec1702806f4cc7c42a82fc2b38e89835fde7c64bb32060e0823c9077ca92efb7
- MD5 0962291d6d367570bee5454721c17e11
- SHA1 59d10a893ef321a706a9255176761366115bedcb
- SHA512 f555e961b69e09628eaf9c61f465871e6984cd4d31014f954bb747351dad9cea6d17c1db4bca2c1eb7f187cb5f3c0518748c339c8b43bbd1dbd94aeaa16f58ed
- SSDEEP 3:MsHlDll:/H
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\GrShaderCache\data_3
- Size 8KB
- SHA256 e09f42c398d688dce168570291f1f92d079987deda3099a34adb9e8c0522b30c
- MD5 41876349cb12d6db992f1309f22df3f0
- SHA1 5cf26b3420fc0302cd0a71e8d029739b8765be27
- SHA512 e9a4fc1f7cb6ae2901f8e02354a92c4aaa7a53c640dcf692db42a27a5acc2a3bfb25a0de0eb08ab53983132016e7d43132ea4292e439bb636aafd53fb6ef907e
- SSDEEP 3:MsGl3ll:/y
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\GraphiteDawnCache\data_1
- Size 264KB
- SHA256 902f30c1fb0597d0734bc34b979ec5d131f8f39a4b71b338083821216ec8d61b
- MD5 d0d388f3865d0523e451d6ba0be34cc4
- SHA1 8571c6a52aacc2747c048e3419e5657b74612995
- SHA512 376011d00de659eb6082a74e862cfac97a9bb508e0b740761505142e2d24ec1c30aa61efbc1c0dd08ff0f34734444de7f77dd90a6ca42b48a4c7fad5f0bddd17
- SSDEEP 3:MsEllllkEthXllkl2:/M/xT02
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\com.teamsync.desktop\EBWebView\Local State
- Size 1KB
- SHA256 6f694f71b90e15e3a75941431631253221608ab8d0c08a7b1db8c7cfb67275d9
- MD5 da7b8e630c4c27a5369e71fdf6cff952
- SHA1 4def9f543fc0023e4b34312444c51e6acd2ec6ff
- SHA512 ba9248844a06a62c784faea08a1e4a98ad6142226cc4bb7c4fda574bcb98a1634e3d3d4b3cbf954d286b4f8f37a4c49467d8d8cd0610dfc42f8f7079fb95cf4c
- TLSH T114219872E5245F33FDD6554A2121BAABCF31906282614E0054DC072C02D635DB6AAC37
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\TeamSync\st\cert.pem
- Size 623B
- SHA256 8a6b149df97f505652a255ffd097486c1bee69f268c9186bad4e323e82edf395
- MD5 7993f65aa8f4ddea66286aeefd4f389d
- SHA1 b886cb015757d41fde94e9677289931721a6bc66
- SHA512 83debc63216bb953e736b107201c1ee3778c7bb18eda20a76076dd0584887a74ddbabb630dce180e0a974a257cc594f2144328928186e0605991a147e2049810
- TLSH T1FFF0DD239E401C411DFFE0008177B24472694642EC0171F900B43190FACD5816FDCB8A
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\TeamSync\st\config.xml
- Size 6KB
- SHA256 64be6234105edecf75d7d0f279379581e06cd381c78b466315fe2921a5985080
- MD5 ad80230a1b3b22795de328276f8afab8
- SHA1 9f9ba5a366314985aedf215fbc05ed75402d63f1
- SHA512 b69ec12f73769804868b1fbf1b4968311c10d4f06d25afe988b11dc6d4cc7f77714e3f289859f739e4f68f74f13229af1588288fcb876fb9cd2ac51538dfc379
- SSDEEP 96:Ygb6R8uUk5sawhO3HbH1dhxFozM6n6B/OJBtRtQV3xerpgrX6b6RLkEmbGty4qhJ:YgbdR/GT1d/4BtRu3sAqbKkbGg4qhJ
- TLSH T1E7D152E1BAC07296827390E7CAF05B0DDE37918337070169B5DC838B7F7C895688366A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\TeamSync\st\config.xml
- Size 6KB
- SHA256 4908bcc83322cd1636c2fbf5594acbc09cd543ca3293027762c8befda24620ab
- MD5 4196940c00b2acd3fce3f9ee4ae77c61
- SHA1 f0165dc09041a09884aaff1d92c299b081a30ac6
- SHA512 01e3ccb2c098596c5e4c0fc1b0b73e9be5cfc7673cd25150807687e49eb8b5df13f99269c9dd1a500ded365c6e5eb61fdd46e8fc21014ed5ae373c05a9572979
- SSDEEP 96:Ygb6R8uUk5sawhO3HKH1dh6kazM6E6iQ/OJBtR2QV3xerpgrX6b6RLkEmbGty4qT:YgbdR/GC1dW+BtR73sAqbKkbGg4qhJ
- TLSH T103E164E1BEC0329A827390EAD9F05B0ADE37508337070165B5DCC28B7FBC499688357A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\TeamSync\st\key.pem
- Size 119B
- SHA256 ae5052172000a7d9ceccf025a5ed9d0b776900eb54a01d28a962d2b9efb5789e
- MD5 9ad1dfd64eea8c3cccb62b5aab9d6653
- SHA1 8d89876e367517706391052594b09bf66a451aff
- SHA512 443c5e75fbafeee8e5cf895d53309a02204326dbe108c09e6c6078119806662b1cb15125a821fea2065ec17b703fbf42f8d45d2c412976b2c2e020f863dff280
- TLSH T140B092930DAE1D94C06EF2EC9C071A3BC624C6B24B9422F1029704023203D89B43EC0E
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\TeamSync\st\syncthing.log
- Size 853B
- SHA256 c7ae2a1c4248da9b5c61ebf52b1b8f956913f566dcc43f1f860b1c73d9419840
- MD5 c6e33a13ccf0a5beda678a3e4a8cfdc8
- SHA1 3648da3f04f8bbb8cfe13e98949dd82da0b0aea3
- SHA512 c29ca637af188aac3ba6bf54a72e19430e7e6c83bce009f6d713bf7e6ce68245481dad4a0b3cbd030a407e5e29df719e4ca7cbd0658089a1c008ba2a2a791121
- TLSH T18F011223104E8EA715512457C33888D90D6012CD2B5B3F7CF92ED88C3E64D68F454481
- MD5 SHA1 SHA512 TLSH
- Path C:\Windows\Installer\e5a35e8.msi
- Size 19.8MB
- SHA256 bcb2e1cf227dcbb1f9ec190eb9729bfcdfb8da03f84f8d3eec16ddf666cf151b
- MD5 6805ae63ab5b6e9ffe4ba94ab8e43ef4
- SHA1 3ba349bcd968d839783b059f47236101a180ee57
- SHA512 4581f367f7e347e767600d723f2e5d992fa30169493005154174f732fd6ce02a7b634c6dbcd66057b11b7d70c23d210b3889018e450d9c3d8ce0674efbe32fb7
- SSDEEP 393216:12cioc6RRf9q1NZZDmiEVvhlujdP+MemWglwzrkIbJjB2FWabgTc0YOqVeyDMB5E:h5DH4NIn8xP+Memz0kIbJj4WaUTNya5I
- TLSH T16527338B7D62E162D85F8DB6047157610A3E3D447A048D17E23C31A8FEF22C51BBAED6
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping1996_1729029212\manifest.json
- Size 116B
- SHA256 181a1631374b5ac1fff89559f7e23498ad9ee4796885d7b956d5e7d5f9c3f8c7
- MD5 daf93729356a67ea1f849554827fdab1
- SHA1 17dad0cbc82d5e04fb068896a5832f983e124c01
- SHA512 473d9d608f2f3324d5db6eddeb4554a7271df4a6b62377820d935c001a8a2376479aa4d3e3b80ffbfdd3ba80f56fe72f1bc9dd020bcb396182b753353b883a30
- TLSH T1FBB09262A8084633249523F4A2639363CBA86D4A91346606091B9480659E73B22A5219
- MD5 SHA1 SHA512 TLSH
- Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
- Size 26.1MB
- SHA256 6eef3106205a9c4ab9861219f39c79e7847536f9156d3209a11053e5bc1b84f0
- MD5 4cb9d83a1b4a45fe552f357ae6bb9f7f
- SHA1 c9c47ef46f8751b3f96b2aec5155713423eaaf5e
- SHA512 942eab792821e0565f16c8fc506db652c5c66a1d11df59b513b9f06cd3abe43cbf1a674f60f11db9fbf17f66485f43c65afcc396d99b442d128de817af082bfd
- SSDEEP 24576:RFo3DMPcdoO/vvTL/Sgn3iFwfru9MrwkEqhl9qJfBiJ6JQ2XMYR23uNmz+r:YHk
- TLSH T16D57022472F92211E7F39E3CA8F06A23493E7D9B9C15DE8D45411B4E0862F71E872F66
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path \??\Volume{e3f46304-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{2e27a50d-b660-4d41-bbdd-f688bc002db9}_OnDiskSnapshotProp
- Size 6KB
- SHA256 235604dee3ab50f74ed2c895672bd6add742486ab9795bb36af669ab646cecb9
- MD5 7e28ac84e11424a59bdd363abeb32a52
- SHA1 9ff7a05775ac592763a4c374a68c7e511e24f4d1
- SHA512 a9a29a126f804bbb26e17c616340d79c53776a491fdf3718faf212cb916ce85c3514a2d5e8871534ec561e9970aee2d46d754b5dc0061e1899e024af3acd46ae
- SSDEEP 96:FAQXjn8vc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:aQsb++uVmN
- TLSH T19BD198084AF54711E2B3AB3128F18557A877B812EF33CB8E0198238E6671910F875F6B
- MD5 SHA1 SHA512 SSDEEP TLSH